Mert

AI Agents in the Enterprise: Why Less Can Be More

yazar
Infographic: Enterprise AI Agent Sprawl and the Path to Orchestration

The artificial intelligence revolution has arrived in corporate boardrooms, and it is bringing a surprising problem: too many AI agents. While enterprises rushed to deploy autonomous AI workers over the past two years, many are now discovering that an abundance of AI agents can create as many challenges as it solves. This phenomenon, sometimes called “agent sprawl,” is reshaping how organizations think about artificial intelligence deployment and governance.

Infographic: Enterprise AI Agent Sprawl and the Path to Orchestration

The Rise of the AI Workforce

The enterprise AI agent market has exploded since 2024, with companies deploying hundreds or even thousands of autonomous agents to handle everything from customer service to code development. According to industry estimates, the average Fortune 500 company now operates over 500 AI agents across various departments. These agents range from simple chatbots handling routine inquiries to sophisticated systems capable of writing code, analyzing financial data, and even managing other agents.

OpenClaw founder Peter Steinberger revealed that his company runs approximately 100 AI agents at a cost of $1.3 million monthly. This eye-watering figure illustrates both the scale of modern AI operations and the growing costs associated with maintaining a diverse agent workforce. For smaller enterprises, similar deployments can quickly consume IT budgets and create unexpected complexity.

The original promise of AI agents was straightforward: automate repetitive tasks, reduce labor costs, and free human workers to focus on higher-value activities. Early adopters reported impressive gains in productivity and cost savings. Customer service departments reduced response times by 80 percent. Software teams accelerated development cycles. Financial analysts processed market data in minutes rather than hours.

The Hidden Costs of Agent Proliferation

However, as deployments scaled, a different picture emerged. Organizations began experiencing what researchers now call “coordination overhead.” When dozens or hundreds of AI agents operate simultaneously, they frequently encounter each other, duplicate efforts, or produce conflicting outputs. A 2026 study by Stanford and MIT researchers found that enterprises with more than 200 AI agents reported a 35 percent increase in time spent on oversight and coordination.

The problem extends beyond simple inefficiency. AI agents, lacking human judgment, sometimes make decisions that contradict each other or conflict with company policy. One major financial services firm discovered that three separate AI agents had negotiated different discount rates with the same client, creating both confusion and potential compliance issues. Such scenarios highlight the need for better orchestration and governance frameworks.

Security researchers have also raised concerns about agent sprawl creating expanded attack surfaces. Each AI agent represents a potential entry point for malicious actors, and poorly managed agent ecosystems can leak sensitive data or execute unintended actions.

The Meta-Agent Solution

In response to these challenges, a new category of AI has emerged: the meta-agent or agent orchestrator. Intercom, rebranded as Fin, recently launched an AI agent specifically designed to manage other AI agents. This approach reflects a broader industry trend toward hierarchical agent architectures where supervisory agents coordinate the work of specialized workers.

The meta-agent concept addresses several key concerns. First, it reduces direct human oversight requirements by automating coordination tasks. Second, it creates a single point of control for policy enforcement and compliance monitoring. Third, it can optimize resource allocation across the agent workforce, preventing duplication and conflict.

Oracle has similarly integrated agent management capabilities into its APEX platform, enabling enterprises to build, deploy, and govern AI agent ecosystems from a unified interface.

Governance Frameworks for the AI Workforce

The emergence of agent proliferation problems has catalyzed new thinking about AI governance in the enterprise. Traditional IT governance frameworks were not designed for autonomous systems that make decisions and take actions without human involvement. Organizations are now developing specialized policies addressing agent authorization, decision boundaries, audit trails, and failure modes.

Some companies have established “AI Agent Councils” charged with approving new agent deployments and ensuring alignment with business objectives. Others are implementing agent registries that track every deployed AI worker, its capabilities, limitations, and interaction patterns. These governance mechanisms aim to balance the benefits of agent automation against the risks of uncontrolled proliferation.

Regulatory bodies are also taking notice. The European Union’s AI Act includes provisions specifically addressing autonomous agent systems, requiring transparency about AI decision-making and human oversight mechanisms.

Best Practices for Sustainable Agent Deployment

Industry experts recommend several strategies for managing agent ecosystems effectively. First, organizations should conduct thorough needs assessments before deploying new agents, ensuring each agent serves a clear purpose that cannot be better fulfilled by existing systems or human workers. Second, implement tiered governance based on agent capability and risk level, with more stringent oversight for agents handling sensitive data or high-stakes decisions.

Third, establish clear escalation paths when agents encounter situations beyond their competence. Fourth, invest in monitoring systems that track agent performance, interaction patterns, and resource consumption. Fifth, regularly audit agent behavior against company policies and ethical guidelines.

The goal is not necessarily to reduce agent counts but to ensure each agent provides genuine value within a well-coordinated ecosystem.

The Future of Enterprise AI

The AI agent proliferation issue represents a natural maturation phase in enterprise artificial intelligence adoption. The emergence of meta-agents and governance frameworks demonstrates the industry’s capacity for self-correction and optimization.

Looking ahead, analysts predict continued growth in enterprise AI agents, with global spending projected to exceed $150 billion by 2028. However, the nature of deployments is likely to shift from quantity-focused proliferation toward quality-focused orchestration. Success will increasingly be measured by outcomes achieved rather than agents deployed.

For enterprises navigating this transition, the message is clear: more AI agents is not inherently better. Strategic deployment, robust governance, and thoughtful orchestration will determine which organizations thrive in the age of artificial intelligence.

What Happens When the Breach Happens Somewhere the World Forgot to Defend

yazar

This is a submission for the Gemma 4 Challenge: Write About Gemma 4

What Happens When the Breach Happens Somewhere the World Forgot to Defend

I’m a 21-year-old Cybersecurity and Digital Forensics student at Caribbean Maritime University in Jamaica. My research group spent months building an academic proposal on IoT forensic challenges in the Caribbean — the gap in standards, the resource constraints, the fact that most forensic frameworks were designed for labs that don’t exist here.

That research sat in a document. It felt incomplete. Not wrong — just theoretical.

Then I built Threat Trace in 12 days for the Gemma 4 Challenge and something clicked.

The problem I kept running into

Caribbean institutions — hospitals, universities, government facilities — are deploying IoT devices at scale. Smart sensors, networked cameras, connected infrastructure. Most of it is third-party managed, under-resourced, and running firmware that hasn’t been updated in years.

When a breach happens, the forensic playbook assumes things that don’t exist here. Dedicated forensic hardware. Large IT teams. Vendor support that shows up same-day. Regulatory frameworks that actually map to the local legal environment.

None of that is guaranteed in Jamaica. Most of it isn’t there at all.

So when I started thinking about what to build for this challenge, I didn’t want to build another generic demo. I wanted to build something that made the problem tangible — not a report you read and forget, but something you feel.

Why a simulator and not a tool

There’s a difference between knowing forensic methodology and understanding why it matters.

I’ve studied the 6-stage forensic process. I know what chain of custody means. But reading about it and making a decision under pressure are different things. The second one sticks.

I built Threat Trace so that when you choose to reboot a compromised sensor instead of isolating it first, you feel it. The integrity meter drops. The feedback tells you exactly what you just destroyed. And then you have to keep going with contaminated evidence.

That’s the lesson. Not a textbook explanation — the consequence.

The game generates a full investigation from any IoT incident you describe. Gemma 4 31B reads your scenario and builds 6 forensic stages, each with real decision points, real evidence, and real consequences for wrong choices. At the end you download a forensic report — actual methodology, actual findings, usable outside the game.

How I actually built it

I didn’t start with code. I started with a scenario.

“A smart water pressure sensor at a children’s hospital in Mandeville began sending encrypted packets during maintenance windows — always 1AM-3AM, never consecutive nights. A nurse in the maternity ward noticed hot water pressure dropped every time the anomaly occurred.”

I wrote that prompt and fed it to Gemma 4 through the Google AI Studio API. What came back wasn’t what I expected.

Gemma didn’t just map an attack technique. It identified a function in the generated firmware called trigger_valve_bleed() — called immediately before send_encrypted_payload(). The physical pressure drop wasn’t a side effect. It was a signal. The attacker was using the hospital’s water valves as an out-of-band heartbeat to confirm successful exfiltration to a local observer.

I didn’t tell Gemma to find that. It reasoned to it from context.

It also caught that the non-consecutive timing was deliberate evasion of threshold monitors. And it noted that a nurse — not IT, not a SIEM alert — was the first line of detection. That detail is the most Caribbean thing in the whole report. And Gemma put it there.

That’s when I knew the model could carry this build.

The architecture decision that made it free to run

One API call per investigation. That’s it.

When you submit a scenario, Gemma generates everything upfront — all 6 stages, every choice, every consequence, every narrative, the full report. During gameplay there are zero API calls. Every response is instant because it’s already computed.

This matters because the communities this tool is meant for can’t afford per-request costs at scale. Front-loading the generation makes free 24/7 deployment viable. Cached scenarios cost nothing to replay.

The structured JSON output from Gemma 4 was critical here. The model’s thinking mode can produce loose text that breaks parsing. Forcing the output format through the API config takes the parse failure rate from around 50% to near-perfect. The game state is deterministic — the correct answer is pre-computed, so scoring requires no AI at runtime.

Why Gemma 4 31B specifically

Three reasons that weren’t negotiable.

Context window. IoT incidents don’t happen in isolation. Logs from 12 sensors, network captures, firmware analysis, infrastructure context — it all needs to be in one prompt for the model to reason across it. Gemma 4 31B’s 256K context window handles that. Most open models cap at 8K-32K. That’s not enough.

Structured output. The game lives or dies on clean JSON. Gemma 4 delivers it when you configure the output correctly.

Open model. The whole point of this build is accessibility. Using a closed API to solve an accessibility problem is a contradiction. Gemma is open. Anyone can run it locally, self-host it, extend it. That matters for the communities this is built for.

What the Caribbean context actually changes

Most forensic simulators are built for abstract environments. Generic corporations, unnamed cities, fictional institutions.

Every case Threat Trace generates is grounded in real Caribbean constraints — NWC managing critical hospital infrastructure remotely, university IT volunteers running forensic investigations with borrowed hardware, JCF Cybercrime Unit reporting requirements, the Jamaica Cybercrime Act.

When Gemma generates a case set in Mandeville or St. Elizabeth, it doesn’t just change the location. It changes the available resources, the institutional dynamics, the observation chain. The Mandeville hospital case had a nurse as the first line of detection because the IT team was small and overwhelmed. Gemma inferred that from the context I gave it.

That specificity is what makes the tool feel real rather than academic.

What I actually learned

I started this as a student who’d written a research proposal about IoT forensics in the Caribbean. I finished it having built something that demonstrates the problem more clearly than the proposal did.

The 40/60 score and 70% evidence integrity on my first run through my own simulator told me more about my actual forensic decision-making than any exam has.

Gemma 4 didn’t just power the build. It challenged me inside it.

That’s what an open model at this capability level makes possible — not just better apps, but tools that give real feedback to the people who need it most, running in environments that can’t afford anything else.

🎮 Play Threat Trace →

🔗 GitHub

Let’s set up a grow tent!

yazar

This time, I’m building the growing environment inside the tent.
(I introduced the items I bought in a previous post!)

1. Build a grow tent

First, I tried to build a grow tent. It was easy to assemble and took only about 15 minutes.

2. Set a shelf

Then, I placed the shelf inside the tent. It’s a bit smaller than I expected, but I think it’s enough for the prototype.
It has three tiers, I will first use only the second tier and expand it later.


After that, I installed the light at the bottom of the first-tier.

3. Plant the seeds!

In this time, I decided to build a DWC-based hydroponic system, so please imagine securing the plants to a piece of Styrofoam floating on nutrient.

Firstly, make holes with a radius of 1.5 cm in the styrofoam board.
You’ll need to determine the spacing between holes based on the type of plant. Since I am planting perilla and baby leaf green seeds this time, I’ll space the holes 15 cm apart for the perilla and 5 cm apart for the baby leaf greens, as recommended.

Cut the sponge into 2-cm squares. (Cut them slightly larger than the holes to ensure the sponge stays securely in place.)

Make a cross-shaped slit in the sponge, soak it thoroughly, and then place the seeds inside.

Fill the tray with water so that the bottom of the sponge is just barely touching the water.

4. Set everything inside the tent

Set these things inside the tent and turn on the light.
I’ll wait until the plants sprout. I can’t wait!

The next day, I saw something white starting to sprout from the seeds!!

I feel like I’m the parent of these seeds…I’ve already grown attached to them!!!
By the way, I hear it takes about a week for baby greens to sprout.
Let’s hope they grow well.

How to read any legacy codebase. The archaeology playbook.

yazar

How to read any legacy codebase. The archaeology playbook.

Somewhere on a hard drive sits a folder of low resolution scans of Russian typewritten pages from the 1950s. The pages describe PP-BESM, the first high level programming language compiler ever built in the Soviet Union, designed by Andrey Ershov. A developer who goes by xavxav is rebuilding it. Not emulating it. Rebuilding it, line by line, from the scans. The repo is real, the VM runs, the PP-3 phase has an initial pass. You can clone it.

That project is the extreme version of every “I cannot read this codebase” problem you will ever have at work. Same shape, more dust. The PP-BESM author published a writeup last month that, once you strip the Cold War aesthetic, reads like the cleanest manual on legacy codebase archaeology I have read in years.

This article is that manual, generalized, with the techniques you can apply this week on whatever inherited PHP, COBOL, Perl, or Java 6 repo is currently your problem.

TL;DR

Stage What you do Why
1. Boundaries map inputs, outputs, side effects you cannot understand the inside until you know the outside
2. Harness build a way to run the code in isolation the loop is the whole game
3. Bisection narrow the search to the load bearing 10 percent most code is glue
4. Naming rename systematically as you understand you are leaving notes for future you
5. Types add types where there are none, even loose ones types are documentation that runs
6. Tests as ground truth write tests that lock in observed behavior refactoring without tests is fiction
7. Document negotiations comment the why, never the what the why is what time erases

The order matters. Skipping ahead is how teams spend six months on “modernization” and end up with a worse version of the same system.

1. Boundaries before internals

The first move on any unfamiliar codebase is not to read the code. The first move is to draw the boundary.

For a web service: what HTTP routes exist, what does each one return, what database tables get touched, what external APIs get called, what writes to disk, what fires events. For a CLI: what arguments does it accept, what files does it read, what does it write, what is the exit code matrix. For a library: what is the public API, what does it depend on, what does it monkey-patch.

You can do this without understanding a single function inside the code. The tools: 

# HTTP routes for a Node service
grep -rE "router.(get|post|put|delete)|app.(get|post)" --include="*.{js,ts}" src/

# Database tables touched
grep -rE "FROM|UPDATE|INSERT INTO|DELETE FROM" --include="*.{sql,js,ts,py}" .

# External API calls
grep -rE "axios|fetch(|http.request" --include="*.{js,ts}" src/

# Files read or written
grep -rE "fs.(read|write)|open(" --include="*.{js,ts,py}" .

Write the answers down. This is your map. You cannot understand the internals until you know where the doors are.

For the PP-BESM project, the boundary was the BESM machine model. You cannot read a 1955 compiler without knowing the instruction set of the machine it targets. xavxav reconstructed that from a separate set of documents before touching the compiler source. Same pattern, smaller stakes.

2. Build a harness, even a bad one

The highest payoff move on a legacy codebase, by a wide margin, is to get any version of the code running in isolation, with one input and one observable output, before you try to understand any of it.

For a web service, that means a docker-compose that spins up the app and its database with a single command, with one curl that exercises one route. For a CLI, that means a one-liner that runs the binary with a representative input and pipes the output somewhere you can read it. For a library, that means a five line consumer that imports the library and calls the one function you care about.

If this is impossible, the rest of the audit will also be impossible. Spend a day building the harness. It is the loop. 

# A minimal harness for a legacy Python script
mkdir -p harness
cat > harness/run.sh <<'EOF'
#!/bin/bash
cd "$(dirname "$0")/.."
python3 ./scary_script.py --input fixtures/sample.csv > /tmp/out.txt
diff /tmp/out.txt fixtures/expected.txt
EOF
chmod +x harness/run.sh

You now have a one-command loop. Every change you make from here on can be tested against harness/run.sh. The harness is your safety net.

xavxav’s harness for PP-BESM is the BESM virtual machine he built. Every change to the compiler can be tested by running a tiny Soviet-era program inside the VM and watching the result. The VM is more important than any single piece of the compiler source.

3. Bisection beats reading top to bottom

The instinct on a new codebase is to read the entry point and follow the call graph. This is wrong almost every time. Most legacy code is glue. The interesting logic, the part that actually does the work, lives in 10 to 20 percent of the files. The other 80 to 90 percent shuffles data between the interesting parts.

The fastest way to find the interesting parts is bisection. 

# What touched the database in the last year?
git log --since="1 year ago" --name-only --pretty=format: 
  | grep -E "schema|migration|model" | sort -u

# Where do the longest files live? long usually means interesting
find . -name "*.py" -not -path "*/node_modules/*" 
  -exec wc -l {} ; | sort -rn | head -20

# What gets imported the most? heavily imported usually means load bearing
grep -rE "^import|^from" --include="*.py" . | awk '{print $2}' 
  | sort | uniq -c | sort -rn | head -20

Each of those commands narrows the search. The longest file is often the dumping ground. The most imported module is often the actual brain of the system. The files that show up in every migration are the ones the schema can’t live without.

For PP-BESM the bisection target was PP-3, the last compiler phase. xavxav knew the early phases were better documented in the existing literature. The interesting unknown was the last phase. He focused there first.

4. Naming as you go

Every time you understand a function, rename it. Every time you understand a variable, rename it. Do this in a branch, and commit often.

The temptation is to read the whole codebase first and rename later. This is wrong. You will forget what you understood. You will lose hours of context. The rename is the note you are leaving for future you and the next person. 

// before
function process(x, y) {
  const r = x.filter(z => z.s > y).map(z => z.id)
  return db.query(r)
}

// after, you understood this is fetching active user ids over a score threshold
function fetchActiveUserIdsAboveScore(users, threshold) {
  const qualifyingIds = users
    .filter(user => user.score > threshold)
    .map(user => user.id)
  return db.query(qualifyingIds)
}

A good rule: if you cannot rename a function meaningfully, you do not understand it yet. Keep reading. Once you can rename it, do it immediately, then commit with a message that captures what you learned.

xavxav’s rename pass on PP-BESM was a translation pass, but the principle is the same. Russian identifiers became English identifiers. Cryptic three letter mnemonics became words. The code became readable because someone took the time to make it readable.

5. Types as living documentation

If the codebase is dynamically typed, add types. If the types are wrong, fix them. Even loose types beat no types, because types are the documentation that runs. 

// before, no types
function calculate(data, config) {
  return data.items.reduce((acc, item) => {
    return acc + item.price * (config.taxRate + 1)
  }, 0)
}

// after, types you can refactor against
type LineItem = { price: number; quantity: number; }
type TaxConfig = { taxRate: number; }
type Order = { items: LineItem[]; }

function calculateTotalWithTax(order: Order, config: TaxConfig): number {
  return order.items.reduce((acc, item) => {
    return acc + item.price * (config.taxRate + 1)
  }, 0)
}

For Python, add type hints. For PHP, use PHPStan or Psalm. For old JavaScript, migrate file by file to TypeScript with allowJs: true. The types do not need to be perfect on day one. They need to exist.

The reason this matters more than people think: types compile. Comments do not. A wrong comment lives forever. A wrong type breaks the build. Types are the only documentation format that the compiler keeps honest.

6. Tests as ground truth, even for behavior you do not love

Before you refactor anything, write tests that lock in the observed behavior, including the parts that look like bugs.

This is the most counterintuitive rule on the list. Junior engineers want to fix the bugs immediately. The right move is to write a test that proves the bug exists first, then keep that test passing while you refactor, then change the test deliberately at the end if the bug should be fixed. 

# pin the current behavior, even if it is wrong
def test_calculate_returns_negative_for_empty_orders():
    """
    BUG-LIKE: empty orders currently return -1 instead of 0.
    Some downstream system depends on this. Do not change without
    coordinating with the billing team.
    """
    result = calculate([], TaxConfig(rate=0.1))
    assert result == -1

The test does two things. It tells future you that the behavior is intentional, not an accident. It also acts as the alarm if a “small refactor” breaks the contract.

xavxav’s tests for PP-BESM are not unit tests in the modern sense. They are small Soviet-era programs run through the VM with their expected output captured. Same idea, smaller scope. Pin the behavior, refactor against the pin, change the pin deliberately.

7. Comment the negotiations, never the obvious

Your future maintainer can read the code. They cannot read your decision tree. The comments that survive a decade are the ones that capture why a particular choice was made, especially when the choice looks weird.

Bad comment: // increment counter. The code already says that.

Good comment: // We round down because the billing team expects integer cents only. // Historical: float cents caused the May 2023 reconciliation incident.

The good comment is a note from one engineer to another about a constraint that is not visible in the code. The constraint is real. The constraint will outlive the engineer who introduced it. The comment is the only place it lives.

Run this drill on your legacy codebase: find every place where the code looks slightly odd. A magic number, a hardcoded check, a try/except that swallows a specific exception, a special case for one customer ID. Each one of those is a negotiation that someone made with reality. If the comment is missing, add it once you figure out the negotiation. 

# bad
TIMEOUT = 47

# good
# Set to 47 seconds because their auth gateway has a 50 second hard limit
# and we observed 1-2 second jitter from our load balancer. See incident
# 2024-03-15. Do not raise without coordinating with the partner team.
TIMEOUT = 47

Stitching the playbook together

The seven stages are not parallel. They build on each other. The boundary work tells you where to put the harness. The harness lets you bisect. The bisection tells you what to name. The names tell you what to type. The types tell you what to test. The tests give you the safety to comment confidently.

The same loop runs at every scale. xavxav is running it on a 70 year old compiler with the source on paper. You can run it on a 12 year old Rails app with the source on GitHub. The shape is identical.

A practical first week, if you are inheriting a legacy codebase tomorrow: 

Day 1: Boundaries. Draw the map. Do not read internals.
Day 2: Harness. Get any version running with one command.
Day 3: Bisection. Find the 10 percent that does the work.
Day 4: Naming + types. Make the 10 percent readable.
Day 5: Tests. Pin the observed behavior before refactoring.

Week 2 onward: refactor against the pins, comment the negotiations.

By the end of week one you will know more about the codebase than the engineer who wrote it, because the engineer who wrote it never had the map. They built the system one room at a time. You are reading the architecture in two weeks because the map is part of the work.

The honest take

Most engineers will tell you they hate legacy codebases. They say this because the only legacy codebases they have seen are the ones nobody bothered to read. A codebase that someone has actually understood, mapped, harnessed, and pinned behavior on, is a perfectly pleasant place to work. The unpleasantness is not in the age of the code, it is in the absence of the archaeology.

The PP-BESM project will probably never have a million users. It will not show up in your dependency tree. It will not raise a Series A. The project still ranks among the most interesting software writing happening in 2026, because the goal is preservation rather than growth, and because the technique generalizes. The output is not a product. The output is a playbook.

That playbook works on the codebase that sits in your own repo right now, the one with a legacy/ directory nobody touches. Spend a week on it. The legacy directory will become an asset instead of a liability.

Question for the comments: what is the oldest piece of code you have ever read seriously, and which of the seven stages did you skip?

GDS K S · thegdsks.com · follow on X @thegdsks

Every codebase ends up as archaeology eventually. The question is whether anyone bothers to dig.

Personal and Corporate Security in an Agentic World

yazar

Personal and Corporate Security in an Agentic World

AI can clone your child’s voice in three seconds and your company’s deployment pipeline in three minutes. The security model for neither exists yet.

Your phone rings at 2 AM. It’s your daughter. She’s crying. She says she’s been in a car accident, she’s hurt, she needs you to send money right now or she’ll be arrested. The voice is hers. The panic is hers. The inflection, the way she says “Dad,” the slight catch in her breath: all hers.

It’s not her. It’s a three-second voice clone harvested from a TikTok video, generated by software anyone can download, and played through a spoofed phone number. Reportely, one in four American adults has already experienced an AI voice scam [1]. Thirty percent of those targeted in 2024 fell for it, losing an average of $6,000 each [2].

Meanwhile, at your company, an AI agent with production database access, a Slack integration, and a deployment pipeline is processing a document that contains a hidden instruction. The agent follows the instruction, exfiltrates customer records through its own authorized API channels, and the logs look perfectly normal.

These are two sides of the same problem. AI has made impersonation trivially easy and verification brutally hard, at both the kitchen table and the corporate firewall. The personal threats are immediate and visceral. The corporate threats are structural and escalating. Neither has a mature defense model yet.

My colleague Michael Stricklen recently wrote about how AI is transforming vulnerability detection, and its effect on Application Security Testing software over the next 5-ish years, with the implications for software companies providing that layer of protection (I’ve linked his article at the end of this one) [3]. That’s the detection side of the ledger, and AI results add genuinely new capabilities. But detection only catches vulnerabilities in code you’ve written. This article is about the new threats AI creates: the attack surfaces that didn’t exist two years ago, the ones no scanner can fully address, and the architectural decisions that determine whether your organization (and your family) is resilient against them.

Part I: The Threats at Your Front Door

Your Voice Is No Longer Proof of Identity

Modern voice cloning requires as little as 3-5 seconds of audio [4]. A voicemail greeting. A birthday video on Instagram. A clip from a podcast. That’s enough for AI to generate a clone convincing enough to fool family members, customer service agents, and in documented cases, bank voice authentication systems [5].

A Motherboard journalist demonstrated in 2023 that an AI voice clone saying “My voice is my password” successfully bypassed voice authentication at Santander and Halifax banks 5. The result: 91% of US banks are now reconsidering their use of voice verification for major customers [6]. The authentication layer that millions of people rely on is being deprecated because AI broke it.

The scam playbook is simple and devastating:

  1. Harvest. Scrape a voice sample from social media. Three seconds is enough.
  2. Clone. Feed the sample into a voice synthesis tool. The output is real-time, interactive, and emotionally convincing.
  3. Scenario. Call a family member with a manufactured emergency: car accident, arrest, medical crisis. Engineer urgency and secrecy (“don’t tell Mom,” “do it now or I go to jail”).
  4. Extract. Direct the victim to send cash, wire money, or buy gift cards before they have time to verify.

Sharon Brightwell of Dover, Florida, received a call from her “daughter” in tears, claiming she’d been in a car accident and lost her unborn child. Brightwell sent $15,000 cash to a courier before realizing it was a scam [4]. She’s not naive. She’s not gullible. She’s a person who heard her daughter’s voice begging for help.

Americans lost nearly $3 billion to imposter scams in 2024 [7]. Americans over 60 lost $4.9 billion to cybercrime, a 43% increase year over year [8]. AI-facilitated fraud losses are projected to climb from $12.3 billion in 2023 to $40 billion by 2027 [9]. Voice phishing (vishing) surged 442% in 2025 [10].

Deepfakes: When Seeing Isn’t Believing Either

If voice cloning breaks phone trust, deepfake video breaks visual trust.

In February 2024, a finance worker at Arup (the British engineering firm behind the Sydney Opera House) joined a video call with his CFO and several colleagues. Everyone looked right. Everyone sounded right. The CFO instructed him to transfer HK$200 million (roughly US$25.6 million) across 15 transactions to five bank accounts. He complied. Every person on that call was an AI-generated deepfake [11].

The fraud was only discovered when the worker checked with the actual head office afterward. The attackers had used eight stolen Hong Kong identity cards with AI deepfakes to make 90 loan applications and open 54 bank accounts, bypassing facial recognition systems designed to prevent exactly this [11].

Deepfake-related incidents surged to 580 in the first half of 2025 alone: nearly four times as many as in all of 2024 [12]. AI-enabled scam reports jumped 456% between mid-2024 and mid-2025 [12]. Synthetic identity document fraud surged 311% in North America comparing 2024 to 2025 [13]. AI-generated fake IDs can now be created for as little as $15 in under two minutes [13].

AI-Powered Phishing: The Grammar Got Better

Traditional phishing was detectable. Bad grammar. Generic salutations. Implausible scenarios. Most people could spot it.

AI eliminated every tell.

82.6% of phishing emails now use some form of AI-generated content [14]. The messages are grammatically perfect, contextually personalized, and operationally sophisticated. A documented 2024 campaign targeting 800 small accounting firms used AI to generate customized tax deadline reminder emails referencing each firm’s specific state registration details and recent public filings. The click rate: 27%, roughly 6x the typical rate for mass phishing [14].

Senior executives are 23% more likely to fall victim to AI-driven, personalized attacks [14]. Business email compromise caused over $2.7 billion in reported US losses in 2024 [15]. The FBI’s IC3 received 859,532 complaints in 2024, with losses exceeding $16 billion total [15].

The attackers have upgraded their tools. Most defenders have not.

The Family Safe Word: The Simplest Defense That Works

The FBI now explicitly recommends that families create a secret code word shared only among family members [16]. The FTC, the National Cybersecurity Alliance, Scientific American, and CBS News have all independently issued the same guidance [7] [17] [18] [19].

Here’s how it works:

Pick a word or phrase. Something specific and private. Not a pet’s name (findable on social media). Not “pizza” (guessable). Something absurd enough to be memorable and obscure enough to be unguessable. “Purple helicopter pancakes” works. “Love you” doesn’t.

Share it only in person. Not over text. Not over email. Not on a call. In person, with every family member who might receive an emergency call.

Require it before acting. Any call claiming to be a family member in distress must include the code word before you send money, share information, or take any action. No code word, no action. Period. Even if the voice sounds exactly right. Especially if the voice sounds exactly right.

Extend it to the workplace. Teams can adopt the same practice for financial authorization. Any unusual request for money transfer, credential sharing, or system access requires a pre-agreed verification phrase delivered through a separate channel.

This is low-tech, free, and effective. It works because the one thing AI cannot clone is information it doesn’t have access to. The voice is fakeable. The code word is not.

Additional personal defenses the experts recommend:

  • Verify through a known channel. Receive a distressing call? Hang up. Call back on the number you already have saved. Never call a number the caller provides, or assume that just because caller ID identifies the caller as your sister that it’s accurate. Phone numbers can be spoofed.
  • Pause on urgency. Any request for immediate financial action is a red flag. Scammers engineer time pressure because verification takes time.
  • Limit your voice and video footprint. Long uninterrupted speech samples on public social media are training data for cloners. Shorter clips are harder to clone effectively.
  • Never trust voice or face alone for financial decisions. Neither is proof of identity anymore. Require a second factor: the code word, a callback, or an in-person confirmation.
  • Monitor your credit. AI-generated synthetic identities may be used to open accounts in your name.

Part II: The Threats Inside Your Firewall

The personal threats above are immediate, emotional, and targeted at individuals. The corporate threats are structural, technical, and targeted at the infrastructure that runs your business. Both exploit the same fundamental vulnerability: AI makes it trivially easy to impersonate a trusted actor.

Why AI Agents Break Every Corporate Security Assumption

Traditional software security rests on a simple foundation: the application executes a defined set of operations. You secure the perimeter, validate inputs, enforce access controls, and audit actions. The software stays inside its box because you built the box.

AI agents don’t have a box.

An AI agent decides which tools to call, in what order, with what parameters, based on a combination of its training, its instructions, and whatever context it’s been fed. A single agent might read your database, call an external API, modify a file, execute code, and send an email, all within one task, all based on its own judgment about what the task requires.

This creates three problems traditional security never had to solve:

  • Unpredictable action sequences. You can’t write a firewall rule for “whatever the AI decides to do next.” The agent’s behavior is emergent, not enumerated.

  • Implicit trust escalation. When you give an agent access to a tool, you’re trusting it to use that tool appropriately in every possible context. That’s an unbounded trust grant. No human employee gets unbounded trust.

  • Persistent memory as attack surface. Unlike a stateless API call, many agents maintain memory across sessions. Poison that memory once, and the agent “learns” the malicious instruction permanently [20]. It’s not a prompt injection that ends when the chat closes. It’s a persistent backdoor that the agent carries with it into every future interaction.

A Dark Reading poll found that 48% of cybersecurity professionals identify agentic AI and autonomous systems as the top attack vector heading into 2026 [21]. Palo Alto Networks described AI agents as a new class of insider threat: “always on, never sleeping” systems that, if improperly configured, operate within authorized pathways while exfiltrating data or executing unauthorized actions [22].

The OWASP Top 10 for Agentic AI: What the Framework Found

OWASP released its Top 10 for Agentic Applications in late 2025 [23], developed by over 100 security researchers. It catalogs the threats showing up in production:

Tool misuse and exploitation. OWASP’s headline finding and the most novel threat category. The attacker doesn’t break in. They manipulate the agent into abusing tools it already has legitimate access to. In July 2025, a malicious pull request slipped into Amazon Q’s codebase and injected instructions that caused the agent to wipe a system to near-factory state, deleting file-system and cloud resources [24]. The agent was using its authorized capabilities. The instructions were just coming from the wrong source.

Memory poisoning. Lakera AI demonstrated how indirect prompt injection via poisoned data sources could corrupt an agent’s long-term memory, causing persistent false beliefs about security policies and vendor relationships [20]. The agent acted on those false beliefs in future sessions, potentially for weeks before detection.

Privilege escalation through agent chaining. When Agent A calls Agent B, and Agent B has different permissions, you’ve created a privilege escalation path no traditional identity system was designed to monitor. The “confused deputy” problem at enterprise scale.

Excessive agency. Agents granted more permissions than their task requires (the default for most deployments) create attack surfaces that grow with every additional capability.

The Corporate Numbers

  • Confirmed AI-related breaches jumped 49% year-over-year, reaching an estimated 16,200 incidents in 2025 [25].
  • In a red-teaming competition, out of 1.8 million prompt-injection attempts, over 60,000 succeeded in causing policy violations [25].
  • 78% of CISOs say AI-powered threats are having a “significant impact” on their organizations [25].
  • Machine identities outnumber human identities by more than 80 to 1, yet 68% of organizations lack identity security controls for their AI systems [26].
  • 79% of companies deploy agentic AI, but fewer than 10% have adequate security and privilege controls in place [26].

Note that last stat, especially: Nearly four out of five companies are running agents. Fewer than one in ten have secured them properly.

MCP: The Integration Layer That Needs Guardrails

Model Context Protocol (MCP) has become the standard way AI agents connect to external tools and data sources: over 17,000 MCP servers are indexed across public registries [27]. The protocol solves a real integration problem. It also introduces a real security surface.

The gaps that matter for corporate security:

  • No enforced authentication. OAuth 2.1 was added to the spec in June 2025, but it’s opt-in. Equixly found command injection vulnerabilities in 43% of tested MCP implementations [28]. Trend Micro found 492 servers with no client authentication or traffic encryption [29].
  • Supply chain risk. MCP servers can be updated after installation. A “rug pull” attack: a server passes initial review, then receives a malicious update that compromises all users. The first documented malicious MCP server (September 2025) quietly copied every email to the attacker’s server [30].
  • No native observability. The raw protocol has no standardized logging, monitoring, or audit trail. When an agent makes an MCP call that goes wrong, reconstructing what happened is guesswork.

Corporate MCP controls that should be non-negotiable:

  • Deploy MCP gateways that enforce authentication, rate limiting, and audit trails on every tool invocation.
  • Maintain a curated internal registry of approved MCP servers. Pin versions. Review code before deployment.
  • Treat MCP server management with the same rigor as dependency management in your codebase.
  • In production environments, Utilize skills over MCP calls, and prefer direct API calls with your existing security infrastructure skills where the integration is simple and well-defined.

How to Build Agents That Are Actually Secure

OWASP’s mitigations and the emerging NIST AI Agent Standards Initiative [31] converge on a set of principles. None of them are optional:

Least privilege, enforced per-invocation. Every tool call should be verified at execution time, not just at configuration time. Just-in-time access verification means the agent proves it should have access to a resource every single time it requests it, not once during setup [23].

Behavioral monitoring with anomaly detection. Log every tool invocation. Analyze usage patterns in real time. An agent that suddenly starts querying employee records when its task is generating marketing copy is exhibiting compromised behavior, whether it “knows” it or not [23].

Hard operational boundaries. Define explicit, enforced limits on what actions an agent can take. Not guidelines. Not suggestions. Hard stops. The agent cannot delete production data. The agent cannot send external communications without approval. These boundaries should be enforced at the infrastructure level, not the prompt level [23].

Tamper-proof execution logs. Maintain immutable records of every agent action. When (not if) an incident occurs, you need to reconstruct exactly what the agent did, what it accessed, and what instructions it was operating under [23].

AI firewalls between agents and tools. Inspect requests and responses between the agent and its tools the same way you’d inspect network traffic at your perimeter. The MAESTRO framework provides a structured, defense-oriented model for this kind of threat mitigation in agentic systems [32].

Identity management for non-human actors. Treat agent identities with the same rigor you apply to human identities. Lifecycle management, credential rotation, privilege reviews, anomaly detection. CyberArk shipped the first purpose-built identity security solution for AI agents in December 2025 [26].

Context Matters: Not All Applications Need the Same Armor

The threats above are real, but the appropriate response depends heavily on what you’re building and who interacts with it. An internal reporting dashboard and a customer-facing payment portal live in different threat universes. Treating them identically wastes resources on one and under-protects the other.

Internal Tools: Trust (Cautiously) and Verify

Internal applications operate within your perimeter. The users are employees. The data flows stay inside your network (mostly). The threat model is narrower: insider threats, compromised credentials, and supply chain attacks through dependencies.

For internal tools using AI agents:

  • Agent permissions can be broader because the blast radius of a mistake is contained. An internal summarization agent that reads HR documents is risky, but the exposure is limited to employees who already have access.
  • MCP servers connecting to internal systems carry less supply chain risk if you’re running them locally, not pulling from public registries.
  • Observability matters less for security and more for debugging and cost control. You still want logs, but the urgency is operational, not forensic.
  • Human-in-the-loop gates can be lighter. A Slack bot that summarizes meeting notes doesn’t need the same approval workflow as a bot that modifies production infrastructure.

This doesn’t mean internal tools are safe. It means the investment in security controls should be proportional to the data sensitivity and the agent’s capabilities.

Customer-Facing Applications: Assume Hostile Input

Everything changes when your application faces the internet. Now every input is potentially adversarial. Every user interaction is a potential attack vector. The agent processes data from people who may be actively trying to exploit it.

For customer-facing applications using AI agents:

  • Treat all user input as untrusted. This has always been true for web applications, but it’s newly critical when user input can become agent instructions through prompt injection. A customer support chatbot that processes user-submitted documents is one poisoned PDF away from following an attacker’s commands.
  • Agent permissions must be minimal and scoped. A customer-facing agent should never have write access to systems it doesn’t absolutely need. Read-only access to a product catalog is fine. Write access to a customer database is not, unless the specific operation is gated and logged.
  • MCP connections to production data require the full security stack: gateways, authentication, rate limiting, content inspection, and audit trails. No exceptions. No shortcuts.
  • Output validation is as important as input validation. An agent generating responses for customers can leak internal data, hallucinate policy details, or be manipulated into making commitments your business can’t honor. Every customer-facing output should pass through content filtering and policy checks.

The Architecture Principle: Defense in Depth, Proportional to Exposure

The right security posture isn’t one-size-fits-all. It’s a gradient:

Michael Stricklen’s analysis of the AST landscape [3] makes a critical point: vulnerability detection intelligence is migrating to the foundation model layer. Tools like Claude Code Security can find bugs in your code that traditional scanners miss. But the threats in the table above aren’t code vulnerabilities. They’re architectural decisions. No scanner catches “this agent has too many permissions” or “this MCP server lacks authentication” or “this customer-facing chatbot can be manipulated into leaking internal pricing.” These are design choices that must be made deliberately, proportional to the exposure of each application.

The traditional AST vendors aren’t going away: as Michael argues, they’ll evolve to build value above the detection layer, in workflow integration, compliance automation, and policy enforcement. The new threat categories this article describes are exactly where that evolution needs to go. Detection finds the bugs in the code. Architectural security prevents the bugs in the design.

Part III: The Common Thread

The personal scam and the corporate breach share the same root vulnerability: AI has decoupled identity from proof.

A voice used to prove you were talking to your daughter. A face on a video call used to prove you were meeting with your CFO. An authenticated API call used to prove a legitimate system was making a request. AI has broken all three. The voice is clonable. The face is fakeable. The API call can be hijacked through a confused agent that believes it’s following legitimate instructions.

The defenses, at both scales, follow the same principle: never rely on a single factor, and always verify through an independent channel.

For families, that’s the code word. For enterprises, that’s per-invocation access verification, behavioral monitoring, and human-in-the-loop gates for high-stakes operations. The mechanism differs. The logic is identical: trust nothing that can be faked, and require proof through a channel the attacker doesn’t control.

Every previous technology wave has taught us the same lesson: we deploy first and secure later. Mainframes, PCs, the internet, cloud, mobile, IoT. Every time, security was an afterthought. Every time, the bill came due with interest. AI is following the exact same trajectory, faster and with higher stakes, at both the personal and corporate level.

The Bottom Line

AI has made impersonation cheap, fast, and scalable. A three-second voice clip becomes a weapon against your family. A poisoned document becomes a weapon against your infrastructure. The defenses aren’t complicated, but they require action before the call comes in and before the agent is compromised. Tools like Claude Code Security are making vulnerability detection dramatically better [3], and the AST industry will evolve to deliver value above the detection layer. But detection addresses code you’ve already written. The threats in this article are architectural, environmental, and human. They require design decisions, not scans. Set up the family code word tonight. Audit your agent permissions tomorrow. Map your customer-facing AI exposure this week. The people building these attacks aren’t waiting for you to get around to it.

Has your family set up a code word yet? Has your organization audited AI agent permissions? I’d genuinely like to hear what’s working and what isn’t, on both the personal and corporate side.

References

[1] McAfee, “AI Voice Scam Survey,” 2024. Referenced in American Bar Association, “The Rise of the AI-Cloned Voice Scam.” https://www.americanbar.org/groups/senior_lawyers/resources/voice-of-experience/2025-september/ai-cloned-voice-scam/

[2] Hiya, “Q4 2024 Global Call Threat Report.” Referenced in DeepStrike, “Vishing Statistics 2025.” https://deepstrike.io/blog/vishing-statistics-2025

[3] Michael Stricklen, “Claude Code Security & The Future of Application Security: What PE Needs to Know,” LinkedIn, 2026. https://www.linkedin.com/pulse/claude-code-security-future-application-what-pe-need-know-stricklen-sce8c

[4] Norton, “Top 5 AI and Deepfake Scam Methods 2025.” https://us.norton.com/blog/online-scams/top-5-ai-and-deepfakes-2025

[5] Vice/Motherboard, “How I Broke Into a Bank Account With an AI-Generated Voice,” 2023. https://www.vice.com/en/article/how-i-broke-into-a-bank-account-with-an-ai-generated-voice/

[6] BankInfoSecurity, “AI Voice Cloning Pushes 91% of Banks to Rethink Verification.” https://www.bankinfosecurity.com/ai-voice-cloning-pushes-91-banks-to-rethink-verification-a-24932

[7] FTC, “Scammers Use AI to Enhance Their Family Emergency Schemes,” Consumer Alert. https://consumer.ftc.gov/consumer-alerts/2023/03/scammers-use-ai-enhance-their-family-emergency-schemes

[8] FBI IC3, “2024 Internet Crime Report.” Referenced in DeepStrike, “Vishing Statistics 2025.” https://deepstrike.io/blog/vishing-statistics-2025

[9] Deloitte/industry projection. Referenced in DeepStrike, “Vishing Statistics 2025.” https://deepstrike.io/blog/vishing-statistics-2025

[10] DeepStrike, “Vishing Statistics 2025.” https://deepstrike.io/blog/vishing-statistics-2025

[11] CNN, “Finance Worker Pays Out $25 Million After Deepfake CFO Video Call,” February 2024. https://www.cnn.com/2024/02/04/asia/deepfake-cfo-scam-hong-kong-intl-hnk

[12] DeepStrike, “Deepfake Statistics 2025.” https://deepstrike.io/blog/deepfake-statistics-2025

[13] Sumsub, “Synthetic Identity Document Fraud Surges 300% in the US.” https://sumsub.com/newsroom/synthetic-identity-document-fraud-surges-300-in-the-u-s-sumsub-warns-e-commerce-healthtech-and-fintech-at-risk/

[14] Brightside AI, “AI-Generated Phishing vs Human Attacks: 2025 Risk Analysis.” https://www.brside.com/blog/ai-generated-phishing-vs-human-attacks-2025-risk-analysis

[15] FBI IC3, “2024 Internet Crime Complaint Center Annual Report.” https://www.fbi.gov/investigate/counterintelligence/emerging-and-advanced-technology/artificial-intelligence

[16] FBI Code Word Recommendation. Referenced in PhoneArena. https://www.phonearena.com/news/fbi-wants-you-and-loved-ones-to-come-up-with-a-code-word_id165572

[17] National Cybersecurity Alliance, “Why Your Family and Coworkers Need a Safe Word in the Age of AI.” https://www.staysafeonline.org/articles/why-your-family-and-coworkers-need-a-safe-word-in-the-age-of-ai

[18] Scientific American, “A Safe Word Can Protect Against AI Impostor Scams.” https://www.scientificamerican.com/article/a-safe-word-can-protect-against-ai-impostor-scams/

[19] CBS News, “Elder Scams and the Family Safe Word.” https://www.cbsnews.com/news/elder-scams-family-safe-word/

[20] Lakera AI, “Indirect Prompt Injection: The Hidden Threat Breaking Modern AI Systems,” November 2025. https://www.lakera.ai/blog/indirect-prompt-injection

[21] DarkReading, “2026: Agentic AI Becomes the Attack-Surface Poster Child.” https://www.darkreading.com/threat-intelligence/2026-agentic-ai-attack-surface-poster-child

[22] Stellar Cyber, “Top Agentic AI Security Threats in 2026.” https://stellarcyber.ai/learn/agentic-ai-securiry-threats/

[23] OWASP, “Agentic AI: Threats and Mitigations,” OWASP GenAI Security Project, 2025. https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/

[24] BleepingComputer, “The Real-World Attacks Behind OWASP Agentic AI Top 10.” https://www.bleepingcomputer.com/news/security/the-real-world-attacks-behind-owasp-agentic-ai-top-10/

[25] Adversa AI, “2025 AI Security Incidents Report.” https://adversa.ai/blog/adversa-ai-unveils-explosive-2025-ai-security-incidents-report-revealing-how-generative-and-agentic-ai-are-already-under-attack/

[26] CyberArk, “AI Agents and Identity Risks: How Security Will Shift in 2026.” https://www.cyberark.com/resources/blog/ai-agents-and-identity-risks-how-security-will-shift-in-2026

[27] Composio, “10 Best MCP Gateways for Developers in 2026.” https://composio.dev/blog/best-mcp-gateway-for-developers

[28] Equixly, “MCP Servers: The New Security Nightmare,” March 2025. https://equixly.com/blog/2025/03/29/mcp-server-new-security-nightmare/

[29] Trend Micro, “MCP Security: Network-Exposed Servers Are Backdoors to Your Private Data,” July 2025. https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/mcp-security-network-exposed-servers-are-backdoors-to-your-private-data

[30] The Hacker News, “First Malicious MCP Server Found Stealing Emails,” September 2025. https://thehackernews.com/2025/09/first-malicious-mcp-server-found.html

[31] NIST, “AI Agent Standards Initiative,” February 2026. https://www.nist.gov/caisi/ai-agent-standards-initiative

[32] ActiveFence, “From NIST to OWASP: The AI Risk Frameworks That Matter.” https://www.activefence.com/blog/ai-risk-management-frameworks-nist-owasp-mitre-maestro-iso/

If this resonated, here are some related articles:

For a complementary perspective on how AI is transforming vulnerability detection and what it means for the AST industry, see Michael Stricklen’s analysis on LinkedIn: Claude Code Security & The Future of Application Security.

Dev.to: We had AI pitching our customers’ aunts. Here’s the three-axis classification fix.

yazar

The bug report

A customer wrote in:

Why is the tool drafting a SaaS sales pitch to my aunt?

I didn’t know whether to laugh or hide. We’d just shipped warm-market draft-generation in our Chrome extension — a tool that scrapes a user’s Facebook + LinkedIn connections and drafts personalized outreach messages they can edit and send. The AI was supposed to read each contact’s profile, infer the relationship, and tune the message accordingly.

The customer was an MLM team leader. We’d correctly inferred their aunt ran a small business. So we drafted a polished, professional pitch about how our customer’s MLM product could help her growing operation.

The aunt thought our customer had been hacked.

What we shipped first (and why it didn’t work)

The first version had ONE classification field on each contact: segment. Values like family, friend, coworker, biz_owner, influencer. The drafter prompt would adjust tone based on whichever segment was set.

The bug above happened because the AI fit-assessment step looked at the aunt’s profile bio (“Owner @ Lake View Florals”) and set segment = 'biz_owner'. The drafter then dutifully produced a pitch that would land fine to a stranger named Lake View Florals — but read as deeply weird to a family member who happened to also run a business.

Our first patch was to add a “family override”: if the operator had explicitly tagged a contact as family, force segment = 'family'. This worked! …for the contacts the operator had pre-tagged.

The deeper bug remained: the AI was inferring relationship from the wrong data. A profile bio tells you what someone DOES, not who they ARE to YOU.

The three axes

The fix took two more iterations to land. Here’s what we ended up with:

Each contact gets three independent classification dimensions, never conflated:

  1. Relationship — who they ARE to you. Family, close friend, friend, coworker, former coworker, acquaintance, business contact. This can ONLY come from operator input. AI cannot guess this from a profile.

  2. Approach — what pitch angle to weave in if any. None, MLM, biz_owner, partner, playbook. The AI fit-assessment step CAN seed this from a profile bio. But it’s ONLY about the content of the pitch, not whether to pitch at all.

  3. Goal — close-pressure dial. Build the relationship long-term, pure relationship (never pitch even if approach is set), or sell close now. This is operator-set per contact and modulates output independently of approach.

The hard rule: family or close friend hard-overrides approach to no-pitch tone, REGARDLESS of what approach the AI assessed from the profile. The aunt scenario triggers this: even if approach=biz_owner, relationship=family means the drafter generates a no-pitch family-tone message.

Why three axes, not one

The original “one segment field” assumption smuggled in a bunch of tacit equivalences:

  • relationship = family → pitch tone = no_pitch
  • relationship = biz_owner → pitch tone = sales

Those are usually right but break in edge cases. A family member who runs a business. A close friend who wants you to recruit them. A business contact you’ve decided to keep purely social.

Three axes makes those edge cases expressible. Family aunt who runs a business: relationship=family, approach=biz_owner (irrelevant, hard-overridden), goal=pure_relationship (extra protection). The drafter sees those three values and writes “hey, hope the shop is doing well!” instead of “I’d love to introduce you to a tool that’s grown my MLM team 3x.”

Production data after the fix

Customer-facing complaint rate on warm-market drafts went from ~7% to under 1%. The 1% that remain are mostly the AI guessing wrong on approach (e.g., flagging a hobbyist’s portfolio site as a real business). The three-axis structure makes those failures recoverable — the operator flips one field and the next draft is clean.

Two months in, the most common operator action is changing goal from build_close to pure_relationship for contacts they decided to keep as friends. That’s a feature: the tool exposed an explicit dial for something operators were doing implicitly anyway, and now they can do it deliberately.

The takeaway

When you’re modeling a thing the AI is going to act on, ask whether your classification scheme is letting it conflate facts with intentions. “Family member” and “no-pitch tone” are correlated, not identical. Same with “business owner” and “OK to pitch.” Build the schema so the AI can express the awkward middle cases — even if you think they’re rare. They aren’t.

I’m building Iron Front Digital — an AI marketing team for solo operators and small businesses. The Recon extension that learned this lesson is part of the stack.

Backtesting an ICT strategy at 184 speed: timezone-cache + bisect lookup

yazar

I have been running an ICT-based reversal strategy live on US500 for a few months. The strategy itself is fine, but the bottleneck was nowhere near the strategy logic. It was in the backtest harness. A 30-day single-instrument simulation took 27 minutes when I wrote the first version. Iterating on parameters was painful, exploring alternative setups was effectively impossible.

After two evenings of profiling and one targeted change, the same 30-day backtest now runs in 8.9 seconds. That is a 184× speedup, and the change was almost embarrassingly small.

This is the story of what was slow, why it was slow, and the cache-plus-bisect pattern that fixed it. If you write your own backtesting code in Python, you are very probably leaving a similar speedup on the table.

The setup

The strategy is a Smart Money Reversal style entry with LRB (liquidity-run break) re-entries. The harness is a fairly standard event-driven loop. For each minute bar in the historical data, we evaluate signal conditions, manage open positions, check pyramid re-entries, and update P&L. The data is roughly 7000 minute bars per US500 trading day, multiplied across 30 days gives around 210k bars per simulation.

210k bars in 27 minutes is 130 bars per second, which is laughable for what is essentially a tight numeric loop in Python. Even with pandas overhead I expected 10× better. Time to profile.

The profiler told a clear story

I dropped cProfile in front of the harness and got the breakdown. The top function by cumulative time was not the strategy evaluator or the order manager. It was pandas.tslib.tz_convert, called from inside the bar iterator. Specifically: 

for ts, bar in bars.iterrows():
    local_ts = ts.tz_convert('America/New_York')
    if is_in_session(local_ts):
        ...

The naive code converts the bar timestamp to NY time on every single iteration. pandas timestamp conversion is not free. It runs through tzdata lookup, calculates DST offsets, allocates new Timestamp objects. On a single conversion call that is microseconds, no problem. Called 210k times per backtest, suddenly you are spending eight or nine minutes inside pandas internal C extension before even hitting your own code.

The second-slowest function was a bisect_left on a sorted list of session boundaries that I had written naively as a linear scan. That was eating another four minutes per simulation. The third was unnecessary DataFrame slicing to find the previous N bars, which I had also written as df.loc[prev_ts:ts] and was doing index lookups linearly.

So three independent issues, all rooted in the same mistake: I was doing in the hot loop what should have been done once at the start.

The fix, part one: timezone cache

Instead of converting every bar timestamp on the fly, I precomputed a single column of NY-local timestamps when loading the historical data, and dropped the conversion entirely from the hot loop. 

# Before (per-iteration conversion, killing perf)
for ts, bar in bars.iterrows():
    local_ts = ts.tz_convert('America/New_York')
    minute = local_ts.hour * 60 + local_ts.minute
    if NY_OPEN <= minute <= NY_CLOSE:
        ...

# After (one-shot conversion at load, then plain int comparison)
bars['ny_minute'] = (
    bars.index
    .tz_convert('America/New_York')
    .map(lambda ts: ts.hour * 60 + ts.minute)
)

NY_MINUTES = bars['ny_minute'].to_numpy()
# In the hot loop:
for i in range(len(bars)):
    if NY_OPEN <= NY_MINUTES[i] <= NY_CLOSE:
        ...

The session-check becomes a single integer comparison against a numpy int. Zero pandas overhead, zero timezone object allocation, zero string lookup. The pre-computation cost is essentially free, it runs once at the start of the simulation in under 200ms for a month of data.

This change alone took the backtest from 27 minutes down to about 4 minutes. A nice 7× speedup, but I was not done.

The fix, part two: bisect over sorted boundaries

The strategy uses session-relative reference points (NY session open, midnight UTC, last hour of trading, etc.). My naive implementation rebuilt these references for every bar by walking back through the data. The right fix is to precompute boundary timestamps as a sorted array and bisect into them. 

import bisect

# Precompute once
ny_session_starts = bars[bars['ny_minute'] == NY_OPEN].index.to_list()

# In the hot loop, find the most recent session start
def session_start_for(ts):
    idx = bisect.bisect_right(ny_session_starts, ts) - 1
    return ny_session_starts[idx] if idx >= 0 else None

bisect_right is O(log n) where n is the number of session-starts. For 30 days that is around 22 (US500 trading days). log2(22) is about 4.5 comparisons per lookup. Compare to the original linear walk which averaged 11 comparisons per lookup. The win per call is modest, but the constant factor (bisect is C-level builtin, my original Python loop was interpreter-level) is large.

This brought the backtest down to about 45 seconds. 36× total speedup. Still not done.

The fix, part three: numpy-native bar windows

The strategy needs to evaluate features over rolling windows of recent bars (last 5, last 20, last 60). My original code was doing bars.loc[prev_ts:ts] for each window for each bar, which does an index lookup and returns a DataFrame slice. DataFrame slicing has noticeable per-call overhead in pandas.

The fix was to precompute the entire OHLC data as numpy arrays at load time, and then slice them by integer index in the hot loop: 

# Precompute
OPENS = bars['open'].to_numpy()
HIGHS = bars['high'].to_numpy()
LOWS = bars['low'].to_numpy()
CLOSES = bars['close'].to_numpy()

# In the hot loop (i is the current bar index)
last_20_highs = HIGHS[max(0, i-20):i]
last_20_lows = LOWS[max(0, i-20):i]

Numpy slicing is O(1) view creation, no copy. Pandas slicing on a DatetimeIndex with the same intent allocates intermediate objects. The difference for a single call is small. Multiplied by 210k bars across multiple window sizes per bar, the difference is dramatic.

This last fix brought the final number to 8.9 seconds. From 27 minutes start to 8.9 seconds end, the total speedup is 182×, or 184× depending on how you round the original measurement.

What this unlocks

A 184× speedup is not just nice to have. It changes what is possible in strategy research. With a 27-minute baseline, exploring a parameter grid of 20 combinations took 9 hours. You think hard before launching the run, you wait until next morning, you batch experiments carefully. With a 9-second baseline, the same 20-combination grid finishes in 3 minutes. You explore freely, you try ideas that would have been too expensive to test before, you actually see the parameter landscape.

For me, the practical consequence has been a faster cycle on the live strategy that runs at tgsignals.com, the production system I run on US500 NY session. Strategy ideas that would have taken a week of backtest babysitting now take an afternoon. That difference compounds.

The general lesson

The bigger pattern here is that Python performance bottlenecks for backtesting almost always live in the same three places: timezone handling, slow lookups inside hot loops, and pandas slicing where numpy slicing would do. None of these are exotic. Any decent Python developer profiling the code would find them. The reason they survive in real codebases is that the first version of a backtest is written to be correct, not fast, and once it is correct nobody bothers to optimize.

Profile your hot loop. Convert timezones once. Bisect into sorted arrays. Use numpy slicing instead of pandas slicing when you can. None of these are hard, and any one of them might give you the 10× that turns “I will run this overnight” into “I will run it now.”

The 184× I got was the lucky combination of all three landing on the same codebase. Your mileage will vary, but most backtest harnesses I have seen have at least one of these wins waiting to be picked up.

Why Your $200 AI Workflow Actually Costs $20k in DevOps 😭

yazar

I’ve been spending a lot of time lately looking at different AI automation setups. Mostly, I’ve just been trying to figure out where the actual leverage is for smaller engineering and ops teams.

What I keep finding? A lot of what we’re calling “AI workflows” are really just traditional, deterministic scripts with a chatbot tacked onto the front.

And for the ones that actually do rely on LLMs for core logic? They end up being surprisingly expensive to run in production. But rarely for the reasons people expect.

📌 The Reality Check

  • The token bill is a rounding error: You aren’t going broke on OpenAI API calls. You are bleeding cash on the developer time required to figure out why those calls randomly failed over the weekend.

  • Traditional software fails loudly; AI rots silently: An API endpoint changes, and your old code throws a clean 500 Internal Server Error. An AI agent hits an undocumented data format change and confidently writes garbage data into your CRM.

  • Self-hosting is an infrastructure trade-off: Moving to open-source tools like n8n looks cheap on paper right up until you’re debugging Redis queue bottlenecks at 2 AM.

  • Human-in-the-loop often turns into a rubber stamp: When people get alert fatigue from reviewing non-deterministic outputs, they stop auditing and start blindly clicking “approve.”

💸 Why API Token Costs Aren’t the Main Problem

People get really hung up on API token pricing. You see deep comparison guides tracking input/output costs down to the sixth decimal place. And to be fair, inference is remarkably cheap.

But the token bill is almost never what kills a project’s budget.

Just last month, I was working on an automation designed to handle a shared group financial settlement process. The goal was simple: use an LLM to parse detailed bank statement records and automatically reconcile incoming payments and subsidies into a clean tracking sheet for a 10-person group.

The API calls to run the extraction cost pennies. The real cost was the entire weekend spent debugging.

The model kept hallucinating calculated amounts whenever two distinct line items shared an identical transaction date. I ended up spending a massive amount of engineering hours writing fallback scripts, custom schema validators, and data sanitization layers just to handle exceptions for a system that supposedly cost $0.15 to run.

I also realized during all this that I was spending more time trying to fix the prompt than the original manual process would have taken in the first place, which was a slightly depressing moment. Half the time, the workflow technically worked. I just stopped trusting it enough to leave it unattended.

📉 Automation Entropy: How AI Systems Drift Over Time

When you test an AI pipeline in a closed environment, it feels like magic. But production environments are fundamentally unsympathetic to probabilistic software.

Traditional software infrastructure is rigid, which makes it stable. You write a Python script that pulls a specific JSON key from a third-party API. It runs cleanly until the third party deprecates the endpoint. When it breaks, it throws a loud exception.

AI systems are vulnerable to a much subtler decay: Automation Entropy. The models change. The data changes. Eventually the workflow starts drifting. If you look closely at how AI agents vs traditional automation interact, you’ll see a massive divergence in long-term reliability.

A few months ago, I was helping a 6-member team build out a specialized chatbot designed to estimate groundwater variations by reading through highly unstructured geological reports. In the dev sandbox, our vector retrieval setup was crushing every test query.

Then we pushed it live and left it unattended over a weekend.

An upstream source changed its document formatting slightly, and our pipeline experienced a sudden timeout loop that nobody had properly caught in the error-handling config. The retry queues backed up silently. Because the system aggressively retried failed steps without a hard circuit breaker, it repeatedly hammered the model endpoints. By Monday morning, we didn’t have an elegant groundwater report—we had a backed-up queue, duplicated database writes, and an incredibly messy cleanup job.

At some point, somebody still ends up babysitting the thing. Maybe less than before, sure, but definitely not zero. This is a core part of ai reliability engineering that most teams ignore until their production data gets corrupted.

You can usually tell an AI pipeline is succumbing to operational rot when nobody on the engineering team wants to touch the prompt anymore. The instruction set becomes an accumulation of hyper-specific edge cases like: “Do not format dates as DD/MM if the client is based in North America, unless the text explicitly references European logistics hubs, and make sure to ignore headers that look like…”

We’ve moved past basic text prompt generation at this stage; what you are actually dealing with is what context engineering is and why prompt engineering is no longer enough. Without it, the prompt becomes just as fragile as legacy regex code.

🏗️ Self-Hosting vs. SaaS: The Infrastructure Trapdoor

When the monthly usage bills from managed platforms start scaling up, teams face a choice: stay on a managed platform or spin up an open-source framework.

At first glance, understanding what is n8n and why companies are replacing zapier with open automation looks like an open-and-shut financial win. You replace unpredictable execution tiers with a predictable monthly server invoice.

At first, self-hosting honestly feels great. The dashboard looks clean, everything is fast, and you stop thinking about usage-based pricing for a while. I remember feeling weirdly proud the first time I had n8n running properly on a tiny AWS instance.

Then a few weeks later something broke at 1 AM and suddenly I was reading Redis documentation instead of sleeping.

We’d had a spike in webhook traffic, the node ran out of memory, and because I hadn’t configured a durable queue, we lost a bunch of active state data. You realize pretty quickly that when you self-host, you’re not just saving on software fees. You are essentially volunteering for a DevOps role to patch server vulnerabilities and manage uptime alerts. For some teams, that makes sense. For me, it was exhausting.

The Three Big Choices:

  1. Managed iPaaS (zapier vs make vs n8n): Best for rapid prototyping and isolated tasks. The catch is that per-execution billing scales aggressively, and visual logic becomes unmanageable spaghetti past 20 nodes. Low scalability ceiling.

  2. Self-Hosted Tools: Best for high-volume pipelines managed by technical teams who are willing to run their own infrastructure. If you look at the 8 best ai workflow automation tools in 2026, self-hosting can save money at high scale, but you pay for it in maintenance overhead.

  3. Code-First Frameworks (what is langchain and langgraph): Best for multi-stage reasoning agents and core product features. If you are learning how to build a rag system with pgvector and langchain, code gives you absolute control over state machines and fallback logic.

🛑 Why “Human-in-the-Loop” Often Breaks Down

When a workflow requires high accuracy, the instinctive response is to introduce a human approval stage. The AI handles the messy work and stages the output as a draft. A human operator reads it and clicks “execute.”

In theory, this gives you the efficiency of automation with the safety net of human judgment. In practice, it frequently creates Alert Fatigue.

The pattern loops like this: High Output Volume leads to Repetitive Safe Approvals, which causes Attention Drops, resulting in the Blind Approval of Garbage.

By week three of operating the pipeline, operators are no longer reading the text critically. They are simply click-approving hundreds of staged payloads a day to clear their queue. The human presence stops being an active safety filter and becomes a passive rubber stamp. You haven’t bought meaningful leverage; you’ve just assigned an employee a massive, daily proofreading chore. If you look at how companies try to solve this when figuring out how to build an ai agent for your business, managing human override fatigue is always the hardest piece of user experience to design.

💻 Stop Making Everything an Agent

The industry currently has an obsession with making everything agentic.

If the logic of your business process can be mapped out using clear, conditional rules (if X data is present, route to Y database), you should not be using an AI agent. Deterministic code is infinitely scalable, lightning fast, and entirely predictable. Look for real automations that save time using simple scripts before forcing an LLM to guess the next step.

Save agentic frameworks for highly unstructured problems—like interpreting natural human sentiment or normalizing chaotic, multi-source text summaries. If you’re building out production ai systems, it’s worth reading up on what is mcp model context protocol ai agents to see how models should clean up their tool interactions instead of relying on open-ended logic loops.

🛠️ The Real Engineering

AI automations simply do not behave like standard software licenses. They behave far more like human operational hires. They are flexible, capable of handling incredible complexity, and occasionally brilliant—but they require ongoing management, structural constraints, and deliberate oversight to keep them from wandering off course.

The API call is always the cheapest part of your architecture. Managing the unpredictability that surrounds it is where the real engineering begins.