Palo Alto Networks firewall bug being exploited by threat actors: Report

Stay Ahead, Stay ONMINE

Palo Alto Networks firewall bug being exploited by threat actors: Report

The issue doesn’t affect the company’s Cloud NGFW or Prisma Access software. Greynoise said exploitation began around Tuesday of this week. Assetnote published research about the hole on Wednesday. Palo Alto Networks published its advisory the same day. ‘Weird path-processing behavior’ The vulnerability, Assetnote said, is a “weird path-processing behavior” in the Apache HTTP server […]

The issue doesn’t affect the company’s Cloud NGFW or Prisma Access software.

Greynoise said exploitation began around Tuesday of this week. Assetnote published research about the hole on Wednesday. Palo Alto Networks published its advisory the same day.

‘Weird path-processing behavior’

The vulnerability, Assetnote said, is a “weird path-processing behavior” in the Apache HTTP server part of PAN-OS, which, along with Nginx, handles web requests to access the PAN-OS management interface. The web request first hits the Nginx reverse proxy, and if it is on a port that indicates it’s destined for the management interface, PAN-OS sets several headers; the most important of them is X-pan AuthCheck. The Nginx configuration then goes through several location checks and selectively sets the auth check to off. The request is then proxied to Apache, which will re-normalize and re-process the request as well as apply a rewrite rule under certain conditions. If the file requested is a PHP file, Apache will then pass through the request via mod_php FCGI, which enforces authentication based upon the header.

The problem is that Apache may process the path or headers differently to Nginx before the access request is handed to PHP, so if there is a difference between what Nginx thinks a request looks like and what Apache thinks it looks like, an attacker could achieve an authentication bypass.

Assetnote describes this as a “quite common” architecture problem where authentication is enforced at a proxy layer, but then the request is passed through a second layer with different behavior. “Fundamentally,” the research note added, “these architectures lead to header smuggling and path confusion, which can result in many impactful bugs.”

Stay Ahead

Explore More Insights

Stay ahead with more perspectives on cutting-edge power, infrastructure, energy, bitcoin and AI solutions. Explore these articles to uncover strategies and insights shaping the future of industries.

Versa Networks launches sovereign SASE, challenging cloud-only security model

Versa’s sovereign SASE offering is designed to be highly customizable, allowing customers to choose their own compute resources, whether on-premises or in a private cloud. The company provides the software and recommends the hardware, but the customer maintains full control over the deployment. The system supports both containerized and virtual

Fortinet speeds threat detection with improved FortiAnalyzer

The package also now integrates with FortiAI, the vendor’s genAI assistant, to better support analytics and telemetry to help security teams speed threat investigation and response, the vendor stated. “FortiAI identifies the threats that need analysis from the data collected by FortiAnalyzer, primarily collected from FortiGates. By automating the collection,

Microsoft braids anyons into topological cubits on new Majorana quantum chip

Traditional qubits are extremely vulnerable to any change in their environment, which makes it difficult to scale up a quantum computer. But the new topological qubits need ten times less error-correction overhead, according to Microsoft. Traditional qubits also require analog controls, like turning a dial. Topological qubits, by comparison, can

Aryaka adds AI-powered observability to SASE platform

Nadkarni explained that Aryaka runs unsupervised machine learning models on the data to identify anomalies and outliers in the data. For example, the models may detect a sudden spike in traffic to a domain that has not been seen before. This unsupervised analysis helps surface potential issues or areas of

Oil, Gas Sector Sees Dip in Contract Volume, GlobalData Reveals

The global oil and gas industry experienced a 15 percent quarter on quarter decrease in total contracts, GlobalData noted in a release sent to Rigzone recently. The company outlined in the release that this figure dropped from 1,596 in the third quarter of last year to 1,353 in the fourth quarter of 2024. Despite the dip in volume, the overall contract value remained stable, driven by the announcement of some major contracts in Africa, GlobalData stated in the release, which highlighted a recent company report on oil and gas industry contracts. This report revealed that overall contract value came in at $39.2 billion in the fourth quarter and $38.8 billion in the third quarter, the release highlighted. A chart showing oil and gas industry contracts by scope in the fourth quarter of 2024, which was included in the release, revealed that 670 contracts had an operations and maintenance scope, 403 contracts had a procurement scope, 139 contracts had multiple scopes, 78 contracts had a design and engineering scope, 62 had a construction and installation scope, and one had an asset retirement scope. “The major contracts announced in the African region include Tecnicas Reunidas and Sinopec Engineering’s $4 billion new deep conversion oil refinery project in Algeria’s Hassi Messaoud region, and $1.4 billion Wuhuan Engineering and WeDo’s ammonia and urea plant project in Angola,” GlobalData said in the release. The company stated that some other notable contracts during the quarter were Bram Offshore and Starnav Servicos Maritimos’ $2.74 billion construction and charter contract from Petrobras for 12 Platform Supply Vessels (PSVs) and Saipem’s $1.9 billion contract from TotalEnergies EP Suriname for the EPC, supply, pre-commissioning, and commissioning assistance for the Subsea Umbilicals, Risers, and Flowlines (SURF) package for the GranMorgu project in Suriname. “These contracts demonstrate continued investment and expansion in

Uncertainty surrounds nuclear tax credit guidance, NRC changes: Morgan Lewis

Dive Brief: Nuclear reactor restarts and capacity uprates could get a financial lift in 2025 and onward from the Inflation Reduction Act’s technology-neutral Section 45Y production and Section 48E investment tax credits and Section 45V clean hydrogen production tax credits, though recent Treasury Department guidance leaves some questions unanswered and executive-branch reforms could affect Nuclear Regulatory Commission activities, Morgan, Lewis & Bockius attorneys said Wednesday on the law firm’s Q1 2025 nuclear regulatory webinar. To qualify for the credits, restarted nuclear reactors must have ceased operations for at least one calendar year, be authorized to restart by federal nuclear and energy regulators, and meet an “anti-abuse” test meant to prevent reactors from shuttering to later qualify for federal tax credits, Morgan Lewis attorney Jared Sanders said on the webinar. Absent incremental capacity uprates, existing nuclear generation facilities are not eligible to claim the technology-neutral production or investment tax credits and can only claim the 45V tax credit up to a maximum of 200 MW under certain conditions, Sanders said. Dive Insight: Since 2023, the owners of three prematurely retired nuclear power plants have announced plans to restart operations by the end of the decade: Holtec International’s Palisades plant in Michigan, Constellation Energy’s Three Mile Island Unit 1 in Pennsylvania, and NextEra Energy’s Duane Arnold facility in Iowa. TMI Unit 1 — now known as the Crane Clean Energy Center — ceased operations in 2019. Duane Arnold shuttered in 2020, followed by Palisades in 2022. All are likely to qualify for federal tax credits, though Constellation spokesperson Paul Adams told Politico last year that it was the company’s 20-year power purchase agreement with Microsoft, not federal tax credit eligibility, that made the restart possible. Holtec also plans to bring two 300-MW SMRs into operation at the Palisades site in the early

The AI energy challenge is coming to a head

Krishna Rangasayee is CEO of SiMa.ai, a software-centric, embedded edge machine learning system-on-chip company. As the last year falls further into the rearview and we are full steam ahead into 2025, the discussion surrounding AI’s massive energy consumption has reached an inflection point. The rapid advancement of AI has resulted in unprecedented demands on global energy infrastructure, threatening to outpace our ability to deliver power — and AI benefits — where they’re needed most. With AI already accounting for up to 4% of U.S. electricity use (a figure projected to nearly triple to 11% by 2030), reducing the strain on our energy systems is a priority, requiring a thorough reexamination of how AI’s energy needs could affect our long-term climate goals, infrastructure, resource availability and the scale at which this technology operates. And the hype doesn’t look to be slowing down anytime soon. A new executive order was issued last month to prioritize and speed up the development of AI infrastructure, including data centers and other power facilities, while proposing new restrictions on exports of AI chips to keep innovation local. While political debates rage about energy sources and environmental regulation, the fundamental challenge lies in the stark mismatch between AI’s accelerating power requirements and our aging energy distribution infrastructure. This has now become a race against time, and though AI has inevitably become a “problem” — it also offers the path to a solution. The scale of AI’s energy challenge Most AI applications we use today — from chatbots to image generators — rely on the cloud to run models and process queries. These AI data centers serve as a hub, steadily accounting for around 4.4% of U.S. electrical demand, potentially increasing to more than a tenth of the total U.S. electrical demand by 2028. Recent data points to

California Phaseout of Fossil Fuel Cars Faces Congress Test

The Environmental Protection Agency (EPA) under the Trump administration is trying to cancel waivers it issued under the Biden government for three regulations in California that aim to curb transport emissions. “[T]he EPA will be transmitting to Congress the Biden Administration’s rules granting waivers that allowed California to preempt federal car and truck standards promulgated by EPA and the U.S. Department of Transportation’s National Highway Traffic Safety Administration”, the EPA said in an online statement. EPA Administrator Lee Zeldin said, “The Biden Administration failed to send rules on California’s waivers to Congress, preventing Members of Congress from deciding on extremely consequential actions that have massive impacts and costs across the entire United States”. During previous president Joe Biden’s last days in office, the EPA granted waivers for California’s Advanced Clean Cars II (ACCII) and Heavy-Duty Omnibus. “Under the Clean Air Act, California is afforded the ability to adopt emissions requirements independent from EPA’s regulations to meet its significant air quality challenges”, the EPA said December 18, 2024. ACCII sets emission standards and raises sales of zero-emission vehicles for model years 2026-35 so that all new light-duty passenger cars, pick-up trucks and SUVs sold in California are zero-emission by 2035. ACCII builds on ACCI, adopted 2012 for model years 2015-25. “By 2035, all those vehicles must be zero-emission, which includes the option to sell plug-in hybrid vehicles”, the California Air Resources Board (CARB) said separately at the time. “The regulation does not ban fossil-fueled cars and pickup trucks; residents can drive existing internal combustion vehicles as long as they want. “The regulation will save drivers of clean vehicles $7,500 in maintenance and fuel costs over the first 10 years of use. It also will cut harmful pollutants by over 25 percent, save lives and save Californians $13 billion in health costs

Indiana regulators approve ‘large load’ interconnection rules

With one change, Indiana utility regulators on Wednesday approved a settlement agreement that sets the terms for connecting data centers and other large loads to the grid. “The tariff approach presented is a reasonable and balanced effort to provide a tariff for standard electric service, which provides financial protection and customer flexibility, and is a transparent, consistent offering across similarly situated customers,” the Indiana Utility Regulatory Commission said in its decision. Indiana Michigan Power — an American Electric Power utility — the Indiana Office of Utility Consumer Counselor, Citizens Action Coalition of Indiana, Amazon Data Services, Google, Microsoft and the Data Center Coalition filed their settlement agreement with the IURC in November. Driven by new large loads, I&M expects peak load in Indiana will jump to more than 7,000 MW by 2030 from 2,800 MW, according to the IURC’s decision. The revised tariff for industrial loads will ensure they pay for the grid upgrades needed to serve them and that those costs are not passed on to existing customers, I&M said in a news release. The settlement agreement amends I&M’s industrial power tariff. It applies to new or expanded facilities with contract capacity of at least 70 MW or 150 MW aggregated across a company. The agreement defers cost allocation issues to future proceedings, such as a tracker filing or rate case, instead of setting a cost allocation or specific methodology for large load customers. In one change to the agreement, the IURC ordered that any planned reduction of more than 20% of a large load customer’s contracted peak capacity must be submitted to the agency for its review and approval. The agreement comes amid major data center development in Northern Indiana. Amazon Web Services broke ground in October on an $11 billion data center campus near New Carlisle, Indiana,

Devon Q4 Earnings Down despite Record Production

U.S. oil and gas producer Devon Energy Corp. has posted fourth-quarter 2024 earnings of $639 million, down from $812 million for the previous quarter and $1.15 billion for the corresponding quarter of 2023. In a media release, Devon Energy said its oil production in the fourth quarter reached a record 398,000 barrels per day, exceeding guidance by 3 percent. Total companywide production averaged 848,000 oil-equivalent barrels per day (boed) in the fourth quarter. This represents a 16 percent increase compared to the previous quarter, the company said. Production for the quarter was positively impacted by the completion of the Grayson Mill acquisition in late September, which added 117,000 boed and 63,000 barrels of oil per day, according to Devon Energy. The company said its production outperformance was mainly due to its Eagle Ford asset, which achieved 92,000 boed. This is up 23 percent compared to the previous quarter, driven by the activation of 23 gross operated wells. In the fourth quarter, Devon’s total sales of oil, gas, and natural gas liquids amounted to $3.1 billion, reflecting a 16 percent rise in revenue compared to the preceding quarter. “During the fourth quarter, our diversified, multi-basin portfolio once again delivered across our assets, with the Rockies and Eagle Ford exceeding estimates due to strong new well productivity and solid base performance. In addition, the company achieved a 154 percent proved reserve replacement ratio in 2024”, Rick Muncrief, president and CEO, said. To contact the author, email [email protected] WHAT DO YOU THINK? Generated by readers, the comments included herein do not reflect the views and opinions of Rigzone. All comments are subject to editorial review. Off-topic, inappropriate or insulting comments will be removed. MORE FROM THIS AUTHOR

Ireland says there will be no computation without generation

Stanish said that, in 2023, she wrote a paper that predicted “by 2028, more than 70% of multinational enterprises will alter their data center strategies due to limited energy supplies and data center moratoriums, up from only about 5% in 2023. It has been interesting watching this trend evolve as expected, with Ireland being a major force in this conversation since the boycotts against data center growth started a few years ago.” Fair, equitable, and stable electricity allocation, she said, “means that the availability of electricity for digital services is not guaranteed in the future, and I expect these policies, data center moratoriums, and regional rejections will only continue and expand moving forward.” Stanish pointed out that this trend is not just occurring in Ireland. “Many studies show that, globally, enterprises’ digital technologies are consuming energy at a faster rate than overall growth in energy supply (though, to be clear, these studies mostly assume a static position on energy efficiency of current technologies, and don’t take into account potential for nuclear or hydrogen to assuage some of these supply issues).” If taken at face value, she said, this means that a lack of resources could cause widespread electricity shortages in data centers over the next several years. To mitigate this, Stanish said, “so far, data center moratoriums and related constraints (including reduced tax incentives) have been enacted in the US (specifically Virginia and Georgia), Denmark, Singapore, and other countries, in response to concerns about the excessive energy consumption of IT, particularly regarding compute-intense AI workloads and concerns regarding an IT energy monopoly in certain regions. As a result, governments (federal, state, county, etc.) are working to ensure that consumption does not outpace capacity.” Changes needed In its report, the CRU stated, “a safe and secure supply of energy is essential

Perspective: Can We Solve the AI Data Center Power Crisis with Microgrids?

President Trump announced a$500 billion private sector investment in the nation’s Artificial Intelligence (AI) infrastructure last month. The investment will come from The Stargate Project, a joint venture between OpenAI, SoftBank, Oracle and MGX, which intends to build 20 new AI data centers in the U.S in the next four to five years. The Stargate Project committed$100 billion for immediate deployment and construction has already begun on its first data center in Texas. At approximately a half a million square feet each, the partners say these new facilities will cement America’s leadership in AI, create jobs and stimulate economic growth. Stargate is not the only game in town, either. Microsoft is expected to invest$80 billion in AI data center development in 2025, with Google, AWS and Meta also spending big. While all this investment in AI infrastructure is certainly exciting, experts say there’s one lingering question that’s yet to be answered and it’s a big one: How are we going to power all these AI data centers? This will be one of the many questions tackled duringMicrogrid Knowledge’s annual conference, which will be held in Texas April 15-17 at the Sheraton Dallas. “Powering Data Centers: Collaborative Microgrid Solutions for a Growing Market” will be one of the key sessions on April 16. Industry experts will gather to discuss how private entities, developers and utilities can work together to deploy microgrids and distributed energy technologies that address the data center industry’s power needs. The panel will share solutions, technologies and strategies that will favorably position data centers in the energy queue. In advance of this session, we sat down with two microgrid experts to learn more about the challenges facing the data center industry and how microgrids can address the sector’s growing energy needs. We spoke with Michael Stadler, co-founder and

Data Center Tours: Iron Mountain VA-1, Manassas, Virginia

Iron Mountain Northern Virginia Overview Iron Mountain’s Northern Virginia data centers VA-1 through VA-7 are situated on a 142-acre highly secure campus in Prince William County, Virginia. Located at 11680 Hayden Road in Manassas, Iron Mountain VA-1 spans 167,958 sq. ft. and harbors 12.4 MW of total capacity to meet colocation needs. The 36 MW VA-2 facility stands nearby. The total campus features a mixture of single and multi-tenant facilities which together provide more than 2,000,000 SF of highly efficient green colocation space for enterprises, federal agencies, service providers and hyperscale clouds. The company notes that its Manassas campus offers tax savings compared to Ashburn and exceptional levels of energy-efficiency as well as a diverse and accessible ecosystem of cloud, network and other service providers. Iron Mountain’s Virginia campus has 9 total planned data centers, with 5 operational facilities to date and two more data centers coming soon. VA-2 recently became the first data center in the United States to achieve DCOS Maturity Level 3. As we continued the tour, Kinra led the way toward the break room, an area where customers can grab coffee or catch up on work. Unlike the high-end aesthetic of some other colocation providers, Iron Mountain’s approach is more practical and focused on functionality. At the secure shipping and receiving area, Kinra explained the process for handling customer equipment. “This is where our customers ship their equipment into,” he said. “They submit a ticket, send their shipments in, and we’ll take it, put it aside for them, and let them know when it’s here. Sometimes they ask us to take it to their environment, which we’ll do for them via a smart hands ticket.” Power Infrastructure and Security Measures The VA-1 campus is supported by a single substation, providing the necessary power for its growing

Land and Expand: DPO, Microsoft, JLL and BlackChamber, Prologis, Core Scientific, Overwatch Capital

Land and Expand is a periodic feature at Data Center Frontier highlighting the latest data center development news, including new sites, land acquisitions and campus expansions. Here are some of the new and notable developments from hyperscale and colocation data center developers and operators about which we’ve been reading lately. DPO to Develop $200 Million AI Data Center in Wisconsin Rapids; Strategic Partnership with Billerud’s CWPCo Unlocks Hydroelectric Power for High-Density AI Compute Digital Power Optimization (DPO) is moving forward with plans to build a $200 million high-performance computing (HPC) data center in Wisconsin Rapids, Wisconsin. The project, designed to support up to 20 megawatts (MW) of artificial intelligence (AI) computing, leverages an innovative partnership with Consolidated Water Power Company (CWPCo), a subsidiary of global packaging leader Billerud. DPO specializes in developing and operating data centers optimized for power-dense computing. By partnering with utilities and independent power producers, DPO colocates its facilities at energy generation sites, ensuring direct access to sustainable power for AI, HPC, and blockchain computing. The company is privately held. Leveraging Power Infrastructure for Speed-to-Energization CWPCo, a regulated utility subsidiary, has operated hydroelectric generation assets since 1894, reliably serving industrial and commercial customers in Wisconsin Rapids, Biron, and Stevens Point. Parent company Billerud is a global leader in high-performance packaging materials, committed to sustainability and innovation. The company operates nine production facilities across Sweden, the USA, and Finland, employing 5,800 people in over 19 countries. The data center will be powered by CWPCo’s renewable hydroelectric assets, tapping into the utility’s existing 32 megawatts of generation capacity. The partnership grants DPO a long-term land lease—extending up to 50 years—alongside interconnection rights to an already-energized substation and a firm, reliable power supply. “AI infrastructure is evolving at an unprecedented pace, and access to power-dense sites is critical,” said Andrew

Data center spending to top $1 trillion by 2029 as AI transforms infrastructure

His projections account for recent advances in AI and data center efficiency, he says. For example, the open-source AI model from Chinese company DeepSeek seems to have shown that an LLM can produce very high-quality results at a very low cost with some clever architectural changes to how the models work. These improvements are likely to be quickly replicated by other AI companies. “A lot of these companies are trying to push out more efficient models,” says Fung. “There’s a lot of effort to reduce costs and to make it more efficient.” In addition, hyperscalers are designing and building their own chips, optimized for their AI workloads. Just the accelerator market alone is projected to reach $392 billion by 2029, Dell’Oro predicts. By that time, custom accelerators will outpace commercially available accelerators such as GPUs. The deployment of dedicated AI servers also has an impact on networking, power and cooling. As a result, spending on data center physical infrastructure (DCPI) will also increase, though at a more moderate pace, growing by 14% annually to $61 billion in 2029. “DCPI deployments are a prerequisite to support AI workloads,” says Tam Dell’Oro, founder of Dell’Oro Group, in the report. The research firm raised its outlook in this area due to the fact that actual 2024 results exceeded its expectations, and demand is spreading from tier one to tier two cloud service providers. In addition, governments and tier one telecom operators are getting involved in data center expansion, making it a long-term trend.

The Future of Property Values and Power in Virginia’s Loudoun County and ‘Data Center Alley’

Loudoun County’s FY 2026 Proposed Budget Is Released This week, Virginia’s Loudoun County released its FY 2026 Proposed Budget. The document notes how data centers are a major driver of revenue growth in Loudoun County, contributing significantly to both personal and real property tax revenues. As noted above, data centers generate almost 50% of Loudoun County property tax revenues. Importantly, Loudoun County has now implemented measures such as a Revenue Stabilization Fund (RSF) to manage the risks associated with this revenue dependency. The FY 2026 budget reflects the strong growth in data center-related revenue, allowing for tax rate reductions while still funding critical services and infrastructure projects. But the county is mindful of the potential volatility in data center revenue and is planning for long-term fiscal sustainability. The FY 2026 Proposed Budget notes how Loudoun County’s revenue from personal property taxes, particularly from data centers, has grown significantly. From FY 2013 to FY 2026, revenue from this source has increased from $60 million to over $800 million. Additionally, the county said its FY 2026 Proposed Budget benefits from $150 million in new revenue from the personal property tax portfolio, with $133 million generated specifically from computer equipment (primarily data centers). The county said data centers have also significantly impacted the real property tax portfolio. In Tax Year (TY) 2025, 73% of the county’s commercial portfolio is composed of data centers. The county said its overall commercial portfolio experienced a 50% increase in value between TY 2024 and TY 2025, largely driven by the appreciation of data center properties. RSF Meets Positive Economic Outlook The Loudoun County Board of Supervisors created the aformentioned Revenue Stabilization Fund (RSF) to manage the risks associated with the county’s reliance on data center-related revenue. The RSF targets 10% of data center-related real and personal property tax

Microsoft will invest $80B in AI data centers in fiscal 2025

And Microsoft isn’t the only one that is ramping up its investments into AI-enabled data centers. Rival cloud service providers are all investing in either upgrading or opening new data centers to capture a larger chunk of business from developers and users of large language models (LLMs). In a report published in October 2024, Bloomberg Intelligence estimated that demand for generative AI would push Microsoft, AWS, Google, Oracle, Meta, and Apple would between them devote $200 billion to capex in 2025, up from $110 billion in 2023. Microsoft is one of the biggest spenders, followed closely by Google and AWS, Bloomberg Intelligence said. Its estimate of Microsoft’s capital spending on AI, at $62.4 billion for calendar 2025, is lower than Smith’s claim that the company will invest $80 billion in the fiscal year to June 30, 2025. Both figures, though, are way higher than Microsoft’s 2020 capital expenditure of “just” $17.6 billion. The majority of the increased spending is tied to cloud services and the expansion of AI infrastructure needed to provide compute capacity for OpenAI workloads. Separately, last October Amazon CEO Andy Jassy said his company planned total capex spend of $75 billion in 2024 and even more in 2025, with much of it going to AWS, its cloud computing division.

John Deere unveils more autonomous farm machines to address skill labor shortage

Join our daily and weekly newsletters for the latest updates and exclusive content on industry-leading AI coverage. Learn More Self-driving tractors might be the path to self-driving cars. John Deere has revealed a new line of autonomous machines and tech across agriculture, construction and commercial landscaping. The Moline, Illinois-based John Deere has been in business for 187 years, yet it’s been a regular as a non-tech company showing off technology at the big tech trade show in Las Vegas and is back at CES 2025 with more autonomous tractors and other vehicles. This is not something we usually cover, but John Deere has a lot of data that is interesting in the big picture of tech. The message from the company is that there aren’t enough skilled farm laborers to do the work that its customers need. It’s been a challenge for most of the last two decades, said Jahmy Hindman, CTO at John Deere, in a briefing. Much of the tech will come this fall and after that. He noted that the average farmer in the U.S. is over 58 and works 12 to 18 hours a day to grow food for us. And he said the American Farm Bureau Federation estimates there are roughly 2.4 million farm jobs that need to be filled annually; and the agricultural work force continues to shrink. (This is my hint to the anti-immigration crowd). John Deere’s autonomous 9RX Tractor. Farmers can oversee it using an app. While each of these industries experiences their own set of challenges, a commonality across all is skilled labor availability. In construction, about 80% percent of contractors struggle to find skilled labor. And in commercial landscaping, 86% of landscaping business owners can’t find labor to fill open positions, he said. “They have to figure out how to do

2025 playbook for enterprise AI success, from agents to evals

Join our daily and weekly newsletters for the latest updates and exclusive content on industry-leading AI coverage. Learn More 2025 is poised to be a pivotal year for enterprise AI. The past year has seen rapid innovation, and this year will see the same. This has made it more critical than ever to revisit your AI strategy to stay competitive and create value for your customers. From scaling AI agents to optimizing costs, here are the five critical areas enterprises should prioritize for their AI strategy this year. 1. Agents: the next generation of automation AI agents are no longer theoretical. In 2025, they’re indispensable tools for enterprises looking to streamline operations and enhance customer interactions. Unlike traditional software, agents powered by large language models (LLMs) can make nuanced decisions, navigate complex multi-step tasks, and integrate seamlessly with tools and APIs. At the start of 2024, agents were not ready for prime time, making frustrating mistakes like hallucinating URLs. They started getting better as frontier large language models themselves improved. “Let me put it this way,” said Sam Witteveen, cofounder of Red Dragon, a company that develops agents for companies, and that recently reviewed the 48 agents it built last year. “Interestingly, the ones that we built at the start of the year, a lot of those worked way better at the end of the year just because the models got better.” Witteveen shared this in the video podcast we filmed to discuss these five big trends in detail. Models are getting better and hallucinating less, and they’re also being trained to do agentic tasks. Another feature that the model providers are researching is a way to use the LLM as a judge, and as models get cheaper (something we’ll cover below), companies can use three or more models to

OpenAI’s red teaming innovations define new essentials for security leaders in the AI era

Join our daily and weekly newsletters for the latest updates and exclusive content on industry-leading AI coverage. Learn More OpenAI has taken a more aggressive approach to red teaming than its AI competitors, demonstrating its security teams’ advanced capabilities in two areas: multi-step reinforcement and external red teaming. OpenAI recently released two papers that set a new competitive standard for improving the quality, reliability and safety of AI models in these two techniques and more. The first paper, “OpenAI’s Approach to External Red Teaming for AI Models and Systems,” reports that specialized teams outside the company have proven effective in uncovering vulnerabilities that might otherwise have made it into a released model because in-house testing techniques may have missed them. In the second paper, “Diverse and Effective Red Teaming with Auto-Generated Rewards and Multi-Step Reinforcement Learning,” OpenAI introduces an automated framework that relies on iterative reinforcement learning to generate a broad spectrum of novel, wide-ranging attacks. Going all-in on red teaming pays practical, competitive dividends It’s encouraging to see competitive intensity in red teaming growing among AI companies. When Anthropic released its AI red team guidelines in June of last year, it joined AI providers including Google, Microsoft, Nvidia, OpenAI, and even the U.S.’s National Institute of Standards and Technology (NIST), which all had released red teaming frameworks. Investing heavily in red teaming yields tangible benefits for security leaders in any organization. OpenAI’s paper on external red teaming provides a detailed analysis of how the company strives to create specialized external teams that include cybersecurity and subject matter experts. The goal is to see if knowledgeable external teams can defeat models’ security perimeters and find gaps in their security, biases and controls that prompt-based testing couldn’t find. What makes OpenAI’s recent papers noteworthy is how well they define using human-in-the-middle

Stay Ahead, Stay ONMINE