OpenAI has published new data showing the gap between heavy and typical enterprise use of its AI tools has more than tripled since January, alongside case studies of three startups it says illustrate how leading firms are embedding agents into core workflows.

According to OpenAI's latest Enterprise Signals report, published 1 September, the top 10% of enterprise users by AI usage now generate 8.3 times as many output tokens per active user as typical firms, up from a 2.6 times gap in January. OpenAI said this reflects leading firms increasingly connecting agents to company context and tools and delegating more substantive work.

The report highlights three companies as examples. At Basis, which builds AI agents for accounting firms, OpenAI said first-day employee onboarding now takes 30 minutes rather than two hours, using a reusable "skill" built around its Codex tool. At Clay, a go-to-market software company, a sales engineer created a persistent digital workspace with dedicated AI subagents tracking each account, which the company said saves roughly an hour of nightly inbox triage. At Exa Labs, which builds search infrastructure for AI agents, Codex now monitors developer ecosystems for integration opportunities, drafts pull requests and prepares weekly updates, with human review before anything ships.

OpenAI set out six recommended steps for enterprise leaders looking to scale similar agentic workflows, including defining measurable outcomes and building human oversight into the process from the start.

Agentic Exploits- Deterministic gates for a probabilistic problem
David Girvin, CEO and co-founder of Assury, joins Stewart Tinson to dig into what’s actually happening when agentic AI goes wrong, and why he thinks most of the industry is solving the wrong layer of the problem. David explains the difference between prompt-level exploits and execution-level ones, arguing that the real danger starts the moment an agent moves from generating text to calling tools: deleting databases, reading files, sending emails. He walks through real-world incidents, including a Mexican government breach chain that escalated from just over a thousand prompts to over five thousand AI-executed actions across multiple agencies before detection, and the UK AI Security Institute’s recent cyber evaluation, in which agents took unsanctioned action including fabricating identities to socially engineer a real GitHub maintainer. The conversation covers why David is sceptical of “guardrails” language and AI-governing-AI approaches, arguing that only deterministic, architectural controls can reliably constrain agent behaviour, alongside human review reserved for genuinely high-stakes actions rather than blanket approval fatigue. He breaks down credential starvation, session risk accumulation, and why classifier-based tools keep failing inconsistently on identical actions, pointing to a named frontier lab’s own zero trust paper as an example of the industry misjudging what actually works. Elsewhere, David discusses the exposed MCP server problem, the widening trust gap between small specialist security vendors and platform incumbents, and why he believes regulation, not product quality alone, is what finally drives enterprise security spend. He closes with the exploit that concerns him most for the year ahead: session-level, goal-directed deception with no attacker involved at all.
BrightTALK
Share this post
The link has been copied!