Proceedings Report

The second Meta Operations Conference (Metopcon II) was held at the Hellenic Club Woden, Canberra, on 23 October 2026. Its subject was the use of AI agents to run business processes, and the sovereign capability on which that use depends. The 10 sessions covered model capability and cost, data centre infrastructure, agentic operations, cyber defence, sovereign AI, agentified business processes, agentic software engineering, and the auditability of AI decisions.

The sessions reported that the cost of completing a task with AI fell sharply between April and October 2026 while capability rose. Hardware, memory, power and cooling constrain supply, and Australia is at a disadvantage on cooling and hardware lead times. Agents now operate infrastructure, defend it and run whole business functions, with people approving at defined points. Organisations stop short of operational use where AI decisions cannot be traced to rules. 6 questions remained in dispute at the close.

Principal findings

Context

By an estimate given at the conference, 30% to 40% of the developed-world population uses AI for personal or business productivity. Most of that use is individual: a staff member with a chat assistant, a developer with a coding tool. Companies convert the time saved into lower operating expenditure. Few have reorganised a process around agents.

Australia sources nearly all of its frontier models from abroad, runs them on imported hardware and connects to the world through about 16 international undersea cables. Access to 2 frontier models was suspended for several weeks in mid-2026 for export-control reasons. By the account given at the conference, national productivity is at its lowest since records began 60 years ago, despite rising technology spending.

The conference addressed 2 questions. The first was what is required for AI to move from assisting individuals to running processes. The second was on whose hardware, under whose control and by whose rules that operation runs.

Figure 1. The subject of the conference. Agentification moves the human role up a level at

each step, and each step rests on hardware, models and law.

Programme

The sections that follow report the sessions in the order they ran.

Figure 2. The sessions of 23 October 2026 in the order they ran, by subject.

Pace of change

The opening session placed AI in the history of technologies that drew predictions of social harm.

The same questions recur with each technology: whether employment will be destroyed, whether the moral basis of society will suffer, who will hold control, and whether the technology is a fad. Computers were widely described as a fad in the early 1990s. The same mitigations also recur. Business finds other methods, new occupations emerge, institutions adapt and controls are introduced. Realised costs have differed from those predicted, and the falling price of AI tokens is the current case.

The interval between generational changes has shortened (Figure 3). For AI the session gave a judgement, not a measurement: 3 generational changes of comparable scale in 3 years. Alvin Toffler's Future Shock (1970) described a condition people suffer when change outpaces their capacity to cope. Whether legislatures can now legislate at the pace the technology changes was left open.

Figure 3. Years taken for half the population to adopt each technology, as presented. AI is not plotted; the estimate given was 3 generational changes in 3 years.

The precedent of new occupations is tested against the staffing evidence in Software engineering. Regulatory lag recurs in Models and cost and in Interfaces and commerce.

Models and cost

Cost per task

The tracking site artificialanalysis.ai plots models on an intelligence index derived from benchmarks against the cost of completing a benchmark task. It tracks 706 models, including open models such as Qwen, DeepSeek and GLM. Between April and October 2026 the efficient frontier on that chart moved towards higher intelligence at lower cost, with the largest single step in September from the latest GPT models. The projection presented was that leading models will pass 65 on the index within 6 months, at substantially lower cost.

Figure 4. Developments between May and October 2026 reported in this section, by category.

The session gave 3 causes for the pace of model releases. More laboratories are releasing models. Laboratories use AI to build their next models. The major laboratories have moved from public internet data to data bought from organisations.

Price per million tokens is a poor guide to cost per task (Figure 5). A frontier model priced at US$50 per million output tokens completes a benchmark task for about US$1.50, and DeepSeek 4.1 Flash completes the same task for about US$0.20. The session treated demand for intelligence as rising as cost falls, with no evident ceiling. The infrastructure session disputed that these prices reflect cost.

Figure 5. Cost per benchmark task, as presented. The frontier model is priced at US$50 per million output tokens.

Recent releases

Flint runs frontier-level coding assistance locally, so code and ideas need not be sent to a cloud provider. The developer reported that its automated research system chose a sparser architecture with 10% faster decoding, devised new quantisation methods and wrote custom

kernels. Other teams were expected to replicate the method. A projection cited at the conference has a new model released every day from January 2027.

Providers retire models by reducing the servers allocated to them, which moves customers to newer versions. The session's advice was to build systems so that the model can be replaced without effect, since models will keep getting cheaper and better.

Decision models

The first decision model was released on 15 September 2026. Liquid, Cloudflare and Microsoft released competing models within 4 weeks, and the first model's developer was reported to have raised US$870m at a valuation of US$7.5bn. A decision model takes structured JSON input and returns a yes or no answer, or a probability, without explanatory text. It is cheaper and faster per task than a reasoning model, and its developer states that it does not hallucinate. A demonstration showed a decision model playing the game Doom at about 10 decisions a second.

Decision models apply wherever a person makes a gate decision in a workflow: whether to pay an invoice, or whether an invoice has the ABN, GST and address an Australian tax invoice requires. They now accept images, audio and video, which extends their use to inspecting printed circuit boards and checking rooftop solar installations for compliance. Enterprises are expected to run them alongside reasoning models. Their use is expected to extend to robotics, manufacturing and defence.

Personal agents

Few delegates used personal agents. The session expected rapid growth, and gave the example of an agent instructed to sell every item photographed in a folder: it identifies each item, lists it, negotiates with buyers and arranges postage.

Frameworks and routers

Agent frameworks allow AI-native applications to be built. Examples given ranged from LangChain and the Microsoft Agent Framework to Pi, a minimal agent harness released at version 1.0 in early October 2026, whose built-in agent rewrites its own code into what the user describes. In the example given, a salon receptionist tells the system to move a client from 11:00 to 15:00 instead of editing the booking through screens.

Model routers such as the open-source LiteLLM sit between an organisation's tools and its inference providers (Figure 6). They pin models to aliases by role and route each request to a suitable model. The added latency is small. Their governance functions are:

recording who requested what applying rules, such as whether information classified as protected may leave the organisation accounting for cost by user sharing a small number of subscriptions across all staff

Figure 6. A model router governs each request and passes it to the model suited to the task. A decision model answers a gate previously answered by a person.

Because the router holds an alias for each role, a model can be replaced without changing any application, and the governance record is unaffected.

Science and medicine

AI disproved an Erdős conjecture during the period. On 8 September 2026 OpenAI published a claimed proof of the Navier-Stokes Millennium Prize Problem, written in the formal proof language Lean and about 38,000 pages long, which remains under review. A further 722 manuscripts of solutions to open problems followed at an average cost of about US$3 each, and mathematicians received them coolly.

The session also reported AI-assisted research in quantum computing and fusion, AlphaFold-based drug discovery, and a drug for pulmonary fibrosis designed entirely by AI that received its first phase 3 dose in September 2026. Some projections place longevity

escape velocity, the point at which medical progress adds more than a year of life expectancy for each year lived, between 2035 and 2040.

Robotics

Robotics is developing in the same pattern as AI inference: foundation models, accessible inference and developer ecosystems, with progress on joints, servos and hands. Physical safety is the main obstacle. How a household would stop an 85 kg robot that malfunctioned is unresolved. Figure has placed robots in about 64 empty homes, where staff create mess for the robots to clean, to collect data. Aged care, with its workforce shortages, is the expected first major market.

Some American homes may have autonomous robots within 12 months. Regulatory process is expected to delay overseas products in Australia by 3 to 5 years, and the session proposed that regulators use AI to shorten that process.

Outlook

Thousands of models are expected: general intelligence, national variants trained on different data, and many small specialist models coordinated by general ones. Firms holding decades of industry data are expected to build specialist models in microbiology, chemistry, physics and other fields within 12 months.

Infrastructure constraints

Cost of supply

The infrastructure session stated that consumer subscriptions of A$20 to A$50 a month are subsidised by companies buying market share, and do not reflect the cost of hardware, power and buildings. On that view, the per-task figures in Models and cost are prices, not costs. The disagreement is recorded in Unresolved questions.

Rack density

A typical rack drew 1 kW to 2 kW a decade ago. AI racks now reach 1,000 kW. Operators are moving to 800 V DC distribution because cabling that load at 240 V would be wider than the rack. Data centres are designed for a life of 15 to 20 years, so facilities 6 to 9 years old are limited in the density they can support. A facility designed in 2017 at 30 kW per rack across 100 racks can host AI equipment for that reason. A single 600 mm rack of the latest liquid-cooled NVIDIA equipment costs A$50m to A$100m, and a large deployment needs hundreds or thousands of them.

Cooling

Australian ambient temperatures typically exceed 20°C, so air-cooled operators run compressors for most of the year and have free cooling only at night and in winter (Figure 7). An enterprise running air-cooled AI in Australia has neither the scale of a hyperscaler nor the free cooling of a cooler climate.

Figure 7. Cooling below hyperscale in Australia.

Power and water

Victoria has about 3 GW of available power and runs short 3 or 4 times a year, on days of about 45°C when household air conditioning peaks. Data centres hold contracts that require them to switch to their own generators on those days, which returns power to the grid. Water use depends on the cooling technology: refrigeration uses none and evaporative cooling does. Density has risen elsewhere in the facility as well. A single network link into a rack now runs at 1.6 Tbps, and a single drive holds 256 TB.

Hardware supply

GPUs and memory cannot be made fast enough. Production is concentrated in a few manufacturers, and the standard lead time for GPU hardware exceeds 60 weeks.

Expedited prices were rising by about 20% a week. A customer paid about A$3.5m for more than 30 H200 cards delivered in 2 weeks. A proof of concept needing 8 cards at A$120,000 each costs about A$960,000 in cards alone. Buyers pay the premium because a 2-year wait forgoes revenue and delivers hardware a generation old.

Figure 8. The NVIDIA H200 card at 3 prices, as presented. The April price is the expedited price 6 months before the conference.

Operators buy directly from the manufacturers that supply the OEMs, collect hardware in person overseas, and require a month's payment in advance and a 3-month deposit before allocating rack space. A 100 MW facility of 6,000 racks, costing A$1.5bn and taking about 24 months to build, awaits a permit in Victoria. Small facilities, each built in about 6 months, meet demand in the meantime.

Figure 9. The supply chain for a GPU server in Australia, with the lead times and prices cited.

Inference silicon

GPUs are not the most economical platform for inference. Inference companies are expected to produce dedicated chips within 12 to 24 months, which would separate training infrastructure from inference infrastructure, and models are expected to be embedded in

silicon. Total power consumption is not expected to fall, because demand absorbs efficiency gains.

Power geography

Australia was described as the second-largest growth market for data centres, because it has spare power on most days. Large technology companies are contracting nuclear generation and running on-site gas turbines. Australia has ruled out nuclear power. Renewables were described as scaling to megawatts but not gigawatts: a 1 MW rack occupies a 600 mm footprint, while 1 MW of solar needs land of about 2 football fields.

Many new Australian data centres serve foreign customers. The session proposed that such operators pay more for the power, water and resources they consume. A delegate proposed that data centre construction fund free household power.

Sovereign hardware

The session defined sovereign capability as hardware bought by an Australian organisation, located in Australia, and owned, run and controlled there. A frontier model controlled from abroad is not sovereign, however it is hosted. The session expected nations to become digitally self-contained and governments to take control of AI infrastructure. A delegate questioned whether state intervention has made any industry more efficient. Hardware fingerprinting, already used by game platforms to ban players by GPU identifier, allows AI hardware to be tracked.

Agentic operations

Design

Data centre operation uses separate tools, each with its own interface: Proxmox for compute, a backup server with its own scheduling and pruning, TrueNAS for storage and WinBox for networking. Senior staff work at the command line. The session demonstrated a single system, connected to all of them, that operators address in plain English.

Language models are probabilistic and return different answers to the same question on different days. The design therefore separates reasoning about intent from the execution of fixed procedures (Figure 10). The model selects an approved procedure. The procedure does the work: building a virtual machine, for example, always uses an approved template with set resources, access configuration, boot and readiness checks and service checks. The system covers hypervisors, logs and alerts, temperature, humidity and UPS sensors, Cloudflare, Tailscale and switches, backup coverage for virtual machines and databases, and the incident history.

Figure 10. Reasoning separated from execution. Each incident is written to a repository that the model reads before it answers.

Demonstration

On production equipment in a working data centre, the harness Mornay, available in a browser and on macOS, iOS, Android and Windows, reported in conversation:

the status of every node in the compute cluster live backup coverage across the fleet about 17 minutes of UPS runtime on mains failure room temperature, humidity, CO₂ and noise, with a 24-hour trend the devices on the facility's Wi-Fi, flagging a device with a weak signal

Autonomy stages

Figure 11. The 5-stage path to an autonomous data centre. Stages 1 to 4 were

demonstrated live. Stage 5, in orange, is in progress.

Fault tests

The event-driven component, Sentinel, monitors continuously and starts workflows without a prompt. 3 faults were induced on live virtual machines.

Asked for a summary of the previous hour, Sentinel listed each incident, its resolution and the number of human interventions. Records are kept in Git, in the runbooks and in a repository, written and maintained by AI, that documents every item of equipment, application, incident, roadmap item and open issue in the facility. The AI reads that repository before it answers.

Operating principles

Capability threshold

Practitioners placed the point at which writing code by hand stopped being worthwhile at Claude Opus 4.6, and described Fable 5.1 and Mythos 5.1 as a further step in tracing problems to their root cause. Custom software written to need with a coding agent was described as preferable to the best open-source and commercial platforms. It is cheaper to

build for a market of 1, harder for outside attackers to study and easier to ring-fence. Monolithic systems built before AI are the hardest to work with.

Security practitioners at the session reported that frontier models refuse or downgrade requests for security testing, and that an operator working by hand cannot respond at the speed of an AI attacker.

Cyber defence

Bitcoin exposure

Bitcoin's code has been open source under the MIT licence since 2009, so anyone can read, run, fork or audit it. Its market capitalisation was given as about A$2.35 trillion, with 100 million to 300 million holders. An attacker who compromises a wallet or an exchange takes money directly. An attacker who steals a corporate database must ransom it or sell it. The session reported that Bitcoin is therefore attacked first and hardened first, and that other sectors follow on the same curve.

Exploits

Figure 12. The sequence of events after the Kimi K3 open weights were released, as presented. Losses are as reported at the conference.

The red team began when the chief executive of a US Bitcoin company tested his own code with Kimi K3 on its release, found nothing, scanned hundreds of other repositories across the ecosystem within days and published the results.

Red team findings

Figure 13. Triage of 643 AI-generated findings by experienced maintainers. About 2% were high severity or above.

The session attributed the gap between those reporting flaws and those receiving the reports to the Lindy effect: the assumption that because the internet and the banks have worked for 30 or 40 years, they will keep working.

Platforms and open weights

Platforms such as OpenAI and Anthropic release a model, add guardrails to limit harm, lose market share to the guardrails, and release again. Open-weight models run anywhere, outside that cycle. Red team members admitted to a frontier laboratory's internal cyber programme after extensive vetting still met refusals on logged queries. They returned to open-weight models, which need no pretexts and can be fine-tuned and run privately.

Open models trail the frontier platforms by about 1 generation, currently 9 to 12 months. The gap is wider on cyber capability, for models such as Kimi K3 and GLM 5.3, and narrower on general intelligence. Privacy-respecting hosted options exist, and small machines such as the NVIDIA DGX Spark give individuals local capability.

The red team's conclusion was that frontier platforms are unusable for cyber defence and open-weight models are necessary. Unrestricted frontier access for security work is limited to governments and very large organisations treated as critical infrastructure. Small and medium enterprises, which make up most of the Australian economy, are excluded.

Software economics

AI platforms receive more detailed information about their users than social media did. The session described platforms inviting businesses to explain how they operate, and then

releasing tools that replace the sector.

Reverse-engineering pipelines such as REA 3.2, released on 3 October 2026, disassemble a binary, derive the business rules it implements, pass those rules to a separate agent to design a clean-room architecture, and pass the design to a coding agent that builds an open-source replacement.

Closed-source vendors rely on intellectual property and licensing. The session's position was that, outside mandated use, closed source has little protection left, and that open code is exploited first but is also hardened first.

Defensive capacity

Code written over 50 years is now readable by a machine that does not tire and has perfect recall. Once a vulnerability is identified, a model can build a working exploit and prove it. 2 remote-code-execution vulnerabilities in the Linux kernel were published, unpatched, the night before the session. Defenders use the same tools. A team of about 6 now does work that needed a team 5 to 10 times larger 3 or 4 years ago. Bitcoin miners seek more hashes per joule and AI operators more tokens per joule, and demand continues to exceed supply as costs fall.

Hidden malicious behaviour in open weights was described as probable. The red team's practitioners self-host their models inside their own systems.

Sovereign AI

Cultural risk

When asked to help prepare a case for Australian sovereign AI, a widely used foreign model resisted at each prompt. The session stated that the largest risk in relying on another country's model is cultural, because a model reflects the culture and priorities of its builder. A parliamentary inquiry into technology and productivity has been launched.

Exposures

Definition

The session defined sovereign AI as existing where the people of a country, through their government, control the company that controls the AI. The definition extends the hardware definition in Infrastructure constraints, and excludes services from foreign laboratories branded as Australian sovereign AI (Figure 14).

Figure 14. The 4 elements of sovereign AI reported across the morning, and the risks that test them.

A sovereign provider can commit never to look at customer data, prompts, responses or data sets on any tier. Distrust of providers' handling of data, including documented cases and US litigation, has held back adoption by Australian SMEs.

The session stated that Australia, with fewer than 30 million people, does not need hyperscale capacity and can be served from a modest footprint. The infrastructure session described a 100 MW facility in planning and an aim to become Australia's own hyperscaler.

Weights and governance

Behaviours can be embedded in a model's layers. An open-weight model deployed in an environment cut off from the internet could disrupt infrastructure without ever reporting back. Sovereignty therefore requires that the builder of a model can be held to account (Figure 15). Government can pause and set conditions before proceeding, but rules that disadvantage Australian builders against foreign ones defeat their purpose.

Figure 15. Open weights cut both ways. The benefits on the upper branches were reported in the cyber defence session, and the risks on the lower branches in the sovereignty session.

Copyright

Australian copyright law, as described at the session, exposes local builders to prosecution for training on copyrighted material, while models trained abroad on similar data can be imported and hosted. The session supported payment to copyright holders, artists and creators, and consistent treatment of local and foreign builders. A delegate noted that, on the same principle, Australia should not host a foreign model trained on data that would be unlawful to use in Australia.

Investment risk

Figures cited from a leading laboratory's listing documents put its non-cancellable spending commitments at about US$450bn, in addition to the amounts already spent. Investors in such a company typically expect a 10-fold return. The session compared the position to the US railway boom of the late 19th century, which was followed by a depression, and questioned how long NVIDIA's valuation of about US$5 trillion would hold. Open-source models are not free to produce, and someone pays for them.

Model building

Capable models can now be built by small teams for single-digit to tens of millions of dollars.

An Australian provider, with about 20 staff and working on transformer models since 2019, was preparing to release a model of about 192 billion parameters for public ranking. Its customers are mainly in defence, intelligence and law enforcement. Its agent platform, Agentaus, can serve about 40,000 users, with data and processing kept in Australia. The session described decision models as resembling the BERT-style models such firms ran in 2019. Maincode, whose model Matilda ranks low, is one of the few other Australian builders.

The benefits stated for building in Australia were high-security environments in which the integrity of a model's layers can be guaranteed, models that reflect Indigenous and non-Indigenous Australian cultures, productivity gains retained in Australia, and self-sufficiency.

The session held that Australia can build sovereign AI without government, provided it complies with Australian law.

Agentified business

Case study

Account and performance figures for the business are withheld from this report.

Agent roles

Implementation lessons

The first collections agent hallucinated, made inappropriate statements to customers and made promises the company could not keep. It was corrected by surrounding it with monitoring agents that track and refine its performance.

Figure 16. The agentification sequence followed by the case study. The return path shows that each process fixed leads to the next.

Commercial model

Revio Labs, launched in 2025 as a separate company, applies the same method to SMEs.

Its lead-generation agent finds prospects in any country from sources such as Apollo and Clay, researches each lead against the products being sold, and follows up automatically.

Legal document work was identified as among the largest uses of language models.

Software engineering

ChimeDeck

The case study came from a digital agency that has built about 200 two-sided marketplaces for international clients on the ShareTribe platform over 8 or 9 years. DriveLah was its second customer. Its staff peaked at about 50 to 60 and now number about 25.

Each client project ran on a Trello board, with each card a feature at a fixed price, paid when the client accepts the card into testing. Trello cost about US$6,000 a year. The agency replaced it with ChimeDeck, built with agents, to learn agentic development on a product its business depends on. ChimeDeck has an MCP interface, a command-line interface and a full API, so its user interface is optional.

ChimeDeck costs about US$700 a year to host and about 20% of a full-time role to maintain. The work began in April 2026, after Claude Opus 4.6, and still met token costs, hallucination, lost context and inconsistency as the code base grew.

Cost of ownership

When the build cost of software approaches zero, the business case for replacing a rented product with custom software still includes migration of data, retraining, 5 years of hosting and maintenance, and management attention. A rented SaaS product needs almost no attention. Custom software needs a product owner, and each new request, such as a new report, draws on executive time. Within about 6 months of a first version the code base is brownfield: the person who directed it may have left, users are finding bugs, and management must decide what to fix.

Software Factory

The agency's Software Factory lets clients direct AI agents through ChimeDeck cards. An agent replies to a comment on a card, refining a requirement or estimating it, in about 5 or 6 minutes. The same exchange with a business analyst or project manager previously took up to 24 hours for clients in other time zones. 1 person built the factory part time over about 6 weeks with an agent, without writing code by hand (Figure 17).

Figure 17. How the Software Factory turns a client comment on a card into deployed code.

People remain at 3 points. A client writes the card, a human moves it to production, and the only move an agent may make on its own is to return a card as blocked.

The agent deployed the infrastructure itself: about 8 servers, a self-hosted Sentry installation of about 14 services, and Tailscale networking. Client onboarding fell from about a week to about 30 minutes for 80% of the steps, and 7 clients were onboarded. Penetration testing remained outstanding. The design follows the pattern described in Agentic operations: reasoning separated from procedure, authority granted in stages, and knowledge held as text in a repository the agents read before they act.

Models and cost

Model costs could probably be halved. The agency uses every available tool to learn how each performs.

Incident response

At 05:49 a US client reported its website down. With only a phone available, the operator asked the agent through Discord. The agent confirmed a 502 error from NGINX, checked AWS logs, commit history and deployment history, established that no code change was responsible, and identified a faulty boot image in an Auto Scaling Group instance refresh. By 05:57 all 3 instances were serving correctly and 10 consecutive checks had passed. The agent warned that the fault would recur and raised a backlog card with an incident report. A senior developer would previously have begun work about 4 hours later.

Disintermediation

The agency's revenue has fallen because its customers use AI. For about 9 months, entrepreneurs have started with general AI assistants, which tend to recommend building a marketplace directly instead of on a low-code platform, and the platform's growth has stalled.

About half of the agency's customers now write their own code with AI and pay the agency only to review the pull request. Work previously worth US$5,000 to US$10,000 is now worth about US$300, and Copilot performs the review. The agency made no profit in 2026 and halved its staff. It identified its skill files, which record how it works and the problems it has solved, as its only distinctive asset.

Figure 18. Customers using AI directly have removed the service provider from the chain.

The session's position was that every service business, including agencies, advertising firms, recruiters and managed service providers, faces the same disintermediation. Value accrues to infrastructure and AI platform providers, which makes ownership of that infrastructure a sovereignty question. How that value is taxed and redistributed to displaced workers was not resolved. A projection put unemployment rising from 4% to 12% in the transition, with doubt that new jobs would appear fast enough.

Positions in discussion

Interfaces and commerce

Conversational interfaces

A gym paying about US$80 a month for membership software was given an agent-first replacement, built from a specification by an agent pipeline. The result is a mobile app with 3 screens: a chat, a group chat and an administrator's inbox. The session expected the effort of specifying requirements to fall towards zero, so that a person starting a gym would say so and an agent would supply the website, sign-ups, payments and monthly reports.

Every application is expected to become a conversational agent interface, as Agentic operations showed for infrastructure, with people speaking instead of typing and the agent generating the display needed at the time. AI is also expected to abandon conventions designed for human use, such as SQL and current programming languages. GLM and DeepSeek have been observed switching to Chinese in their reasoning traces while answering in English. Infrastructure was the recommended investment, on the basis that software in any form runs on hardware.

Agent commerce

Personal agents such as Grokbot and Instinct are the consumer application, for people willing to hand over their personal data. Amazon has closed its site to purchasing bots, which the session attributed to the value of owning the start of the purchasing journey, where premium advertising is sold. Asked to find a gift within a A$100 budget, a buying agent researches the options, offers 3 choices and completes the purchase from any merchant on Shopify or with an MCP interface (Figure 19). Buy-side agents are mature, sell-side agents are close behind, and commerce is expected to become agents dealing with agents.

Figure 19. Commerce between agents, as described in discussion.

Patching and hosting

In the week of the conference a PHP vulnerability that attacked hosting infrastructure directly, in a language used by about 70% of web infrastructure, led many operators to shut services down until a patch was released. An analysis by Goldman Sachs was cited showing vulnerabilities reported faster than organisations patch them. In the experience reported, no federal or state agency or major bank runs current software across its whole fleet. The

Essential Eight was described as a minimal baseline. On the 10-point severity scale, a 10 means an attacker can take full control of a server and move through the internal network, and the volume of critical vulnerabilities is rising.

The rest of the decade was expected to be turbulent. In the long run, AI-driven attack and defence were expected to produce sturdier infrastructure, particularly in open source, by clearing 50 years of accumulated defects.

Trusted Decision

Problem

An AI system gives an answer that does not account for the scenario or apply the right rules. Challenged, it agrees that it missed some rules and gives a new answer. Asked how it reached the answer, it points to source documents. Asked for the logic, it cannot provide it. An organisation using AI for operational decisions needs to know whether an answer is repeatable, follows its own rules, has missed none, rests on stated evidence and considers the responsible parties.

Many organisations run proofs of concept that reach 70% to 80% accuracy and stop, because the system cannot be put in front of staff for real decisions. Companies whose agents make substantial reasoning decisions are pausing deployment, and some are building evaluation suites that prove costly to maintain. The problem applies to decision- making, not to code generation.

Industry approaches

Model B

Model B, described as a trust compiler, applies knowledge-engineering techniques from the 1990s. It takes authoritative source evidence, extracts concepts, relationships and rules, checks and normalises them, and produces an executable model that any agent can run, with every decision traceable (Figure 20).

The layers are held in a single representation, so the model can be queried from any angle. Around them, Model B identifies the scenarios the model must handle and the reasoning behind each. The build reads requirements, legislation or policy, marks up each passage so that every element traces to its source, identifies constraints and the anomalies to watch for in use, and abstracts the result for deployment in different executable forms, including an ontology in OWL or RDF that any language model can use.

Figure 20. Model B compiles source documents into an executable model with a full decision trace. A language model alone reaches a decision without that trace.

Capital gains tax example

Table 1. The auditability comparison presented for boards, in summary. The rows marked "partial or none" were presented as a group.

Questions raised

Will better models Models are improving at reasoning but lack the structured make this methods of 1990s knowledge engineering. Those methods could

AI was prominent in the 1990s and declined from about 1999 because the tools were too expensive.

Application to legislation

The CGT changes were modelled about 6 weeks after the bills were published, and government subsequently identified scenarios it had not considered. Legislation could be tested against a model while it is drafted, and existing legislation back-tested for gaps. A company can compile a policy, have the expert who wrote it review the result, and give it to an agent.

The furthest projection was legislation implemented within 24 hours of passage through an agentic pipeline, with citizens consulting a single agent portal on questions such as whether to sell a property after a tax change. Codified rules would remove much of the review now performed by delegates exercising powers under legislation, which was also given as the reason government may not adopt the approach.

Demonstrated and projected

Figure 21. The dated projections made during the day. None had been demonstrated at the time of the conference.

Undated projections included unemployment rising from 4% to 12%, the gap between open and frontier models narrowing, and legislation implemented within 24 hours of passage. Several reported events, including the exploits and their losses, the claimed mathematical proofs and the cable breaks, were presented as accounts and are not independently verified in this report.