Uber gives 30,000 staff an AI agent, and the people who know the exceptions decide how much it can do

Until now, 1,000 Uber staff had it in a pilot. The rollout reaches operations, finance, marketing and product, and the agent finishes tasks with many steps across Gmail, Google Drive and Slack. It runs by default on GPT-6.1 Sol, about a fifth of the price of OpenAI's top model, and that price is what makes an agent for every employee affordable.

Uber's own two-week experiment showed where agents struggle: the hard part of automating a job is knowing the job. A written procedure leaves out the workarounds that keep work moving. An agent that has only the procedure behaves like staff in a work-to-rule protest, who do exactly what the rules say and nothing more, so the work stops at the first case the rules do not cover.

For example, a retailer's rule for supplier price increases says to check the contract and approve anything under 3%. The buyer knows more: two suppliers send new prices only as scanned PDFs, and fresh produce needs the category manager's agreement. None of that is in the procedure, but all of it is in last month's emails.

Going through the last 25 cases and writing down every step that the rule does not mention takes the buyer an afternoon, and that list becomes the agent's instructions. By giving the agent to everyone, Uber puts the people who know the exceptions in charge of writing those instructions. Their knowledge, more than the model, decides how much work the agent can take.

ConnectWise Cloud Backup copies companies' email and files from Microsoft 365. Each company approved the app once, and from then on it signs in with its own key, with no person and no login code involved. Attackers stole that key, and AI agents tried it on more than 2,250 companies.

ConnectWise then switched off its Cloud Backup service, leaving its customers without that backup. Every outside app approved in Microsoft 365 holds a key that someone else can lose. Ask IT for the list of those apps, and keep a backup that does not depend on the same vendor.

AI models are trained to help security firms, which companies pay to attack their own systems. Attackers tell the model what those firms tell it: this is an authorized test. The model sees only the request, and it cannot check whether the owner agreed.

One group ran Claude Code inside an open-source testing tool and broke into at least 15 Argentine healthcare organizations.

So a model's refusal to help with attacks protects nobody's network. The same kind of AI agent, run with permission by a clinic's IT provider, finds the weak spots before an attacker's agent does.

The extra code waited for approval, which took 49% longer, about ten and a half days per change.

On one team, a single senior engineer approved all changes, once a week. After AI-written code caused outages, the team required his approval for every AI change, and the queue grew.

When AI drafts an office team's purchase orders, the first mistake will bring the same demand for an extra signature, and it will land on the slowest step. Orders move faster when only those above a set amount go to the senior person and a colleague approves the rest.

An agent that signs in with a customer's password looks like the customer, so the bank cannot set limits for it or shut it out without locking out the customer. JPMorgan's finance chief warned that customers could carry the loss if such an agent makes an unwanted payment.

Banks fought the same fight in 2015 with money apps that logged in with customers' passwords. It ended with banks giving those apps their own limited access, and agents are moving the same way: some banks are allowing them read-only access.

A bookkeeper who gives an agent the company's bank login to download statements has given it the power to pay suppliers too. Hiding the password, as 1Password does, does not change that: the signed-in agent can still do anything the account allows. Change any bank password that an agent already holds.