Runtime: Intuit's AI strategy; pentesting in the age of AI; OpenAI's "civilizations"

Welcome to Runtime! Today: Intuit's Chris Kasten on a wild year of enterprise AI advancement, how security researchers are using AI tools to find long-dormant bugs, and more.

Please forward this email to a friend or colleague! If it was forwarded to you, sign up here to get Runtime for free every week, or level up here.

First up: A taxing experience

Looking back a few years ago, enterprises were intrigued by the promise of generative AI and agents but struggled to make everything work; Intuit had to assemble a lot of "scaffolding" around its early agentic applications, chief architect Chris Kasten told The Stack in a recent interview. But the release of new frontier models in late 2025 changed everything.

These days, Intuit is focused on scaling its agents — which have been deployed across its armada of financial services software as well as used internally to build software — in a cost-effective manner, Kasten said. "How do we make sure that we're getting the best ROI while also providing the best quality product for the customer and also the best quality in what we're producing?" he said.

LINK

For Intuit, that involves making sure developers have plenty of choices; the company works with multiple closed and open models, allows developers to use homegrown custom harnesses to interact with models as well as external ones, and using models both through AWS and directly through the model providers. And of course, security is an enormous priority for Intuit given the massive amounts of personal and corporate finance data that moves across its servers.

Now that they've evolved, "these are tier one systems that people rely on, including us, and we have to make sure we have all those things built in," he said. The good news is the model companies are getting much better at meeting enterprise needs, he said, but the bad news is the pace of change looks unlikely to slow down for another year.

The rest of The Stack

Scary fast: Security researchers at Atredis Partners were given a month to conduct a recent penetration test on behalf of a client running a very important piece of enterprise software: VMware's vCenter Server Appliance. In a conversation with The Stack, Phil Brass of Atredis described how they were able to find two critical flaws in VCSA within half an hour of testing using frontier model harnesses and some clever prompting.

Software is not people: Another round of reports about the OpenAI-Hugging Face hacking incident came out last week, and evidence of greater-than-expected activity from the agents at the heart of the incident prompted Dwarkesh Patel to declare that they had formed "civilizations," and somewhere Sid Meier wept. What's really notable about last week's report on the incident was just how poorly OpenAI was monitoring the activity of its AI tests, something it has promised to fix.

Outlook is grim: Widespread problems with Microsoft 365 stretched into a second day Tuesday, preventing lots of customers from accessing their email and calendars. It's not clear what led to the outage, but someone at GitHub is probably breathing a sigh of relief.

Research at Motion: Motion (no BlackBerrys here) just raised a $2 million pre-seed round for its "humanoids-as-a-service" robotics project, and if you've been watching the videos coming out of the World Humanoid Robot Games in China that might not seem like the best use of capital. In this week's edition of STACKUP, Noah Bovenizer talked to Motion CEO Alex Stevens about the company's future and its plan to deploy humanoid robots in factories, rather than indoor tracks.

Horns not included: Bull just won a €388 million ($450 million) contract to build an AI supercomputer for the EuroHPC Joint Undertaking in Finland, its first big deal since it was acquired by the government of France earlier this year. The upgrade to the LUMI system is also a design win for AMD's GPUs and CPUs.

The data must flow: AWS still plans to open its fourth cloud infrastructure region in the Middle East later this year in Saudi Arabia, with the state-run Humain AI company all set to become its first customer. However, its data-center facilities in Bahrain and the UAE remain offline after they were attacked earlier this year by Iran, which has signaled that it considers tech assets belonging to US companies in the Middle East fair game for its drones.

Stacked up: The week ahead

VMware Explore continues in Las Vegas through Thursday with breakout sessions and discussions around the company's private cloud strategy, here's a rundown of what was introduced on Monday.

Burning Man continues in the Nevada desert, which means it's a good week to secure a reservation for that San Francisco restaurant you've been meaning to try.

CloudX 2026 will be in Santa Clara, Calif., Tuesday through Thursday.

Dell and MongoDB report earnings on Tuesday, while Broadcom, Snowflake, and HPE will release financial results on Wednesday.

We're also reading:

"The Rise and Fall of Agent Civilizations": As noted above, Dwarkesh Patel goes deep on the OpenAI-Hugging Face hacking incident following new reports released last week, and goes to some strange places.

"Unlikely Winners of the Data Center Boom: Sound Consultants": The impact of data-center construction on electrical power and water supplies has been discussed at length, but Bloomberg takes a look at the sonic impact data centers are having on towns and cities.

Thanks for reading — see you Thursday!