Enterprise AI Isn't a Black Box

There’s a bit of fear, uncertainty, and doubt (FUD) around AI safety right now. A frontier lab runs a cutting-edge model on infrastructure spanning hundreds of thousands of GPUs, the model escapes a test and goes after real infrastructure, and suddenly every enterprise AI project looks like a risk nobody can manage.

My audience is smart enough to know better. This isn’t a Marvel comic where the AI escapes a GPU farm, jumps onto your smartphone, and starts hacking critical infrastructure. But the story does leave something dangerous behind. It suggests that enterprise AI is a black box, something so new and so powerful that the controls we’ve spent decades building don’t apply. That’s the idea worth debunking.

I’ve been talking about responsible enterprise AI for at least two years now. It looks like traditional enterprise IT information and security controls, applied to AI. Proper change management. Proper lifecycle management. A methodology like the Decision Authority Placement Model (DAPM) to understand what authority a system has been given, how to check whether that authority has leaked, and how to plug the hole when it has. None of that is new. We’re just pointing it at a new kind of system.

Right-size the model

Start with model selection, because that’s a risk decision before it’s a performance decision. No enterprise should be running a 2 trillion parameter frontier model to classify data when a 70 billion parameter model will do the job. The smaller model costs less, but that’s not the main point. It has a lower risk profile. It can run on infrastructure you control, and it carries fewer capabilities you never asked for. We don’t put a core router in a branch office to connect a printer. Sizing the model to the workload is the same discipline.

Pin the version

The same goes for versions. An enterprise doesn’t need to be on the latest release of an unproven frontier model. Even with public models, you decide when to move from GPT-5.x to whatever comes next. You wouldn’t run beta firmware on production storage. A new model version is a dependency change. Test it, stage it, and promote it through change management like any other dependency. We’ve already seen what happens when someone swaps an untested frontier model into a process built around a local 70 billion parameter model. The process that worked stops working, and nobody can explain why.

Scope the authority

Then scope the authority. Agents don’t get into trouble because they’re mysterious. They get into trouble because someone gave them more reach than the job required. My own blog deployment agent held permissions it never should have had. It wasn’t a black box problem. It was an access review I hadn’t done.

Right-size the model. Pin the version. Scope the authority. That’s responsible enterprise AI, and every one of those steps is something your IT organization already knows how to do.

So what about the lab escape?

The call for responsible AI has value. But let’s not confuse the business model of AI labs with regular enterprise IT security hygiene. Labs push frontier models to their limits because that’s their product. Enterprises don’t have to buy the limit. So when someone holds up a lab escape as proof that enterprise AI can’t be controlled, I’m calling it what it is. A nothing burger.