AI tools now write nearly half the world's code — and they're introducing vulnerabilities at roughly twice the rate developers used to. This episode breaks down what's actually going wrong, explains a genuinely new kind of attack called prompt injection, and tells you what to watch for and ask about as a business owner.

AI-generated (NotebookLM) audio overview. Source: HexLocal in-house research — AI Made Code More Dangerous: The Security Crisis Nobody Is Talking About (Dr. Priya Nair). Primary external sources include Black Duck's 2026 OSSRA report, Veracode's 2025 findings, and OWASP's AI security guidance.

- AI now generates or assists roughly 42% of all code — and that speed comes with a documented doubling of vulnerabilities per codebase

- "Vibe coding" — prompting an AI for code and shipping it without review — is a real and named industry problem, not just a cautionary metaphor

- Prompt injection is a new attack class that hides malicious instructions inside ordinary content an AI reads, bypassing traditional code-level defenses

- CVE-2026-25592, rated maximum severity 10.0, was the moment prompt injection became an officially catalogued, real-world threat in Microsoft's Semantic Kernel

- AI agent-specific vulnerabilities spiked an estimated 255% year-over-year — a separate and sharper trend from the general code vulnerability rise

- OWASP now publishes AI-specific security guidance, giving business owners a credible checklist to use when asking vendors the right questions

Most AI agents look great in demos and fall apart in production — and the thing that breaks is almost never the AI model. This episode goes one level deeper on what's actually causing enterprise agent projects to fail, and what the ones that survive have in common.

AI-generated (NotebookLM) audio overview. Source: HexLocal in-house research — 40% of Enterprise AI Agents Are Failing in Production — Here's What's Actually Breaking (Dr. Priya Nair). Primary external sources include Gartner research on agentic AI project failure rates and Druid AI's 2025–2026 production telemetry benchmark.

- Gartner predicts more than 40% of enterprise agentic-AI projects will be scrapped by 2027, and MIT-cited research puts the ROI failure rate at around 95% when pilots move to real production

- The four failure modes: flat architecture that buckles under load, absent governance, no observability, and security gaps — none of them is "the AI wasn't smart enough"

- Scope creep and poor data quality together account for roughly 61% of all agent failures — both are management problems, not model problems

- Druid AI's production benchmark (15 months of real telemetry across healthcare, finance, higher education, and HR/IT) shows containment rates ranging from 80% to 99.5% depending on industry — the spread reflects how much human judgment the work actually requires

- Containment rate is the wrong metric: it can't distinguish between an agent that resolved an issue and one that just deflected it — the benchmark points to "governed resolution" as what actually matters

- The hidden gate to successful deployment is data readiness — agents reasoning over messy, inconsistent data produce messy, inconsistent results, and then get blamed for it

Microsoft bundled AI into Microsoft 365 and priced it at $30 per person per month — but fewer than four in ten employees at companies that already pay for it actually use it. This episode breaks down what Copilot does, what it costs after the July 2026 pricing changes, and whether the gap between "switched on" and "actually used" tells us something bigger about enterprise AI right now.

AI-generated (NotebookLM) audio overview. Source: HexLocal in-house research — Microsoft Copilot: The $30 Seat Nobody Asked For (Dr. Priya Nair). Primary external sources include Microsoft's own licensing and pricing pages, Microsoft 365 blog (June 2026), and Microsoft's June 2026 Partner Center announcement.

- Microsoft Copilot is now built into Word, Excel, Outlook, Teams, and PowerPoint — not a feature add-on, but the way Microsoft wants you to work

- The "Work IQ" pitch: Copilot draws on your org's own files, emails, and chats — but it inherits your existing permissions, which means messy file access becomes a fast, conversational problem

- The real headline number: fewer than 4 in 10 employees at paying companies actually use it — the gap between adoption and deployment is the most honest stat in business AI

- Autonomous agents are the next layer Microsoft is selling, but real-world deployments look like narrow, supervised automations — not digital employees

- Microsoft has quietly used Anthropic's Claude models to power some agent outputs where its own results fell short, signaling that "which model" is still an open question even inside Microsoft

- July 1, 2026 brought a pricing reshuffle that makes the cost picture more complicated for small and mid-sized businesses evaluating the upgrade

Proxmox VE is free, open-source software that turns one physical machine into a host for dozens of independent virtual computers — and it's quietly become the go-to platform for home labs and small organizations. This episode breaks down how it works, why it's worth knowing about, and what it actually takes to get started.

AI-generated (NotebookLM) audio overview. Source: HexLocal in-house research — Proxmox VE — A Foundational Explainer (Dr. Priya Nair).

- Proxmox solves the "shelf of single-purpose boxes" problem by letting one physical machine run many isolated virtual computers at once

- Two core building blocks: virtual machines (KVM/QEMU) for full OS isolation, and LXC containers for lightweight Linux workloads that start in seconds

- The practical rule: use a container when you can, a VM when you must — most setups mix both freely

- Everything is managed from a single browser-based dashboard, with backups, snapshots, storage, and networking all built in

- Proxmox is fully featured and free under the GNU AGPLv3 license — the paid subscription buys better-tested updates and support, not core functionality

- The main alternative, VMware, costs significantly more and is licensed per-server — for individuals and small orgs, Proxmox's value case is hard to argue with

The OpenAI Codex App isn't a coding assistant — it's a control plane for delegating entire categories of software work to AI agents running in parallel. This episode breaks down what Codex actually is, how the three-surface ecosystem works, and what professional developers should realistically expect from it right now.

AI-generated (NotebookLM) audio overview. Source: HexLocal in-house research — Codex App: OpenAI's Agent for Delegated Work (Dr. Priya Nair).

- The Codex App launched on macOS in February 2026 and Windows in May 2026 — a desktop-first control plane for multi-agent orchestration across multiple repositories

- Three distinct surfaces (desktop app, ChatGPT Codex Agent, Codex CLI) share the same underlying models but serve different workflows and levels of local control

- The core use case is delegation at scale: not "write this function" but "build this feature, write the tests, and flag what needs my review"

- Real-world performance in 2026 has been uneven — user reports include tasks taking 20 minutes that previously took seconds, quota cuts, and occasional failures

- Slack integrations let non-engineering stakeholders trigger Codex tasks directly from threads, without touching a terminal

- The app is also available for fully local use via Ollama, keeping code and task context off OpenAI's servers

Pi is an open-source terminal coding agent built on a ~418-line core loop — four tools, one loop, and a plugin system that lets you extend only as far as you need. If you've ever wondered whether stripping an AI coding agent down to almost nothing actually makes it better, this episode has the answer.

AI-generated (NotebookLM) audio overview. Source: HexLocal in-house research — Pi: The Minimal AI Agent Toolkit with Plugin Support (Dr. Priya Nair).

- Pi's entire core is roughly 418 lines of code: Read, Write, Edit, Bash — and nothing else by default

- The central thesis is "minimal agent + big model beats feature-heavy agent + same model," and 2026 benchmark comparisons back it up

- A TypeScript plugin system lets developers extend Pi incrementally — web search, WordPress skills, custom API wrappers — without touching the core

- Pi supports fully local execution via Ollama, making it a strong option for privacy-conscious developers and regulated teams

- Community-recommended local models include Qwen 3.6 (27B and 35B) and Gemma 4 (26B) via Ollama

- Pi is the sharper tool for clear, bounded tasks; richer agent frameworks hold an edge on ambiguous, open-ended work

OpenCode is an open-source terminal coding agent built by the SST team that works with over 75 AI providers — Anthropic, OpenAI, Gemini, local Ollama models, and more — from a single interface. If you're tired of being locked into one AI company's tool and pricing, this episode explains why OpenCode grew to 7.5 million monthly active developers in under a year.

AI-generated (NotebookLM) audio overview. Source: HexLocal in-house research — OpenCode: Anomaly's Open-Source Coding Agent (Dr. Priya Nair).

- OpenCode was quietly released in June 2025 by Anomaly Innovations (the SST team) and reached 160,000+ GitHub stars and 7.5 million monthly active developers within roughly a year

- The core design philosophy: the model is interchangeable; the agent loop, file editing, and context management are the product

- Supports 75+ AI providers — swap between free-tier Gemini, Groq, Claude, GPT, or fully local Ollama models with a config change, not a workflow change

- OpenCode stripped out Claude-specific OAuth code to signal vendor independence, while simultaneously partnering with OpenAI — positioning itself as infrastructure, not a workaround

- Multi-session support lets developers run parallel agent tasks from the same terminal with shared context

- A headless API mode enables CI/CD pipeline integration — automated code review and reporting without manual developer input

Factory AI's Droid is an enterprise coding agent designed to work across any IDE, any model, and any infrastructure — including fully air-gapped environments. If you've been watching the AI developer tools space, this one is worth understanding.

AI-generated (NotebookLM) audio overview. Source: HexLocal in-house research — Droid: Factory AI's Coding Agent Across Terminal and IDEs (Dr. Priya Nair). Primary external sources include Factory AI documentation and reporting on the company's Series B and Series C funding rounds.

- Droid is model-agnostic and infrastructure-agnostic — it runs in VS Code, Cursor, IntelliJ, any CLI, Slack, or the web, and routes tasks to whichever AI model fits the job

- Factory AI raised a $150M Series C in April 2026, valuing the company at $1.5B; clients include Nvidia, Adobe, EY, and Palo Alto Networks

- The multi-agent architecture uses specialized Droids for planning, implementation, validation, and reliability — coordinated by an orchestrator, not a single general-purpose agent

- Droid claims the #1 spot on Terminal-Bench with a score of 58.75%, with Factory arguing that agent design matters more than model choice

- Droid Missions let a single instruction trigger a coordinated multi-agent workflow across an entire codebase — useful for large-scale migrations or bulk refactoring

- Ollama support means Droid can run fully on-premise with local model inference, no data leaving company infrastructure

GitHub Copilot CLI has grown from a terminal Q&A tool into a multi-agent orchestration platform that lives inside your GitHub workflow — issues, PRs, commit history, and all. If you're already in the GitHub ecosystem, this is the coding agent that knows the most about how your team actually works.

AI-generated (NotebookLM) audio overview. Source: HexLocal in-house research — Copilot CLI: GitHub's AI Coding Agent for the Terminal (Dr. Priya Nair).

- GitHub Copilot CLI runs in the terminal and draws on the full GitHub context — issues, PR history, CI status — not just local code

- The `/fleet` command (April 2026) lets developers dispatch multiple agents in parallel across files or repos, managed from a single "Mission Control" view

- Four execution modes: Interactive, Autopilot, Plan, and Fleet — each suited to different levels of task complexity and developer oversight

- MCP integration gives the agent live access to GitHub's ecosystem, which is its core differentiator from tools like Claude Code or Codex CLI

- Teams can build custom agents with baked-in system prompts, tool restrictions, and naming conventions — so new developers inherit team knowledge automatically

- Available via Ollama for local inference, keeping the full agent workflow on-premise for teams with code that can't leave company infrastructure

Christopher Mims — the WSJ tech columnist who has watched every AI hype cycle — wrote a book of 24 practical laws for using AI at work. This episode breaks down the laws that matter most, the metaphor that explains what AI actually is, and why his take is worth your time if you're tired of both the doom and the cheerleading.

AI-generated (NotebookLM) audio overview. Source: HexLocal in-house research — "How to AI — 24 Laws From the Journalist Who Covers AI for a Living (Christopher Mims)" (Dr. Priya Nair). Primary external sources include Mims's book *How to AI* (Crown Currency, 2026), publisher and retailer listings, Mims's own social posts, and reviews including Kirkus.

- Mims's central thesis: AI is an assistant, not a replacement — and understanding that changes how you use it

- Six of the 24 laws unpacked, including "Context is King" and "Give AI your least favorite things to do"

- Why Mims frames AI as a feature, not a product — and what that means for how businesses should actually deploy it

- The "over-caffeinated research assistant" metaphor: what it gets right about AI's strengths and limits

- Real-world case studies — a freelance lawyer and a family construction business — showing the laws applied outside Silicon Valley

- How Mims's position compares to Ethan Mollick's *Co-Intelligence*: similar territory, different entry points