72 Percent of Executives Say Companies Aren’t Really Transforming Work With AI. It Shows Why Increasing Productivity Isn’t Enough

Companies are using AI to help employees accomplish more. New research suggests the bigger opportunity is changing what organizations can accomplish together. Companies are investing billions in artificial intelligence to make employees more productive. Reports can be written faster, information can be analyzed in seconds, and routine administrative work can be automated. By conventional measures, those improvements represent progress. But new research from SAP SuccessFactors suggests that many organizations may be pursuing the wrong objective. They are becoming better at completing existing work without fundamentally reconsidering how that work creates value. The research published October 7 by SAP’s Future of Work Research Lab draws on global research involving 2,718 employees, 500 C-suite leaders, and 60 HR executives, among other sources. One finding is particularly revealing: 72 percent of C-suite leaders believe that most organizations claiming to transform work with AI are actually automating existing jobs faster. That distinction exposes a problem. An organization can become more productive without becoming more effective. Productivity and performance are different things Productivity measures the relationship between inputs and outputs. How many reports can an analyst produce? How many customer inquiries can an employee resolve? How many hours can a company eliminate from an administrative process? These are useful measures, but they reveal only part of organizational performance. Consider a company that uses AI to double the number of market analyses its employees produce. The productivity improvement is measurable. But if those analyses continue moving through the same approval processes, reaching the same decision makers, and informing the same strategic assumptions, the organization may not become any better at responding to its market. More information does not necessarily produce better decisions. Faster work does not automatically produce greater adaptability. Research from McKinsey reinforces this distinction. Its global study of how organizations are capturing value from AI found that, among 25 organizational practices examined, redesigning workflows had the greatest effect on whether companies reported an earnings impact from generative AI. In other words, the value of technology depends partly on what organizations change around it. SAP’s research points toward a different operating model The SAP researchers identified six shifts that could make work more valuable and engaging. They include moving from static jobs to dynamic roles, from centralized authority to decentralized decisions, and from measuring output to measuring impact. In an experimental study conducted by SAP SuccessFactors researchers, employees reported 77 percent greater perceived autonomy under decentralized decision-making, while dynamic roles were perceived as 49 percent more challenging than static jobs. These findings concern employees’ perceptions of work design, not demonstrated improvements in business performance. Nevertheless, they suggest that changing how work is organized could improve the conditions under which people contribute. When employees have greater authority to make decisions, they can respond to problems without waiting for unnecessary approval. When roles become more flexible, expertise can move across organizational boundaries. When performance is evaluated by impact rather than activity, employees have stronger reasons to concentrate on outcomes that matter. These changes do not simply make existing work faster. They change how an organization functions. AI can increase output without increasing capacity Greater productivity can also create unexpected demands on employees. Researchers Aruna Ranganathan and Xingqi Maggie Ye examined how generative AI changed work habits during an eight-month study at a technology company. In their research published in Harvard Business Review, they found that employees worked faster, assumed additional responsibilities, and extended work into more hours of the day, often voluntarily. AI made more work possible, but that did not necessarily make work more sustainable. The distinction matters because every additional output can create new demands for coordination, review, and decision-making. A company generating twice as many analyses may also create twice as many recommendations for someone to evaluate. SAP’s research identified a related problem. Although 88 percent of employees reported changes to their jobs because of AI, half of those changes occurred without meaningful guidance from managers or their organizations. Employees are adapting to new capabilities while the systems around them remain largely unchanged. Technology increases what individuals can accomplish, but organizational friction can prevent that capability from producing greater value. Measure what the organization can accomplish together Leaders should begin by asking three questions that traditional productivity measures often overlook: Are decisions improving? Does relevant expertise reach decision makers sooner, and can teams respond more effectively to emerging problems? Is coordination improving? Can employees combine their knowledge, share responsibility, and work across functions without unnecessary barriers? Is the organization becoming more adaptable? When customers, technologies, or competitive conditions change, can people reorganize their efforts and respond effectively? These measures are harder to capture than hours saved or tasks completed. They are also closer to what determines sustained organizational performance. The larger opportunity presented by AI is not simply to accelerate individual work. It is to improve the relationships, responsibilities, and decision processes through which people create value together. Making everyone more productive may improve today’s numbers. Making the organization more capable can change tomorrow’s possibilities. EXPERT OPINION BY SCOTT HUTCHESON, AUTHOR, BIOHACKING LEADERSHIP

Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet

Governments and companies around the world are racing to fix vulnerabilities revealed by artificial intelligence that could affect 70% of the world’s websites. Some websites and services briefly went dark after the set of vulnerabilities were announced Wednesday. The US National Security Agency and Europe’s cybersecurity agency advised companies to take immediate action to address two critical flaws in PHP, a programming language that powers 70% of the world’s websites. The flaws in PHP were uncovered and addressed by teams at OpenAI, Google-owned cybersecurity company Wiz, and another cybersecurity company, Calif. The underlying flaws had existed for a decade, but exploiting them involved a complex set of steps “at the edge of what human researchers could practically achieve,” according to Wiz. Researchers then deployed AI to adapt techniques for taking advantage of those vulnerabilities – known as as “exploits” in cybersecurity – and analyze the results. The bugs, collectively called PHP2Shell, could allow attackers to break into websites and read memory that could contain sensitive information, like passwords. The PHP Foundation, the organization behind the coding language, has released a patch for the bugs, which have been hidden in their software for years, and is urging website operators to update their systems immediately. The CEO of Cloudflare said on X that his company’s network has observed millions of attempts to exploit the vulnerabilities in the past couple of days. “With PHP behind such a vast share of the web, the exposure could reach almost everywhere people spend money online,” said Nigel Green, the CEO of deVere Group, a financial advisory firm. “Booking platforms, marketplaces, subscription services, ticketing sites, delivery apps and utility portals could all be holding card details on systems built with the same kind of code,” he added. ‘AI inflection point’ The vulnerabilities involve an issue with how the PHP language works with a computer’s memory. When a website request unexpectedly ends, PHP could leave data behind in the memory that can be accessed and potentially corrupted or exposed later. The flaws could allow attackers to remotely execute code, disrupt services and expose customer data, according to web infrastructure provider Cloudflare, which has been working with the PHP Foundation, Calif, OpenAI and Wiz to address the issue. “Think of a hotel room where you check out, but your key still works,” Patrick Fussell, global head of adversary simulation at IBM, told CNN. “And so you can just go back into that hotel room later, and now somebody else’s stuff is there.” The bugs were discovered in late August but were disclosed to the public only on Wednesday, after PHP had come up with a fix. AI played a crucial role in identifying and fixing vulnerabilities “that had remained hidden in the PHP codebase for more than a decade,” according to Wiz. The company called PHP the “backbone of the web” and said the episode marks an AI inflection point. “What AI changed was the ability to understand the weaknesses,” Wiz researchers wrote in a blog post Wednesday, and then quickly exploit those weaknesses into a way to attack. “With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” they added. Researchers at Wiz used Google’s Gemini 4 Argon, Wiz Atlas and OpenAI’s GPT-5.6 Sol during the research process. World leaders weigh in Global leaders urged organizations to take action. Dutch Prime Minister Rob Jetten said that his cabinet was “closely monitoring the situation surrounding the vulnerabilities in PHP.” Japan’s Prime Minister Sanae Takaichi said companies should consider suspending services if necessary in order to reduce their exposure. “Please check if your publicly available websites use PHP, and prepare to apply the fix patch that will be released tonight… as soon as possible,” she posted on X Wednesday. Japanese airline ANA, railway operator JR West and the country’s largest bank, MUFG, were among companies that reported some webpages and services temporarily suspended. In Europe, government websites in France, Denmark, Finland and the Netherlands, including the Dutch cyber security agency, were temporarily taken offline while security fixes were implemented. The Wikimedia Foundation, the non-profit that operates Wikipedia, told CNN Thursday that it was “in the process of addressing security vulnerabilities in PHP,” and that a number of its systems had been taken down as a “precautionary measure.” Nearly three dozen UK government services are unavailable and four are “partially unavailable” while security upgrades take place, UK government minister Elizabeth Lloyd told the House of Lords Thursday. The Journal, Ireland’s second most-popular news outlet, was temporarily offline Thursday morning while it bolstered its “defences,” it said in a notice. A shift in cybersecurity Wiz researchers say the issue is on par with the Heartbleed bug from 2014, which impacted an encryption technology estimated to be used by some two-thirds of the Web. Heartbleed allowed cybercriminals to access data that should have been protected. Like Heartbleed, the researchers at Wiz say PHP2Shell could similarly serve as a turning point in cybersecurity. While the vulnerabilities existed for years, AI made it practical to deploy them. “The speed with which vulnerabilities are being discovered is well beyond what it ever was before,” said Fussell. Even though a patch has been released, it’s likely that not all companies and organizations will update their systems at the same time, according to Gang Wang, associate professor of computer science at the University of Illinois. That could give bad actors a window to exploit it now that the vulnerability has been made public – and they can now do so faster using AI. But taking advantage of the vulnerability is no easy task, even with the help of AI, according to Fussell. “This is being touted as like, ‘Hey, you can push a button and basically take over a server type of thing,’” he said. “…To actually pull this off requires a couple of conditions that are actually fairly complex and not always going to work out in favor of somebody who’s trying to go and exploit this bug.” By Lisa Eadicicco, Hanna Ziady

AI Agents Are Breaking the Internet. 5 Things You Should Do Right Now to Protect Yourself

A thing we’re learning more and more is that much of the internet runs on technology that’s been around for decades. Sure, the websites and apps we use every day look very different from what they did 20 years ago, but a lot of the underlying infrastructure hasn’t actually changed that much at all. And, as it turns out, a lot of that infrastructure is more fragile than you might think. Last week was a pretty good reminder. First, researchers disclosed two critical vulnerabilities in PHP, the programming language that powers roughly 70 percent of websites. According to experts, the flaws could allow attackers to take complete control of vulnerable servers without even needing a password. AI played an important role in identifying and validating the vulnerabilities. That’s great, but the same technology that finds bugs can also be used by people trying to exploit them faster than companies can fix them. Then, security researchers disclosed that they had discovered compromised encryption keys belonging to an Indian company responsible for issuing TLS certificates. Those certificates help browsers know that the sites they connect to are actually what they say they are. So, when you visit the URL for your bank, you’re actually giving your login and password to your bank, not some phishing scam. The problem is, the encryption keys were based on a single digit, not a 256-bit key. Anyone with those keys could impersonate almost any website, at least until browsers stopped trusting the affected certificates. To be clear, there’s not much you can do personally about vulnerabilities in PHP or compromised security certificates. There are, however, a handful of relatively simple things everyone should do right now to protect their information. 1. Use a password manager Everyone hates remembering passwords, which is why far too many people use the same simple password for all kinds of websites. That’s a huge problem, and using a password manager that can safely store unique passwords is probably the single most important thing you can do to protect your information online. A password manager creates a unique, hard-to-remember password for every account and then remembers it so you don’t have to. That means if one website gets hacked, criminals can’t simply use that same password to access your email, bank, or other accounts. Apple’s Passwords app and Google’s Password Manager are built into their respective platforms. There are also excellent options like 1Password that make it easy to share access to login credentials across families or teams. Even better, use passkeys whenever they’re available. I realize a lot of people resist passkeys because they don’t understand, but they’re far easier to use than passwords and virtually impossible to steal through phishing. 2. Turn on two-factor authentication Even strong passwords aren’t entirely secure. If someone does get your password, they have access to your account unless you turn on two-factor authentication (2FA). You’re probably most familiar with entering six-digit codes via text message after you log into a website. That’s 2FA. The whole point is that your password isn’t enough—you have to have access to a second factor to gain access to the account or website. You can also use an authenticator app, but receiving a code by text message is better than having no protection at all. At a minimum, you should definitely enable it for your email and Apple Account. Your email is the way someone could reset passwords for everything else, and your Apple (or Google) Account has pretty much all your personal information and photos. 3. Pay attention to which apps have access to your information As AI agents become more common, a lot of people are connecting them to their Gmail, cloud storage, and other sources of data. That’s super useful, but you’ve basically given your AI tool permission to access information you probably would prefer be kept private. Depending on the permissions you enable, your AI agent might even be able to modify files, send messages, or take other actions on your behalf. That’s incredibly useful, but it also means that there is a risk. It’s worth taking a few minutes to check all of the applications connected to your most important accounts. Turn off anything you don’t recognize or don’t use anymore. And don’t give an AI agent permission to do something it doesn’t actually need to do. 4. Turn on automatic updates I get it, software updates are annoying. I don’t know anyone who enjoys updating their computer or iPhone, especially since it seems that the only time either wants to update its software is when I sit down to do something important. Still, making sure you are up-to-date is one of the easiest ways to protect yourself. Security issues are constantly being discovered, and software updates are how companies fix vulnerabilities. In fact, the PHP flaws disclosed last week are a perfect example of why keeping software updated matters. Make sure your phone, computer, and browser install security updates automatically. It might be the simplest thing that can protect you without requiring you to think about it again. 5. Be skeptical of anything asking for your information AI has pretty much removed all friction when it comes to creating convincing emails, text messages, and even phone calls that appear to come from someone you know and trust. Partly that’s because its good at looking at real human writing and producing reasonable messages that sound like they’re actually coming from another person. As a general rule, you should never click on unexpected links asking you to sign in or provide financial information. If you do get an email that you think is real, open the company’s app or website directly. And if you’re using an AI agent, require your approval before it sends messages, makes purchases, or changes important information. Obviously, none of these things are going to make you completely immune to sophisticated attacks. That’s especially true when many of the most critical issues are in software and systems you don’t have any control over. But these five steps are things you can control, and that’s the point. As AI agents become more capable, the internet is going to become an increasingly complicated place to keep information secure. There’s not a lot you can do about that, but the good news is that there are little things you can do that go a long way toward keeping your information safe. EXPERT OPINION BY JASON ATEN, TECH COLUMNIST @JASONATEN

Want AI to Make You Smarter, Not Dumber? Research Says Make This Simple Change

If you’re inclined to worry that leaning on AI might be making us dumber, there are plenty of studies indicating you’re right to be concerned. Researchers have found handing off thinking and ideating to AI can lead to “cognitive atrophy” or “cognitive surrender.” Translation: You forget how to do core skills and end up dumber. On the other hand, just about every business thinker under the sun is also issuing urgent warnings to learn to use AI to become more productive or your career is toast. So how do you square these two seemingly irreconcilable truths? Is there a way to use AI not just for basic admin but also for the thinking and judging parts of your job and end up smarter rather than with brain rot? Yup, suggests at least one AI researcher who has studied these questions extensively. All you need to do, according to UMass Amherst’s Monideepa Tarafdar, is make one important flip in how you use these tools. Ask AI to make your job harder, not easier The first instinct of most people, when presented with a shiny new AI tool, is to ask it how to do their work better and faster. Generate some ideas for me to evaluate, you might say, or suggest resources that would help me think through this problem. Slap together this presentation or poster. The aim is to use these tools to make our jobs easier. But recent research from Tarafdar and her colleagues suggests that, if you want Claude, Gemini, and the like to end up boosting rather than sapping your intelligence, you should aim for the exact opposite. Rather than try to get the bots to make your job easier, you should ask them to make it (temporarily) harder. Good friction leads to stronger work “We found that when knowledge workers intentionally use AI to challenge their ideas—to generate friction—they can significantly improve their performance,” Tarafdar recently wrote on Greater Good, summing up her team’s findings. What does that look like in practice? One marketing professional in the researchers studied asked AI to create virtual customer personas who would dislike her product. The exercise revealed preferences and problems no one had considered before. An attorney asked a chatbot to search for obscure legal loopholes. “That exposed surprising but realistic scenarios of hard-to-detect unethical behavior in employees,” Tarafdar reports. Another operations professional asked AI to suggest technologies from other fields that might apply to his own work. The suggestions were unfamiliar, requiring research and critical judgment to evaluate, but they also ended up being highly useful. In all these instances, rather than smoothing the path for these professionals, AI threw up difficulties, roadblocks, challenged assumptions, and suggested possibilities they hadn’t previously considered. Did that make more work for them? In the short term, yes. But it also made the end product of their work stronger and better. The role of leaders Using AI as a sparring partner doesn’t come naturally to many people. Most of us, in general, try to make our lives easier, not harder. But when AI is used to offload difficulty, the result is often not just weaker work, but a weaker brain. That’s why leaders need to actively encourage employees to use these new tools to introduce rather than eliminate friction. Nearly every organization is encouraging their people to experiment with AI these days. Adapting these nudges to specifically suggest employees ask the bots to challenge their thinking, poke holes in the ideas, or seek out perspectives they may have overlooked is a relatively simple tweak that can pay big dividends. “An important detail is pointing out that adding friction can appear to make an AI system work against you, but—as new research shows—it actually helps it work for you,” Tarafdar stresses. AI-induced brain rot is a real fear. But it is not inevitable. The right approach, one that views AI as a tough coach rather than a sycophantic intern, can actually end up making you smarter. But you need to prompt yourself and your people to actually use it that way. EXPERT OPINION BY JESSICA STILLMAN