The conversation about AI in enterprise has shifted, quietly but clearly, from “will it work?” to “how do we operate this at scale?” That shift is visible in the kinds of problems practitioners are now presenting to each other — not capability demos, but production lessons: security incidents, code review bottlenecks, token economics, and the hard question of when to let an agent act without human oversight.
The talks from the enterprise and finance track at AI Engineer New York 2026 offer a useful cross-section of where that maturity actually stands.
The threshold that explains sudden adoption
One framing worth holding onto: AI capabilities do not feel useful until they cross a task-specific threshold. Below the threshold, the tool is impressive but inconvenient — not quite worth changing the workflow for. Above it, adoption becomes near-total, almost overnight.
The finance context makes this concrete. Work on Excel modelling, earnings research, and regulatory document analysis crossed that threshold in 2025 and 2026. At one firm, switching from near-zero Codex usage to ninety percent of finance, legal, and recruiting teams using it happened within four months — not because of a campaign, but because the model finally crossed the “good enough for this task” line.
This pattern is worth keeping in mind when trying to predict where AI will land next. The question is not “is the model improving?” — it generally is — but “which task-specific thresholds are about to be crossed?”
What production teams are actually building
At the applied research level, a few approaches are proving genuinely practical.
Specialist fine-tuning is one. Rather than routing every query to a large frontier model, teams are post-training smaller open-weight models on specific tasks — financial spreadsheet question-answering, for instance — and finding that accuracy matches or beats much larger models at a fraction of the cost and latency. The economics are compelling: unit token costs are falling, but fine-tuning lets teams stay ahead of cost curves on high-volume, specialised tasks.
Incremental autonomy is another pattern showing up across organisations. The structure that holds up in practice is a staged model: supervised in the first stage, where every action is reviewed; sampling in the second, where the agent handles a subset autonomously; exception-only in the third, where human attention is reserved for edge cases. Each stage advance is tied to a measured confidence threshold, not a calendar date. This is not glamorous, but it appears to be how teams actually earn trust with stakeholders and avoid costly mistakes.
Agentic workflows as policy DAGs — where the outer flow is deterministic (a directed acyclic graph, meaning a fixed sequence of steps with no cycles back) and only the inner loops are adaptive — is an approach that makes operational visibility tractable. When something goes wrong, there is a clear structure to inspect.
The security surface that comes with agents
The threat model for agents is genuinely different from traditional software, and this is where some of the most important thinking is happening.
Static roles and firewalls cannot detect a hijacked agent — one that has been subtly redirected by injected instructions and is now pursuing the wrong goal with full authorisation. Production incidents described at the conference are not theoretical: DNS exfiltration via hidden prompt injections (DNS exfiltration means leaking data by encoding it in domain name lookup requests, which most firewalls ignore), Morse-code instructions decoded inside a tool call that drained a token wallet, sleeper-agent instructions embedded in agent memory.
The defence-in-depth framework that holds up has three non-negotiable starting points: one agent gets one short-lived, scoped identity — never shared or long-lived keys; all outbound traffic is default-deny, including DNS; and a deterministic invocation broker requires human approval for high-value actions. Everything else builds on top of these three. A useful rule of thumb: an agent can safely have any two of these three — untrusted input, sensitive data, external action capability — but all three together requires a human in the loop.
The code review problem does not go away
One uncomfortable finding: agentic code generation is increasing code volume dramatically — one analysis cited roughly a twenty-four-hundred percent increase in lines generated — but release frequency is not keeping pace. The bottleneck has shifted from writing code to reviewing it.
The deeper problem is what might be called cognitive surrender: in studies, humans agree with AI assessments around ninety-three percent of the time when the AI is correct, and four out of five times when it is wrong. The reliability of LLM-based code review is also shaky — verdict changes of seven to thirty-four percent when findings are challenged suggest these evaluators are not stable enough to trust without structure around them.
The approach worth taking seriously is to enforce four properties — intent, guard rails, verification, evidence — as a loop rather than relying on a single AI pass to catch problems.
What this adds up to
The production phase of enterprise AI is not primarily a technology problem anymore. It is an operations, governance, and trust problem. The teams making progress are not necessarily the ones with the most capable models — they are the ones who have figured out how to stage autonomy, observe their systems clearly, and stay a step ahead of an adversarial surface that grows more interesting as their agents grow more capable. That is the work the next few years will actually require.
Text summarized and optimized using Anthropic’s models and reviewed by a human.