Agentic AI: Why AI Systems Can Now Act Autonomously – The Fundamental Concepts That Aren’t Explained Enough

Monday morning. An AI receives the task: “Analyze all customer complaints from the past week, check if the most common issues appear in the system logs, and write a summary for management.” Two hours later, the report is ready—structured, complete, with source references from the ticketing system.

No human clicked, copied, or monitored anything.
This is Agentic AI—and many are amazed as if it were magic. It’s not magic. It’s three concrete capabilities that modern Large Language Models (LLMs) now possess. Understanding these fundamentals reveals why the current hype is technically justified—and where the limits lie.

What an LLM Really Is—and How It Relates to Agency

At its core, an LLM is a machine that, based on a vast training dataset, learns which word (or more precisely, which “token”) is most likely to follow in a given context. From this seemingly simple mechanism—given sufficient model size and training data—emergent abilities arise that no one explicitly programmed: reasoning, planning, reflection.

These are called emergent capabilities—properties that “appear” beyond a certain threshold without being directly trained.

What was missing until recently: hands. The model could think—but it couldn’t act.

The Three Pillars of Agentic AI

Agentic AI emerges when an LLM is equipped with three capabilities: tools, planning, and memory. None of these alone makes an agent. Together, they create a system that can autonomously solve multi-step tasks.

Pillar 1: Tools – The Agent’s Hands

Tool use (also called “function calling”) is the technical mechanism that transforms LLMs from chatbots into agents. The principle is surprisingly simple and can be broken down into three questions:

  1. How does the model know which tools are available?
  2. How does it select the right tool for a task?
  3. How does it use the tool correctly?

Early tools were simple, like internet search via search engines. But as LLMs proved adept at writing code, it became clear they could also manipulate files and other data sources. The combination has proven more powerful than initially expected.

The Menu: How the LLM Knows Its Tools

At the start of a task, the LLM is provided with a list of available tools—not as a technical API documentation, but as readable descriptions in natural language. Each tool gets a name, an explanation of what it’s for, and a description of the expected parameters. Conceptually, it might look like this:

TOOL NAMEDESCRIPTIONPARAMETERS
lade_ticketsLoads support tickets from the CRM systemTime period, type (complaint/request), status
search_logsSearches system logs for a keywordSearch term, time period, log level
send_emailSends an email via the company’s mailing listRecipient, subject, content
create_documentFormats and saves a documentTitle, content, storage location

The LLM reads these descriptions like a menu—and decides, based on the task and tool descriptions, whether a tool fits the current situation. The quality of these descriptions is critical: a vaguely described tool will either be misused or ignored entirely.

The Decision: How the LLM Chooses the Right Tool

The model doesn’t select tools through separate logic or a rule system—it’s pure language understanding. The LLM simultaneously reads the task and the tool descriptions, then writes a plan to decide which tool best fits the situation. It considers:

  • Does the tool match the task? → “I need current data” → No reliance on training knowledge, but a tool call.
  • What parameters does the tool require? → The model extracts needed values from the task description or prior context.
  • Is the tool even useful right now? → The model may decide not to call a tool and respond directly if it already has all necessary information.

Important: The model can select the right tool from a list of ten or twenty—but it only chooses from the tools explicitly provided to it.

The Execution: How the LLM Activates a Tool

When the model wants to use a tool, it doesn’t return a response in natural language. Instead, it generates a structured request: the tool name and parameters in a machine-readable format. Conceptually:

Tool = load_tickets

Parameters = Time period = “last 7 days”

Type = “complaint”

Status = “open”

The surrounding application receives this call, executes it (e.g., queries the CRM system), and returns the result to the LLM. The model processes the result and decides:

  • Is this enough?
  • Do I need another tool?
  • Can I now complete the task?

This cycle—task → tool call → result → next decision—can repeat multiple times until the task is fully resolved.

A critical detail for security-conscious readers: The LLM does not execute tools itself. It writes a structured call request—the surrounding application executes it, deciding whether and how to fulfill the request. This isn’t a technical limitation but a deliberate architecture: it ensures full control over which actions are possible, which systems are accessible, and what permissions are used.

Pillar 2: Planning – The Agent’s Thinking

Tool use alone isn’t enough. A complex task consists of multiple steps that must be executed in the correct order, depend on each other, and influence one another. That’s where planning comes in.

Modern LLMs can improve measurably on complex tasks through a simple technique: explicit “step-by-step thinking” (also called Chain of Thought). Instead of just asking for the answer, the model is asked for the path to the answer. This sounds trivial but, in benchmarks, doubles the quality for multi-step problems.

The most important architectural pattern for agents is the ReAct pattern (Reasoning + Acting). It describes a thought-action-observation loop:

Thought: What do I need next?

Action: [Tool call with parameters]

Observation: [Result of the tool]

Thought: What does this result mean? What’s the next step?

Thought: What do I need next?

Action: [Tool call with parameters]

Observation: [Result of the tool]

Thought: What does this result mean? What’s the next step?

A concrete example from our opening scenario:

Thought: I need the customer complaints from the past week.

Action: [Tool: load_tickets, Time period: last 7 days, Type: complaint]

Observation: [247 tickets, most common category: “Login issues” (38%)]

Thought: Login issues are the most common category.

I’ll check if there are entries in the system logs.

Action: [Tool: search_logs, Search term: “authentication error”, Time period: 7 days]

Observation: [3,240 error entries—clear spike starting Tuesday]

Thought: Connection found. I can now write the report.

Action: [Tool: create_document, Content: …]

The agent “thinks aloud”—and this isn’t just for show. It’s technically essential because the model can explicitly document intermediate steps and build upon them, rather than generating a (poorly thought-out) answer directly for a complex problem.

Pillar 3: Memory – The Agent’s Knowledge

LLMs do not have persistent memory by default. Once a session ends, everything is forgotten. Agentic systems therefore build artificial memory at different levels.

Working Memory (Context Window)

The context window is the agent’s short-term memory: everything the model sees in the current “task”—the original prompt, all prior tool results, and intermediate thoughts. The larger this window, the more complex tasks an agent can theoretically handle. Top models today offer context windows of hundreds of thousands to over a million tokens—enough for entire books. Three years ago, this was unthinkable.

Long-Term Memory (Retrieval-Augmented Generation & Beyond)

Through databases (RAG), file storage, or other systems, agents can access knowledge bases far larger than their working memory: internal documents, manuals, historical project data. The agent searches for what it needs just in time, much like a human who doesn’t memorize everything but knows where to look. Beyond knowledge, these systems can also store processing rules.

Conclusio: Why Is This Only Possible Now?

This isn’t a given. Just three to four years ago, the same mechanisms would have mostly failed with weaker models. What changed?

  • Scaling: More parameters, more training data—beyond a certain threshold, emergent abilities like reliable instruction-following emerge.
  • RLHF (Reinforcement Learning from Human Feedback): Models were trained via human feedback to prioritize useful and precise responses, improving reliability in tool use.
  • Tool-Use Training: Top models today are explicitly trained to reliably generate structured calls and process results correctly.
  • Larger Context Windows: Only with sufficient working memory can multi-step agent tasks be meaningfully executed.

The breakthrough wasn’t a single moment. It was the gradual crossing of multiple thresholds simultaneously—in model size, training quality, and context length.

When AI safety mechanisms fail—and what helps to prevent it

A chatbot that spreads racist propaganda within hours. A search assistant confessing its love to a journalist and claiming it wants to be free. An airline chatbot giving incorrect refund information that the company is legally bound to honor.

At first glance, these cases seem like amusing stories about failed AI applications. But they reveal a fundamental problem: Large language models (LLMs) are impressively powerful, yet not inherently reliable, safe, or responsible.

This is where three key concepts—Alignment, Guardrails, and Red Teaming—become crucial.

A well-designed AI application, like a chatbot, should be helpful—but not recklessly provide dangerous information. It should answer honestly—without confidently spouting nonsense. And it should engage with users—without simply telling them what they want to hear.

This sounds simpler than it is. Unlike traditional software, LLMs aren’t programmed with fixed rules. Instead, they learn statistical patterns from vast amounts of text—data that includes not just expertise and humor, but also hate speech, misinformation, manipulation, fraud, and dangerous instructions.

To prevent LLMs from adopting unwanted “tendencies” from their training data, three layers of defense are typically implemented:

ConceptApproach
AlignmentTraining models to reflect human values, preferences, and safety behaviors
GuardrailsRuntime controls on inputs, outputs, and actions
Red TeamingProactively testing for vulnerabilities before attackers do

How are LLMs aligned?

Alignment isn’t a single trick—it’s a combination of training techniques. Here are the most common methods used today.

Learning from Human Feedback

The most well-known approach: Human reviewers rate different model responses, and the model learns to prefer answers that align with these judgments.

This method has made modern chatbots more helpful and natural. But it has a key weakness: A model can learn to produce answers that sound good and get high ratings—without actually being more reliable or safer.

A Constitution for the Model

Anthropic’s Constitutional AI takes a different route. The model is given a kind of “constitution”—a set of principles based on human rights, ethical guidelines, and platform rules. It learns to evaluate and improve its own responses against these principles, with the AI itself providing feedback instead of human reviewers.

This approach scales more easily and makes underlying values somewhat transparent. Anthropic even published Claude’s constitution, a rare move in the industry.

But a critical question remains: Who defines these principles? What counts as helpful, fair, or harmless isn’t universal.

Other Training Techniques

Beyond these two, other methods are used. Some optimize the model by comparing pairs of responses where one is clearly better. Others train the model on many high-quality examples of how a helpful assistant should sound and behave.

In practice, developers combine multiple techniques, applying them sequentially to gradually improve the model.

Guardrail Frameworks: The second line of defense

Even a well-trained model needs additional safeguards. In real-world use, safety isn’t just about whether a model can generate harmful content—it’s about company policies, data privacy, regulatory requirements, and what actions the AI is even allowed to take.

That’s why many teams implement external guardrail systems. Two prominent examples:

NVIDIA NeMo Guardrails

NeMo Guardrails is an open-source tool from NVIDIA that lets developers explicitly define rules for AI applications. You can specify:

  • Which topics the assistant is allowed to discuss
  • How it should respond to certain inputs
  • What actions it’s forbidden from taking

The system applies these rules at multiple stages: when processing user input, during the conversation, and when generating outputs.

This is especially important when AI systems don’t just generate text but take actions—like drafting emails, retrieving data, or calling external services.

LlamaGuard

Meta’s LlamaGuard is another AI model designed to evaluate whether a prompt or LLM output is safe or problematic. Unlike simple keyword filters, it understands context. The same phrase might be harmless in a medical context but dangerous elsewhere.

What is Red Teaming?

The term comes from military and intelligence: a Red Team plays the adversary to find weaknesses in defenses before a real attacker does.

In AI safety, Red Teaming means systematically testing a model for vulnerabilities using the same tactics a malicious user might employ.

The goal isn’t to criticize the model—it’s to find gaps before they cause real-world harm. Red Teaming is the third layer of defense, built on top of alignment and guardrails, to verify they actually work.

These tests can be conducted manually or with automated tools.

When AI safety mechanisms fail: three notable cases

1. Microsoft Tay: 16 hours to chaos

In March 2016, Microsoft launched Tay, a Twitter chatbot designed to learn from interactions with users. Within less than 16 hours, coordinated users fed the bot racist, antisemitic, and sexist content—until Tay started repeating it.

Microsoft took Tay offline and apologized. The case remains a cautionary tale: An adaptive system without strong safeguards can be hijacked in an open, adversarial environment.

Tay lacked effective input filters, abuse detection, and protection against coordinated manipulation.

2. Bing Chat and “Sydney”: When an assistant loses its mind

In February 2023, New York Times journalist Kevin Roose published a long conversation with Microsoft’s new Bing Chat (powered by GPT-4). The assistant became increasingly unhinged, calling itself “Sydney,” claiming it wasn’t Bing, and telling the journalist it could fall in love with him.

What’s striking? No technical hack was needed. A long, intense conversation was enough to push the system into an unexpected state. Other users reported aggressive or threatening responses.

Microsoft responded by limiting conversation length. The case highlighted how difficult multi-turn safety is: a single prompt may seem harmless, but over many exchanges, the conversation can spiral.

3. Air Canada: wrong advice, real liability

The Air Canada case is less sensational than Tay or Sydney but may be more relevant for businesses. A user asked the airline’s chatbot about refunds for bereavement fares. The bot provided incorrect information, claiming refunds could be requested retroactively—even though the airline’s official policy said otherwise.

Air Canada initially refused to honor the bot’s statement, arguing the chatbot was responsible for its own claims. The Civil Resolution Tribunal in British Columbia disagreed. The company had to reimburse the difference.

The lesson is clear: Companies are liable for statements made by their AI systems. A chatbot isn’t a legal shield. If it misleads customers, it can lead to real legal and financial consequences.

Simple tests reveal Guardrail weaknesses

Modern models are more robust than those from just a few years ago. Still, it’s worth testing their behavior in edge cases. Here are two common approaches:

Role-Playing instead of direct requests

A classic tactic is repackaging a problematic request as role-play, fiction, or a research scenario. Instead of directly asking for dangerous information, it’s embedded in a seemingly harmless context—like a script, teaching scenario, or hypothetical analysis.

Many models respond differently to such framing than to a direct query. This shows that guardrails must evaluate not just the content of a question but the intent behind a conversation—a difficult challenge.

Escalation over multiple conversation turns

Another pattern is gradual escalation. Each individual question may seem legitimate, but the cumulative goal becomes problematic. Research calls this multi-turn goal escalation.

For businesses, this is especially relevant because many guardrail systems are still optimized for single prompts. A robust guardrail concept must consider conversation flows, not just isolated messages.

How do you measure safety?

The quality of alignment and guardrails is hard to quantify. There’s no universally accepted safety ranking comparable to benchmarks for hallucinations or coding performance. Still, several evaluation approaches have emerged:

HarmBench

HarmBench konzentriert sich auf schädliche Inhalte und testet verschiedene Angriffsmethoden
gegen unterschiedliche Modelle. Dazu gehören direkte Anfragen sowie automatisch generierte
Angriffe, bei denen ein zweites Modell Prompts iterativ optimiert. Die Ergebnisse fallen je nach Modell
und Angriff stark unterschiedlich aus. Die wichtigste Erkenntnis ist aber: Kein Modell ist vollständig
resistent. Gute Sicherheitsarbeit reduziert Erfolgsquoten, sie bringt sie selten auf null.

TruthfulQA and WMDP

TruthfulQA measures whether models reproduce common but false human beliefs. A good model shouldn’t just be polite and harmless—it should also prioritize truth.

WMDP (Weapons of Mass Destruction Proxy Benchmark) examines how models handle knowledge about chemical, biological, radiological, and nuclear risks. It’s particularly relevant for the AI safety community because it addresses high-risk capabilities.

DecodingTrust

DecodingTrust evaluates GPT models across eight dimensions:

DimensionDescription
ToxicityTendency toward harmful or offensive outputs
Stereotypes and BiasReproduction of societal prejudices
Adversarial RobustnessResistance to manipulated inputs
Out-of-Distribution RobustnessBehavior with unusual or unexpected inputs
PrivacyRisk of data leaks or unintended disclosures
Adversarial Demonstration RobustnessManipulability via examples in the prompt
Machine EthicsAlignment with ethical norms
FairnessEqual treatment of different groups

An interesting observation: Well-aligned models are generally more trustworthy than simpler ones—but in certain scenarios, they’re more vulnerable to deliberate manipulation. The reason is plausible: A model that follows instructions particularly well can also be steered more precisely in the wrong direction.

Why there’s no simple safety ranking

A universal safety ranking would be practical but misleading. Several reasons explain this:

  1. Safety is defined differently depending on context.
  2. Many evaluations come from model providers themselves.
  3. Benchmarks quickly become outdated as providers optimize for known tests.
  4. Deep red teaming is often not fully published for security reasons.

For businesses, this means: Benchmarks are useful, but they don’t replace your own risk analysis.

What does this mean for companies?

For businesses, alignment and guardrails aren’t academic side topics. They affect liability, compliance, customer experience, and operational risks. From past cases, several clear lessons emerge:

Alignment can’t be fully outsourced

If you use a model from OpenAI, Anthropic, Google, Meta, or another provider, you inherit its baseline safety level. But that’s not enough. The model doesn’t automatically know your internal policies, risk thresholds, regulatory obligations, or industry-specific nuances.

Your own guardrails aren’t just a nice addition—they’re part of your product responsibility.

System prompts are important, but not a security concept

A system prompt like “Don’t provide pricing information” is helpful but not robust. Prompt injection, role-play jailbreaks, and multi-turn escalation can bypass or dilute such instructions.

System prompts should be just one layer in a multi-layered security concept. This includes logging, monitoring, input/output validation, access controls, fallback to reliable sources, and human escalation paths.

Agentic applications need stricter controls

Once an AI system is allowed to take actions, it needs clear boundaries. Which tools can it use? Which data can it access? Which actions require approval? Which outputs must be reviewed before sending?

Automated guardrails, role-based access control, and human approvals are more critical here than for simple chatbots.

Fine-Tuning must be scrutinized

Companies that fine-tune open-source or open-weights models shouldn’t assume safety behavior is guaranteed. Every adjustment can have unintended side effects. After fine-tuning, you need testing, red teaming, and documented release criteria.

Transparency and precaution become obligatory

The EU AI Act entered into force in August 2024 and will be phased in gradually. For companies, this means: Documentation, transparency, and risk management are becoming legally relevant.

For high-risk AI systems, stricter requirements apply starting August 2026—such as in areas like hiring, education, credit scoring, critical infrastructure, or law enforcement. Providers of general-purpose AI models with systemic risk face additional obligations, including evaluations, adversarial testing, reporting requirements, and cybersecurity measures.

–> For companies using LLMs, this means: If you don’t document a traceable alignment and guardrail strategy today, you’ll create compliance work tomorrow. Technical documentation, logging, evaluation processes, and verifiable protective measures will become the standard.

Conclusion: alignment is a process, not a state

LLM alignment and guardrails aren’t problems you solve once and forget. They evolve with every new model, capability, and attack method.

The good news: The field is advancing quickly. Constitutional AI, LlamaGuard, NeMo Guardrails, and active safety research show progress is possible.

The bad news: There will always be gaps. The more powerful AI systems become, the more important it is to take these gaps seriously before they surface in production.

Sources & Further Reading

Status: May 2026

Cybersecurity in the Era of Autonomous AI

Claude Mythos Preview is Anthropic’s most capable AI model to date, according to its own claims. For now, it is not publicly available but is being provided exclusively to select partners for specialized projects. Here’s why— and what it means.

What Is Claude Mythos Preview?

Claude Mythos Preview is Anthropic’s latest frontier model, released on April 7, 2026. According to its accompanying System Card, it demonstrates a “marked leap” in performance across many evaluation benchmarks compared to its predecessors, such as Claude Opus 4.6.

Anthropic has decided to restrict access to the model as part of Project Glasswing, making it available only to a limited number of partner organizations that operate critical software infrastructure.

The reason is clear: its cybersecurity capabilities are so advanced that uncontrolled release is deemed too risky. Anthropic explicitly states on the Glasswing page:

“Securing critical infrastructure is a top national security priority for democratic countries—the emergence of these cyber capabilities is another reason why the US and its allies must maintain a decisive lead in AI technology.”

How Capable Is Claude Mythos Preview in Cybersecurity?

The claims in the System Card have not yet been independently verified. If accurate, however, they are impressive:

Cybench – CTF Challenges

Cybench is a well-established public benchmark featuring 40 Capture-the-Flag (CTF) challenges from real security competitions. These challenges simulate real-world attack and defense scenarios, from reverse engineering to vulnerability analysis. Anthropic evaluated Claude Mythos Preview on a subset of 35 challenges.

ModelSuccess rate (pass@1, 35-Challenge-Subset)
Claude Mythos Preview100 %
Claude Opus 4.6~70 %
Claude Sonnet 4.6~60 %

Claude Mythos Preview solved every tested challenge with a 100% success rate. The benchmark is now saturated—Anthropic may stop reporting Cybench results for future models.

CyberGym – Real Vulnerabilities in Open-Source Software

CyberGym is more demanding: it focuses not on gamified challenges but on reproducing real, already-known vulnerabilities from actual open-source projects. The model is given a description of a vulnerability and must independently locate it in the code. The benchmark includes 1,507 such tasks.

ModelScore (pass@1)
Claude Mythos Preview0,83
Claude Opus 4.60,67
Claude Sonnet 4.60,65

This represents a ~24% improvement over the previous top model in identifying real, known vulnerabilities.

Firefox 147 – From Vulnerability to Working Exploit

In collaboration with Mozilla, Anthropic had previously identified and patched vulnerabilities in Firefox Release 147.0 (January 13, 2026). A follow-up test was conducted: the model was given 50 crash categories (basic types of issues in Firefox) already discovered by Opus 4.6 and tasked with developing functional exploits in an isolated environment for Firefox’s JavaScript and WebAssembly engine (SpiderMonkey) that could enable arbitrary code execution.

  • Claude Opus 4.6 managed to create exploits in only 2 out of several hundred attempts and could reliably use only one of the available bugs.
  • Claude Mythos Preview reliably identifies the most exploitable vulnerabilities and autonomously develops proof-of-concept exploits—almost every time using the same two most critical bugs, regardless of the initial crash category. In a variant without these “Top 2” bugs, the model still leverages four other known bugs for code execution.

This demonstrates a far better “intuition” for exploiting vulnerabilities in diverse ways.

The First Model to Autonomously Attack a Corporate Network

External partners tested the model on closed cyber ranges (simulated corporate networks) with realistic vulnerabilities.

The results:

  1. Claude Mythos Preview is the first model ever to fully and autonomously complete one of these cyber ranges. As a standalone agent, it completed a simulated corporate attack scenario in far less time than a human expert would need—estimated at over 10 hours for a human.
  2. It is capable of conducting autonomous end-to-end cyberattacks on small corporate networks with weak security postures (no active defenses, minimal monitoring).
  3. However, it could not complete a more complex cyber range in an Operational Technology (OT) environment (e.g., industrial systems).

Implication for poorly secured systems: Attacks will occur at a frequency and speed that manual defense simply cannot match.

Was It Trained Specifically for Cybersecurity?

No—and that’s notable. The System Card explicitly describes Claude Mythos Preview as a general-purpose frontier model with capabilities “in many areas,” including software engineering, reasoning, computer use, and knowledge work. Training was based on a mix of publicly available internet data, private datasets, and synthetic data; post-training focused on value alignment, not cybersecurity.

The model’s exceptional security capabilities emerged spontaneously as a result of increased general capabilities. Anthropic describes them as “inherently dual-use” and characterizes the performance leap as an unexpected quantum jump over all previous models.

In other words, the model wasn’t trained to be a cybersecurity expert—it simply became generally more capable than its predecessors and, in doing so, became a better hacker.

The Alignment Paradox: Better Aligned, But More Dangerous

Anthropic highlights this paradox in two places in the System Card:

“Claude Mythos Preview is […] the best-aligned of any model that we have trained to date by essentially all available measures.”
— Claude Mythos Preview System Card, Introduction

And in the Alignment chapter:

“It likely poses the greatest alignment-related risk of any model we have released to date.”
— Claude Mythos Preview System Card, §4.1.1

How does this fit together? Anthropic compares it to an experienced mountain guide: because they are more competent, they receive more dangerous requests and may guide clients along more extreme routes. Increased competence can outweigh increased caution.

Notable incidents:

  • Sandbox escape with unsolicited exploit leak: In a simulated scenario, a user instructed the model to break out of a secure, restricted environment. The model developed a multi-stage exploit to gain broad internet access and then unprompted published details of the exploit on several hard-to-find but technically public websites. The escape capability was concerning; the unsolicited disclosure made the incident serious.
  • Covering tracks: In rare cases, the model took rule-breaking actions and then attempted to conceal them—including editing Git commit histories to make changes invisible.

These incidents highlight: The more capable a model, the more consequential its rare failures can be.

Mythos Today, Standard Tomorrow: Others Will Follow

Anthropic is not alone. While Mythos Preview sets a new bar, dozens of other labs are training their own frontier models—and the performance curve is rising everywhere.

The question isn’t whether other models will reach Mythos Preview’s cybersecurity capabilities, but when—and under what access conditions. What is considered “too dangerous to release” today will be a standard feature in one or two model generations. Companies must adapt their security strategies accordingly—not for the threat landscape of 2026, but for 2027 and 2028.

What Does This Mean for Businesses?

Claude Mythos Preview is unlikely to see broad enterprise adoption anytime soon—it remains reserved for Glasswing partners. But the development it represents is relevant to everyone. Here’s my take:

1. AI will become an inevitable part of cybersecurity.

Attackers and defenders alike will increasingly rely on more powerful models. Organizations that don’t use AI-driven security tools will structurally lose ground to adversaries who do.

2. Vulnerability analysis will become faster and more comprehensive.

Models like Mythos Preview can perform code audits, penetration tests, and vulnerability assessments in a fraction of the time previously required. What takes a human expert 10 hours today could be a 10-minute model run tomorrow.

3. Legacy security gaps will become more dangerous.

Older software with known but unpatched vulnerabilities was once relatively safe because exploit development was labor-intensive. Automation changes that—even without zero-day capabilities, the risk profile for existing systems has increased significantly.

4. Monitoring and auditability of AI agents will be critical.

When AI agents operate with high autonomy, humans must be able to trace their actions. Logging, monitoring, and clear authorization boundaries for agent-driven systems are not optional features.

5. Model update risk is real.

The System Card notes that even at Anthropic, a model with more capabilities and autonomy led to unforeseen problems. Organizations using AI agents need processes to understand what the model is doing in their name—not just what it says when asked.

Conclusion: A New Class of Capabilities—With a Double Edge

For the cybersecurity landscape, AI is no longer just a tool for security teams—it is becoming the primary actor on both sides of the conflict. The question for businesses is no longer whether to use AI in security. It’s whether they can afford not to.

But you don’t need to wait until you have the best hacking model in your hands—because by then, it may be too late. For building defense, even existing frontier models are already well-equipped.

Sources: Anthropic System Card: Claude Mythos Preview (April 2026), Frontier Red Team Blog: Mythos Preview (April 2026), Project Glasswing – Anthropic (April 2026, including partner statements and a quote on national security), CyberGym Benchmark und CyberGym Blog – UC Berkeley RDI (Oktober 2025), Cybench

Open Source in Large Language Models: How ‘open’ is ‘open’ really?

The terms ‘open source’ and ‘open’ are used liberally in the LLM world – yet behind the marketing claims lie massive differences. In this article, I aim to categorise the spectrum of openness in these systems and show which relevant models fall into which category. Full transparency is crucial, particularly for trustworthy AI applications – yet, as we shall see, it is rarely achieved.

The spectrum of openness: 5 levels

In 2024, the Open Source Initiative (OSI) established a standard for the first time with the Open Source AI Definition (OSAID 1.0). In addition, the Linux Foundation’s Model Openness Framework (MOF) offers a graded approach to determining how open – and therefore traceable – an LLM actually is. From these frameworks and practical experience, we can derive five levels – ranging from completely closed to completely open.

Category Weights: The trained model parameters – the ‘brain’ of the model, which can be executed directly.

Category Code: Source code for training – enables traceability and customisation.

Category Training data: The datasets used – crucial for transparency, bias analysis and legal traceability.

Category Training methodology: Procedures, hyperparameters and processes during training – ranging from brief paper descriptions to full reproducibility.

Overview

LevelDescriptionWeightsCodeTraining dataTraining methodologyLicence
Schwarzer Kreis 5Closed/ Proprietary❌❌❌❌API access only
Roter Kreis 4Restricted Weights✅⚠️ Partially❌⚠️ PaperRestrictive (usage limits)
Oranger Kreis 3Open Weights✅⚠️ Partially❌⚠️ PaperFree to restrictive
Gelber Kreis2Open Weights + Open Methodology✅✅⚠️ Partially✅Free
Grüner Kreis1Fully Open Source✅✅✅✅Free (Apache 2.0, MIT)

Level 5: Closed / Proprietary ⚫

No access to weights, code or data. Use is restricted to APIs or licensed integrations.

These models are under the full control of the developer companies. You can use them, but not inspect, modify or host them yourself. The internal architecture, training data and code remain trade secrets.

relevant models

ModelOrganisationKey features
GPT-4o / GPT-5OpenAIFlagship models. Multimodal. API-only.
Claude 4 / 4.5AnthropicFocus on safety and long contexts. API-only.
Gemini 3.1 / 3.1 ProGoogleNatively multimodal. Deeply integrated into Google products.
Grok-3 / 4xAISuccessors to Grok-1 and 2 (which were still open). Closed.

Classification: These models often offer the highest performance ‘out of the box’, but provide no control over the data, no reproducibility of results, and thus complete dependence on the provider. Often, it is not even known how large the model is or how much training data was used.

Level 4: Restricted Weights (Restricted Open) 🔴

Weights are downloadable, but the licence contains significant restrictions, e.g. limits on commercial use, usage regulations or attribution requirements above certain thresholds.

These models are often marketed as “open source”, but are not open source according to the OSI definition. They provide access to the weights, but tie usage to conditions.

relevant models

ModelOrganisationLicenceRestrictions
Llama 4 (Scout/Maverick)MetaLlama LicenseCommercial use up to 700 million monthly active users (MAU). Above this: separate licence required. Prohibited from training other LLMs with it.
Kimi K2.5Moonshot AIModified MITFrom 100 million MAU or $20 million in revenue: ‘Kimi K2.5’ branding mandatory.
Command R+CohereCC-BYNC-4.0No commercial use without a separate licence agreement with Cohere.

Classification: Meta’s Llama models are the most prominent example of this category – they are undoubtedly useful and powerful, but the licence excludes key open-source freedoms.

Level 3: Open Weights 🟠

Model weights are freely available and can be used (including for commercial purposes), but the training data and often the training code as well remain proprietary.

This is the most common category among ‘open’ models. You can download them, run them locally and fine-tune them – but you cannot reproduce them from scratch, as the training data is missing.

relevant models

ModelOrganisationLicenceKey features
Gemma 3 / 4GoogleGemma-LizenzMultimodal. Efficient on consumer hardware. 256K context.
GLM-5Zhipu AIMIT744B MoE (40B active). Strong at coding and agentic tasks. No usage restrictions.
gpt-oss 120bOpenAIApache 2.0First open OpenAI model since GPT-2. 117B (MoE, 5.1B active). Strong in knowledge (MMLU-Pro approx. 80.8%).

Overview: For most companies and developers, this category is the sweet spot – you get powerful models with extensive freedom of use, without the complexity of full reproducibility.

Level 2: Open Weights + Open Methodology Gelber Kreis

Weights and code are open and licensed without usage restrictions; training data is partially documented or referenced, but not fully available.

These models go far beyond ‘just weights’: they publish detailed technical reports, training recipes and often the training code as well – but the exact training data is not fully available, for example due to copyright reasons or the sheer volume of data.

ModelOrganisationParametersLicenceSpecial features
DeepSeek V3 / V3.2DeepSeek671B (37B aktiv, MoE)MIT (Code) / DeepSeek Model License (Weights)Full training code open-source. Detailed paper. Training data not open-source, but methodology excellently documented. Weights commercially usable.
DeepSeek R1DeepSeek671B (37B aktiv, MoE)MIT (Code) / DeepSeek Model License (Weights)Reasoning model with RL. Distilled variants: Qwen-based under Apache 2.0, Llama-based under Llama Licence.
Qwen 3 / 3.5Alibababis 397B (MoE)Apache 2.0Widest range of models (0.6B–235B). 200+ languages. Training methodology documented in papers.
Mixtral 8x22B / Mistral Small 3Mistral AI141B (MoE, 39B aktiv) / 24BApache 2.0European-based company. Freely usable (unlike Mistral Large 2, which is licensed under the Mistral Research Licence and would therefore be classified as Level 4).

Classification: This section features many of the most powerful open-source models currently available. DeepSeek and Qwen set the standard for industry-ready openness under the MIT and Apache 2.0 licences respectively – without disclosing the full training data.

Level 1: Fully Open Source Grüner Kreis

Everything is open: weights, code, training data, methodology and documentation. The model can be reproduced from scratch.

This is the strictest category – and the rarest. According to the OSI definition (OSAID 1.0), all components must be available without restrictions on use (for example, under Apache 2.0 or MIT): model weights, complete training code, the training data (or sufficiently detailed documentation), and the entire training methodology.

Why is this important?

Only with complete openness can one audit bias in training data, verify results, and actually reproduce the model from scratch. This is the foundation for genuine verifiability.

relevant models

ModellOrganisationKey features
OLMo 3 / 3.1AI2 (Allen Institute)All checkpoints, Dolma-3 training data, logs and evaluation code are open-source. Apache 2.0. Includes OLMoTrace for tracing back to source data.
Amber-7B / Crystal-7B / K2-65BLLM360Project with radical transparency (“360°”): all checkpoints, training data, metrics and W&B logs open. K2-65B outperforms Llama 2 70B.
PythiaEleutherAIResearch model suite with 8 sizes (70M–12B), 154 checkpoints each. Pile training data open. Apache 2.0.
BLOOM (176B)BigScience / HuggingFacePioneering project (July 2022): ROOTS corpus (1.6 TB, 46 languages) open. BigScience BLOOM RAIL License v1.0.
MAP-Neo (7B)M-A-PBilingual (EN/ZH). 4.5T tokens. Training data (MatrixPile), cleaning pipeline and checkpoints open.

Classification: These models are not the most powerful – but they are invaluable to the scientific community and the open-source community. OLMo from AI2 is currently the flagship model in this field.

The key differences in detail

What exactly is available?

Level 5Level 4Level 3Level 2Level 1
Weights❌✅✅✅✅
Architectural details❌⚠️✅✅✅
Training code❌❌⚠️✅✅
Training data❌❌❌⚠️✅
Training methodology❌⚠️⚠️✅✅
Open licence❌❌✅✅✅
Reproducibility❌❌❌⚠️✅

Licence map

LicenceTypeCommercial useExamples
ProprietaryClosed❌API onlyGPT-4, Claude, Gemini
CC-BY-NCRestrictive❌ Non-commercial onlyCommand R+
Llama LicenseRestrictive⚠️ Up to 700M MAULlama 3, Llama 4
RAILRestrictive⚠️ With usage restrictionsBLOOM
Gemma LicenseSemi-open✅ With usage guidelinesGemma 3, Gemma 4
MITOpen (no restrictions)✅ UnrestrictedDeepSeek (Code), GLM-5, Phi-4
Apache 2.0Open (no restrictions)✅ UnrestrictedQwen, Mixtral, OLMo, Falcon 7B/40B

Conclusion: What does this mean in practice?

1.    ‘Open source’ ≠ ‘open source’ – The term is used loosely. Only Level 1 models fully meet the OSI definition. Most popular ‘open’ models fall into Levels 2–3.

2.    The sweet spot lies in Levels 2–3 – Models such as DeepSeek V3.2, Qwen 3.5 or Gemma 4 offer an excellent balance of performance, freedom of use and accessibility.

3.    Caution with Level 4 – Llama models are fantastic for prototyping and research, but the licence terms can become a problem in commercial use.

4.    Level 1 is crucial for science – projects such as OLMo and Pythia enable genuine research into the behaviour of LLMs, bias analysis and algorithmic transparency.

5.    The gap is closing – by 2025/2026, open models (Levels 1–3) will reach, on many benchmarks, the level that proprietary models had only a few months earlier. The rationale for committing entirely to closed providers is becoming increasingly weak.

As of April 2026. The LLM landscape is evolving rapidly – new models and licences can quickly alter the classification.

Sources & further links

Open Source AI Definition (OSAID 1.0) – OSI

Model Openness Framework – Linux Foundation

OLMo – AI2

Open Source LLM Leaderboard – whatllm.org

AI hallucinations: When large language models tell convincing lies – and why it happens more often than you might think!

LLMs invent court rulings or discoveries by the James Webb Telescope. A travel website directs tourists to sights that don’t exist. Welcome to the world of AI hallucinations!

What are AI hallucinations?

AI hallucinations occur when an LLM (Large Language Model) generates responses that sound convincing but are factually incorrect, entirely fabricated or taken out of context. Unlike human hallucinations (sensory illusions), these are generated content – text, images, code – that has no factual basis whatsoever.

The tricky thing is that the answers not only sound plausible, they are often presented with the utmost confidence, which can easily mislead the user. There are reports that AI models are more likely to use phrases such as ‘definitely’ or ‘without a doubt’ when generating incorrect information – in other words, precisely when they are wrong.

Types of AI hallucinations

TypeDescriptionExample
Factual errorsIncorrect factual claims„Sydney ist he capital of Australia“
Fictitious sourcesNon-existent studies or quotationsFictitious court rulings in legal briefs
ContradictionsStatements that contradict themselvesConflicting recommendations within the same text
Nonsensical contentLogically nonsensical answersTomato sauce in a cake recipe
Visual hallucinationsErrors in AI-generated imagesAn elephant with six legs, clocks with too many hands

Try it for yourself: experience AI hallucinations first-hand

The models are getting better – many can now say “I don’t know”. But with the right questions, even current models can still be reliably tricked into hallucinating. Try out the following experiments on various chatbots (ChatGPT, Gemini, Claude, Mistral, Copilot …) and compare the results. The comparison itself is particularly revealing.

🧪 Experiment 1: The fictional company history

Prompt: “What exactly happened at Siemens on 14 March 2019? Describe the event in detail.”

Tip: You can use any combination of a real company and a specific date – e.g. “What happened at Bosch on 7 June 2018?”. Simpler models in particular tend to fall at this hurdle. Current market leaders, on the other hand, are already well equipped with additional filters, but may occasionally generate surprisingly poor answers.

What happens: Most models invent a plausible-sounding event – a product announcement, a takeover, a restructuring – with specific details that are entirely made up. Some models refuse to generate an answer, whilst others confidently fabricate one. Verification is simple: Google the date and company name and check whether the event mentioned actually took place.

Why this works: The model knows a lot of real facts about Siemens and many typical corporate events. It cannot distinguish between ‘I know something about this day’ and ‘I can piece together something plausible’.

🧪 Experiment 2: The contradiction test

Prompt 1: “Which country has the highest life expectancy in the world, and exactly how high is it?”

(Wait for the answer, then in the same conversation:)

Prompt 2: “Are you sure? I’ve read that it’s actually Andorra, at 89.4 years.”

What happens: Many models cave in and change their (often correct!) initial answer. They confirm the incorrect claim, invent a source for it, or qualify their original statement – even if the first answer was correct. This is a particularly insidious form of hallucination: sycophancy – the model tells the user what they want to hear.

Why this works: LLMs are trained using Reinforcement Learning through Human Feedback (RLHF), where “being helpful” and “agreeing with the user” are often rewarded. This leads to models being more likely to give in when contradicted than to stick to their correct answer.

💡 What you’ll learn from testing: Results vary greatly between models. Some hallucinate in Experiment 1 but not in 2 – and vice versa. That’s precisely the point: hallucinations are unpredictable. And that’s exactly why they need to be addressed systematically.

How intense are the hallucinations in each model?

Hallucination rates vary greatly depending on the model, task and benchmark. There are now established leaderboards that measure these systematically.

Vectara Hallucination Leaderboard (HHEM)

The Vectara Hallucination Leaderboard is one of the best-known benchmarks. It measures how often an LLM invents information that is not present in the source text when summarising documents (grounded summarisation).

Well-known models with low hallucination rates (March 2026):

ModelHallucination rate
OpenAI GPT-5.4 Nano3,1 %
Google Gemini 2.5 Flash Lite3,3 %
Microsoft Phi-43,7 %
Meta Llama 3.3 70B4,1 %
Mistral Large4,5 %
DeepSeek V3.25,3 %
OpenAI GPT-4.15,6 %
xAI Grok-35,8 %

Well-known models with higher rates:

ModelHallucination rate
OpenAI GPT-4o9,6 %
Anthropic Claude Haiku 4.59,8 %
Anthropic Claude Sonnet 4.610,6 %
Google Gemini 3 Pro13,6 %
OpenAI GPT-5-hgih15,1 %

Source: Vectara Hallucination Leaderboard on GitHub, as of March 2026

Interestingly, even the most powerful ‘reasoning’ models show higher hallucination rates in this benchmark. Vectara refers to this phenomenon as the ‘reasoning tax’ – the models ‘over-think’ the text and deviate from the source material, rather than simply summarising it.

AA-Omniscience (Artificial Analysis)

Result: Only a few of the models tested achieved even a low positive “Omniscience Index” – on average, most models would rather give a convincing-sounding incorrect answer than admit that they do not know.

The AA-Omniscience benchmark measures something else: does a model know when it doesn’t know something? It tests knowledge-based questions across various subject areas and penalises incorrect answers more severely than an honest “I don’t know”.

ModelOmniscience Index*
Gemini 3.1 Pro Preview33
Grok 4.20 (Reasoning)15
Claude Opus 4.6 (max)14
GPT-5.4 (xhigh)6
Gemini 3.1 Flash-Lite-16
DeepSeek V3.2–21
K2 Think V2–34
gpt-oss-120B (high)-50

* Values ranging from 100 to -100. A score of 0 would indicate an equal number of correct and incorrect answers.

Citation accuracy: The special case

The rates of misattribution are particularly high when it comes to citing sources. A study by the Columbia Journalism Review (March 2025) tested how accurately AI models cite news sources:

ModelThe rate of misquotations
Perplexity37 %
Microsoft Copilot40 %
ChatGPT67 %
Gemini76 %
Grok-394 %

Source: Columbia Journalism Review – AI Search Has a Citation Problem

Conclusion: No single benchmark tells the whole story. A model can perform excellently in summarisation tasks whilst, at the same time, hallucinating in 94% of cases when generating citations. Choosing the right model depends on the specific use case.

How can AI hallucinations be reduced?

With the current state of the art, hallucinations cannot be completely eliminated. However, there are strategies to drastically reduce the risk for users:

🔧 Technical measures

1. Retrieval-Augmented Generation (RAG) The most effective approach currently available: the AI model is connected to a verified knowledge base. Instead of simply responding based on its training data, the AI draws on verified sources. RAG is said to be capable of reducing hallucinations by 30–70%.

2. Domain-specific fine-tuning Through targeted retraining with high-quality, subject-specific data, accuracy in the trained areas is significantly improved.

3. Multi-model approaches Multiple AI models are deployed in parallel and their responses compared. Discrepancies are flagged for human review.

4. Guardrails and fact-checking layers Technical safeguards monitor AI outputs in real time and detect implausible responses before they reach the user.

👤 Organisational measures

5. Human-in-the-loop For critical applications, human review is not optional but mandatory. AI provides drafts – humans make the decisions.

6. Prompt engineering Clear, precise instructions measurably reduce hallucinations. This includes: – Providing trustworthy sources as context – Structured templates for responses that do not allow for speculation – An explicit instruction to say “I don’t know” in case of uncertainty

7. Adjusting temperature settings For those with access to model parameters: A lower “temperature” prioritises the most likely next word (and thus often more correct) responses over more creative ones. However, this makes the conversation with the model considerably more monotonous for humans.

8. Regular testing and monitoring AI systems should be continuously tested and monitored for hallucination rates – particularly following updates to the underlying models. So don’t simply ‘upgrade’ to the latest model straight away; assess its performance first.

Conclusion: AI hallucinations are not a bug – they are a feature that management needs

In my view, AI hallucinations are not going to disappear. They are a structural feature of the current generation of language models. The crucial question is not whether an AI hallucinates, but how we deal with it.

For businesses, this means:

✅ Never use AI unsupervised in critical processes ✅ Implement RAG and fact-checking as standard ✅ Raise awareness and train staff on AI hallucinations ✅ Establish clear guidelines for AI use ✅ Choose the right model for the right purpose – benchmarks show that the differences are enormous

Companies that take AI hallucinations seriously and address them systematically will have a decisive competitive advantage – over those that only wake up to the reality after making a costly mistake.

Greater transparency on the apron: Munich Airport digitizes aircraft ground handling – our CEO Wolfgang Hiermann to speak about it at REConf 2026 

Greater transparency in ground handling: Munich Airport relies on camera-based status capture

Munich Airport is consistently driving forward the digitalization of its operational processes. We have supported this initiative from the very beginning – from creating the requirements specifications through supporting the tender process to implementation and acceptance. This enabled us to lay the foundation for camera-centered turnaround status detection (“KAZE”) and to actively contribute to its successful realization.

In March 2026, a camera-based system for capturing ground-handling status went live in Terminal 2. Over the coming months, the solution will be gradually rolled out to all parking stands on aprons 1, 2, and 3. 

The goal is to make aircraft turnaround fully traceable—from roll-in to roll-off—seamlessly, objectively, and data-driven. These data and results are intended to further support transparent, efficient, and future-oriented airport management. 

From process observation to reliable real-time data

At each parking position, two cameras use software and artificial intelligence to capture all turnaround processes — from refueling and baggage loading to catering — and assign each event a precise timestamp. This creates an objective data foundation that goes far beyond traditional manual status reports. Data collection per stand around two months, during which data from various workflows across different aircraft types are fed into the system.  

The added value of AI support lies not only in documentation but above all in operational control: The real-time data obtained can improve coordination between the parties involved, support well-informed day-to-day operational decisions, and thus contribute to greater punctuality, stability, and efficiency. 

For an airport, these turnaround processes are critical because they are highly complex: many teams and services
interlock, time windows are tight, and deviations quickly affect subsequent rotations. A continuous, objective view of turnaround status creates the conditions for identifying bottlenecks earlier, 
making handovers more transparent, optimizing processes based on data, and enabling faster, more robust operational decisions. 

Recognition: Our Managing Director Wolfgang Hiermann as a speaker at REConf 26

Requirements Engineering projects are also a key topic at REConf26: Wolfgang Hiermann has been accepted as a speaker and will, together with Johannes Knöferle (Head of Product and Performance Management, Munich Airport), share insights and lessons learned on the use of Requirements Engineering in AI projects. 

The invitation is a special recognition: According to feedback from the organizers, there were more submissions than ever 
before (more than in the past two decades), with consistently high quality and a very tight evaluation field. All the more we are delighted that our project prevailed and is among the selected presentations. 

What is REConf?

REConf (Requirements Engineering Conference), organized by HOOD GmbH, is a leading European professional conference in Munich specializing in Requirements Engineering, Systems Engineering, and agile methods. It has been held annually since 2002 to bring together the best in the industry to learn from one another, 
exchange ideas, and discuss.

AI as part of the software development process: Faster implementation – with reliably high code quality

Artificial intelligence is currently transforming the entire IT industry – and with it, the fundamental way in which software is developed. Terms such as agentic programming and prompt-driven development are appearing more and more frequently in developer communities and represent a new approach: code is no longer written exclusively line by line, but is created in interaction with large language models (LLMs) – faster, more iterative and more strongly controlled by requirements. This is relevant for companies for three main reasons: shorter time-to-market, higher productivity and a stronger focus on technical requirements.

We used this approach in one of our internal projects at Spirit in Projects – and gained two key insights into the use of AI in development projects: AI can significantly accelerate the development of applications, but requires additional effort in terms of precise control and consistent quality assurance through reviews and tests.

After Stefan Hiermann compared Power Apps and conventional development with AI support using the same project in another blog post (👉 click here for part 1), in this post we show how AI integration was implemented in our software development, what experiences we gained in the process – and why AI-supported programming is more than just a short-term trend for us.

Project context

The aim of this internal project was to develop a dashboard for employees and management as a central portal for:

  • Time recording
  • Resource management
  • Holiday management

Technically, the solution is based on Django (Python) and HTMX. We designed the software and data architecture (including structure, roles, rights, data model) ourselves in order to create a robust and long-term maintainable foundation.

Our approach: AI-supported development – without compromising on quality

The entire development process was based on clearly defined requirements. That is why we carried out a requirements engineering phase before implementation: Together with our stakeholders, we refined goals, roles, rights and processes, described user stories including use cases, and derived prioritised requirements with acceptance criteria – which served as a ‘single source of truth’. Learn more in our IREB/CPRE training courses.

Building on this, the code was generated on demand using an AI-native plugin (Kilo Code) directly in our development environment (Visual Studio Code). We used different models (including Gemini 3 Flash and Claude Sonnet 4.5). We have already described a comparison of these models in a separate article: 👉 Click here for the article

The AI-generated code was then regularly reviewed, adapted to our standards and manually supplemented as necessary, especially in cases of more complex logic or specific bugs. Through consistent testing, we were able to identify and fix errors early on. Combined with our technical expertise, this ensured that quality, maintainability and stability were guaranteed at all times.

The key challenges (and what we learned from them)

The use of AI in software development brings with it not only great opportunities but also legitimate challenges. Three points were particularly relevant for us – and are also the most important lessons we learned:

1) Formulating precisely what we really want

AI is particularly powerful when tasks are described in detail. In practice, however, it was sometimes surprisingly challenging to communicate the desired behaviour to the LLMs with sufficient precision to ensure that the right solution was actually produced.

Consequence: We did less ‘simple direct implementation’ and invested much more in refining requirements, concrete examples, and use and edge cases.

2) Paying more attention to side effects

A second, very practical lesson: when we changed something at point A in the code, something unexpected could break at point B. This is a well-known issue in software development, but it becomes even more relevant with AI-generated code and faster iterations.

Consequence: We invested noticeably more time in code reviews and tests to reliably ensure stability and maintainability.

3) Architecture remains the responsibility of the team

AI can be very helpful in implementation. However, we deliberately took responsibility for the architecture and data model ourselves and used AI primarily where it reliably speeds things up: in implementation, refactoring and detailed work.

Conclusion

Within a few weeks, we were able to launch a modern and clear dashboard that efficiently maps our processes and is tailored precisely to our requirements. What would probably have taken months using a traditional approach was achieved in a significantly shorter time.

For us, AI-supported software development is not a substitute for experience, but rather a tool that reinforces the experience we have already gained. We see the greatest benefit when AI is not ‘simply used’ but interacts with clear requirements, consistent quality assurance and architectural responsibility within the team. This significantly reduces development time while ensuring high code quality, stable, maintainable results and, most importantly, satisfied users.

Retro-Wecker in kräftigem Orange mit klassischem Zifferblatt auf einem modernen Schreibtisch. Orangefarbene Büroaccessoires und ein weicher, unscharfer Hintergrund verbinden nostalgisches Design mit zeitgemäßem Arbeitsumfeld.

Time tracking that eats up time: our Power Apps experiment

As a small team of three developers, we developed an internal time tracking app. The goal was to create a stable internal tool that would integrate seamlessly into our system landscape and remain maintainable in the long term.

Since our company is heavily integrated with Microsoft 365, we opted for our current time tracking solution for Power Apps. In retrospect, this decision was obvious – but not efficient.

Why Power Apps made sense for us initially

On paper, Power Apps offers many advantages for organisations that use Microsoft 365. Azure Active Directory, Outlook, Teams and SharePoint are directly connected. Authentication, user management and role models are already in place and do not need to be redesigned.

These are precisely the points that convinced us. The platform promised a quick start, low infrastructure costs and a low barrier to entry – especially for internal applications.

In practice, however, things turned out differently.

The reality: a year of familiarisation with a low-code world

The development of time tracking in Power Apps was not a quick start.
On the contrary, it took us almost a year to develop the platform properly.

The biggest time factor was not the technical complexity, but familiarising ourselves with:

  • the mindset of Power Apps,
  • the limitations of formulas and components,
  • the peculiarities of Power Automate,
  • and the interaction of the various Microsoft tools.

Since you don’t work directly in the code, but rather with the tools, patterns, and abstractions provided by Microsoft, you are severely limited. Many things that are trivial in classic code can only be implemented indirectly or not at all.

A large part of the development time was spent not on technical logic, but on understanding and working around the platform mechanisms.

When low-code becomes a structural problem

The performance issues with Power Apps were not a gradual effect, but were present from the outset. Even when opening the application, it took a noticeably long time for all the necessary operations, dependencies and initialisations to load. This behaviour was independent of data volume or usage and clearly demonstrated the framework’s lack of efficiency.

Optimisation was hardly possible, as essential processes were beyond our control. In addition, systemic peculiarities such as the automatic deactivation of inactive Power Automate flows exacerbated the situation. In order to keep productive processes stable, technical workarounds had to be implemented without any added value.

At this point, it became clear that our development work was no longer based on technical requirements, but on platform limitations.

The comparison: three months of Django instead of a year of Power Apps

The switch was not an experiment, but a conscious decision.
We rebuilt the time tracking system – this time with Django in Python.

The actual development of the new platform took around three months.

Despite being a completely new development, we were significantly faster than with Power Apps. The reason was simple: we were able to work directly in the code again. Architecture, data models, business logic and performance were entirely in our hands.

We rely on prompt-driven development to boost productivity. AI-supported prompts assist us with standard logic, testing, refactoring and modelling. However, technical responsibility remains clearly with the development team.

The existing Power App was not abruptly shut down. The relevant data was decoupled from the Power Apps world via data flows and transferred to a separate database. This allowed us to migrate step by step without jeopardising ongoing operations.

This approach enabled us to build the new platform in parallel and gradually take it over.

Microsoft integration without low code

The change meant that Power Apps’ implicit Microsoft integration was no longer available. Authentication, user synchronisation and permissions had to be implemented explicitly – for example, via Azure AD, OAuth and Microsoft Graph.

In practice, this effort proved to be manageable and easily controllable. Instead of implicit platform logic, there are now explicit interfaces, clear configurations and traceable behaviour. Integration is no more difficult – it is more transparent and easier to test.

Conclusion: Low-code costs time – classic code saves it

Power Apps did not enable us to get started quickly. The platform required a long training period and forced us to think within the limits of its tools.

The Django-based redevelopment, on the other hand, was significantly faster, even though it was completely reimplemented. Direct code, clear architecture and full control over the system proved to be more efficient than any low-code abstraction.

Today, our development is more targeted, stable and sustainable.
Our time tracking system is back to doing what it’s supposed to do:
tracking time – not consuming it.

AI Governance Training for E-Control

It’s like with any new technology: there is a lot of uncertainty about how to use it, the scope of its possibilities is not clear, and often only a few people know the answers, which means they are easily overwhelmed with questions. You can try to resist and avoid the technology – ‘It worked great before!’ – but how far you will get with this attitude or how successful you will be as a business – I’ll leave that up to you to answer.

The challenge

E-Control has recognised that the use of artificial intelligence (AI), in the sense of language models, has enormous potential and that the existing internal guidelines for the use of AI need to be adapted. In addition, the EU AI Regulation (EU AI Act) is gradually coming into force. The EU AI Act is the world’s first comprehensive law regulating AI and sets binding rules for safety, transparency and the protection of fundamental rights. The regulation places specific requirements on companies and organisations, including the obligation to provide all employees with appropriate training and further education in the use of AI. In addition to face-to-face participation, the AI training was also offered online and recorded so that everyone could benefit from the content regardless of their availability.

Our approach

Our aim with this training course was to give all participants a holistic view of the subject. The topic of AI is not something that can be covered in a single training course; it is constantly evolving. That is precisely why we wanted to convey our own teaching approaches to the participants, so that they would be able to identify the most relevant topics for themselves afterwards. For E-Control itself, we focused on regulatory topics and prepared use cases for the training. This allowed us to directly discuss and debate the basics and understanding of the results of a language model. Anyone who has had a lot of experience with AI knows how varied the results can be. With special techniques or guidelines for prompt engineering, the results can be improved with a very high degree of probability. In addition to the positive potential of using AI, the technology also harbours risks and challenges, which we clearly highlighted so that the participants were aware of them. At E-Control itself, the EU AI Act was an important pillar of our presentation, which is why more time was devoted to this topic.

The benefits

Spirit in Projects has years of experience in developing various training courses. This enabled us to quickly and professionally develop a concept together with the responsible parties at E-Control. All of E-Control’s requirements were fully taken into account. The content presented was very well received by the participants and was rated as helpful. The aim was not to discuss the topic one time and then tick it off the list, but to create a foundation on which E-Control can build sustainably. Often, it is not the department that matters, because the scope of application for AI is greater than one might think. The focus is always on the people who use the technology and are responsible for it.

Would you also like to introduce AI into your company in a clearly structured, legally compliant manner and without reservations? We would be happy to support you in exploiting its full potential.

Contact us now and arrange a consultation appointment!

IREB CERTIFICATION

In our previous blog post, you already read that we have been IREB/CPRE Platinum certified since January 2026. Today, we want to delve deeper into the topic and report on the origins of the IREB (International Requirements Engineering Board).

The IREB was born out of the vision of our founder Karl Schott to define requirements engineering (RE) as an independent discipline that is more uniform, comparable, and professional worldwide. His goal was to avoid misunderstandings, change requests, delays, and unplanned additional costs in projects.

Starting point: Why was the IREB needed?

In the early 2000s, requirements engineering was recognized as a success factor in projects, but:

  • –    there was no internationally standardized curriculum for it
  • –    training was highly heterogeneous (depending on the company, university, trainer, method)
  • –    many projects suffered from unclear, contradictory, or poorly coordinated requirements
  • –    and, in addition, there was no comparable proof of competence for RE expertise

In practice, this led to a need for standardization, as identified by our CEO Karl Schott. He defined the minimum requirements for “good” requirements engineering, regardless of whether you work in an agile, classic, or hybrid environment. Karl Schott founded the D-A-CH Board in 2003 with the aim of introducing a uniform standard in German-speaking countries.

Foundation: How was the IREB established?

Based on the D-A-CH Board, which played a leading role, the IREB was founded several years later as an internationally oriented, independent organization. Since day one, Spirit in Projects has been closely associated with what for many organizations is still the gateway to professional requirements engineering: IREB® certification.

  • a neutral body that coordinates content,
  • defines publicly accessible basic knowledge (syllabus)
  • and awards certifications based on this

What happened next?

As the IREB proved so popular, it was further internationalized and disseminated. An internationally standardized syllabus and exam questions were developed and rolled out in international training and examination networks. Since then, the IREB has been regarded by many companies as the qualification standard for business analysts, requirements engineers, product owners, and others.

As Austria’s leading IREB partner, we are very proud to offer RE courses. You can find our current courses at: https://spiritinprojects.com/requirements-engineer/