Open source software (OSS) is everywhere—it’s the lifeblood of the modern software ecosystem. Ninety percent of companies use open source1, 97% of codebases contain open source2, 70-90% of the code within commercial tools comes from open source3, and the value of OSS globally is estimated to be $8.8 trillion4. At GitHub, we love open source—and we’re so honored to host so much open source code that we famously preserved it in the Arctic. But in the same way that your office microwave doesn’t just magically get clean and your favorite park doesn’t have self-mowing grass, open source software doesn’t just happen.   We’re surrounded by human-maintained infrastructure and resources that, in our busy lives, can be easy to take for granted. This is why we started Maintainer Month—a time to thank the open source software maintainers that keep projects healthy. This May marks the fifth annual Maintainer Month, and there are lots of treats in store: new badges, special discounts, events with experts, and more. In addition to the fact that the device you’re reading this on functions–thanks, open source maintainers! Maintainer Month events and livestreams There are over 25 events and livestreams scheduled during Maintainer Month, so head on over to the schedule to see them all or add your own! Everyone is welcome at these events—whether or not you’re ready to call yourself a software maintainer. Here are a couple of our favorites, since they tackle thorny issues:  What maintainers need to know about open source licensing, SBOMs and security: May 6, 2025Join our colleague Jeff Luszcz from the GitHub Open Source Programs Office as he reviews what every maintainer should know about these topics in the ever-evolving landscape of 2025. We get so many questions about this, and Jeff is the expert! The CRA and Open Source: What Maintainers Really Need to Know: May 27, 2025Feeling stressed about the European Union’s new Cyber Resilience Act (CRA) regulations? We can help! Come to this stream with the Eclipse Foundation’s Cyber Resilience Working Group, where they’ll talk about resources and practical information for maintainers navigating these changes. 🎁 Meet the 2025 Partner Pack This year, we’re launching the new Maintainer Month Partner Pack—a bundle of perks, tools, and resources from organizations that truly believe in open source. Think of it as a care package for the folks behind our digital infrastructure. Here’s just a taste of what’s inside (and it’s available to all maintainers): Arachne Digital: Free tailored threat report with steps to defend your project Boot.dev: One month of free premium access to backend dev courses CNCF: Discounts on select cloud native training (Kubernetes included!) DevCycle: A full year of the Developer plan, free for maintainers JSConf North America: Special discounted tickets for Maintainer Month Linux Foundation Education: 25% off the full course catalog Mockoon: Free Mockoon Cloud account to build, test, and mock APIs faster Sentry: Access to their open source plan for monitoring and performance TODO Group: 20% off the CODE certification for enterprise open source Web Summit: Discounted tickets to Vancouver & Lisbon for OSS contributors …and we’ll be adding more throughout May.  👉 See all current offers and partners here. Some partners are offering extra perks for members of our private Maintainer Community—a vetted space to connect, share, and support each other. If you maintain an open source project, you can request to join our Maintainer Community. Security: a new challenge Security is kind of a big deal, which is why you hear about it all the time. This is why we’re excited to launch new security guidance on opensource.guide to help maintainers strengthen the trust and resilience of their open source projects. We’ve pulled together practical advice and tools you can start using right away to make your project safer for everyone who relies on it. Because building great open source software isn’t just about what your project does—it’s about how you protect the people who use it. The new Open Source Guide on Security Best Practices for Your Project will walk you through the basic considerations for software security, including how to: Secure your code as part of your development workflow Avoid unwanted changes with protected branches Set up an intake mechanism for vulnerability reporting Looking to improve security on your project with expertise and community? Apply to the GitHub Secure Open Source Fund.  You don’t have to secure your project alone—we’re here to support you. The GitHub Secure Open Source Fund provides a combination of funding, training sessions with experts, and access to researchers and community to get your project more secure. We’re completely serious, we will give you money ($10K) to improve your security practices!  Apply to the GitHub Secure Open Source Fund > 🔒 Security Challenge: Level up during Maintainer Month Ready to boost your project’s defenses—and your own skills? This May, take the Maintainer Month Security Challenge, which features three hands-on GitHub security skills while allowing you to snag a voucher for GitHub Advanced Security certification (hello, career boost!). In just a few hours, you’ll pick up real techniques to protect your project—and show the world you’re serious about security. Let’s build a safer open source together. Join the Security Challenge > 🔧 How to get involved throughout May and beyond Explore the Partner Pack: maintainermonth.github.com Join the Maintainer Community: maintainers.github.com Want to contribute an offer? Email us at maintainermonth@github.com Share your story: Tag #MaintainerMonth on social media to help us celebrate the humans behind the code! Read more about what’s happening with open source. 1 GitHub. 2022. “Octoverse 2022: The state of open source software.” https://octoverse.github.com/2022/. & OpenUK. 2021. “State of Open: The UK in 2021.” https://openuk.uk/wp-content/uploads/2021/10/openuk-state-of-open_final-version.pdf.  2 Blackduck. 2025. “Six takeaways from the 2025 “Open Source Security and Risk Analysis” report.” https://www.blackduck.com/blog/open-source-trends-ossra-report.html. 3 The Linux Foundation. 2022. “A Summary of Census II: Open Source Software Application Libraries the World Depends On.” https://www.linuxfoundation.org/blog/blog/a-summary-of-census-ii-open-source-software-application-libraries-the-world-depends-on. & Intel. 2025. “The Careful Consumption of Open Source Software.”  https://www.intel.com/content/www/us/en/developer/articles/guide/the-careful-consumption-of-open-source-software.htm.  4 Harvard Business School. 2024. “The Value of Open Source Software.” https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4693148.  The

If you have opened Copilot Chat in VS Code lately and didn’t notice the tiny dropdown hiding at the bottom, you’re not alone. It’s easy to miss, especially when you’re heads down trying to get something shipped. That little menu is where you can switch between ask, edit, and agent modes—three ways you can integrate Copilot into your workflow. But here’s the thing: Each of these modes does something pretty different. And depending on what kind of developer you are, how much context you have, or how much control you’re comfortable giving GitHub Copilot, you might have a very different experience with each one.  I’ve been using all three in different ways, from building apps and testing ideas to playing with frameworks I haven’t touched in a while. I’ve also spent time talking to other developers about what’s working for them.  Below is what I’ve learned so far. This isn’t the manual (for that, look at the VS Code documentation). It’s more of a guide for how to think about these tools, as you navigate where they fit into your own workflow. Ask mode: The quick gut check Ask mode is the simplest of the three—and if you are a long-time user of GitHub Copilot, it might be the only time you’ve thought about bringing up the Chat window.  Here’s how it works: You highlight some code, type a question into Copilot Chat, and it generates an answer. It might explain what the code does, suggest how to test it, give you a code snippet that implements what you are asking about, or remind you how to handle a particular edge case.  Ask mode is fast, helpful, and focused entirely on answering your programming question without touching your code. You can stay in your editor and ask questions that Copilot can answer using all the context of your current editor environment. Think of it like a quiet little whisper in your editor saying, “Hey, here’s what I think this means.” And it’s not just about your code. You can ask it anything related to programming—like how to use a certain library, how to structure a SQL query, and even which search algorithm is more efficient for a given dataset.  Need help styling something with Tailwind? Want a refresher on closures in JavaScript? Curious how to debounce an input in React? Copilot can help with that, too. There’s no project commitment, no architectural decisions, and no code changes. Just answers, right when you need them. It’s the lowest-friction way to get unstuck when a question is standing in the way of you and building what’s next. Edit mode: You’re still in charge, just moving faster Edit mode in VS Code is where things start to get more interesting. It lets you pick any number of files in your project you want to change and describe the update in natural language. Then, Copilot will immediately apply inline, review-ready code edits across those files.  Edit mode is perfect when you know what you want to do but don’t necessarily want to write it all out yourself. You highlight a block of code, type in an instruction—perhaps something like “add error handling” or “refactor this using async/await”—and Copilot rewrites the code for you. But (and this is important) it doesn’t save anything without showing you the diff first. That’s what makes edit mode so reliable. Copilot does the work, but you get the final say. You’re not handing over the reins. You’re speeding things up while staying fully in the loop. You can also bring custom instructions into edit mode if you want to level it up a bit. It’s a way to teach Copilot how you and your team like to write code, including your style preferences, how verbose or concise you want it to be, what your team’s standards are, how formal or casual you want it when it explains things, and even what language you want your comments written in. Setting up those preferences is like giving Copilot a playbook ahead of time—so when you say “clean this up,” it already knows what “clean” actually means to you. I’ve found myself reaching for edit mode when I’m deep in a brownfield app and don’t want to touch the rest of the system, or when I’m just trying to get through a handful of small but annoying improvements with surgical precision. It’s not trying to redesign your architecture. It’s not going to rename things you didn’t ask it to. It’s just here to make the thing you’re working on better and faster, with less mental overhead. Honestly, once you get used to it, it’s hard to go back. Agent mode: A lot of power, when you’re ready for it Now let’s talk about Agent mode. Agent mode lets you hand it a high-level prompt and then watch as Copilot autonomously plans the steps, selects the right files, runs tools or terminal commands, and iterates on code edits until the task is complete. It is by far the most powerful mode in Copilot Chat—and also the newest, which means for a lot of people, it’s still the least familiar. Agent mode can reason across your entire project, take multi-step actions, and hold onto a significant amount of context across a session. You can ask it to build features, fix bugs, create files, clean up routing logic, or even scaffold an entire section of an app based on a single prompt. At first glance, agent mode can look like an expanded version of edit mode—and in some respects, it is. But there’s a crucial distinction: Instead of only rewriting the lines you specify, agent mode analyzes related code, identifies additional changes that may be required, and applies them across the project to keep everything consistent. Another key distinction? Agent mode applies edits automatically rather than waiting for explicit approval, while still surfacing any potentially risky commands for review before they run. The workflow is closer to a continuous-edit “driver” model: The developer defines

Let’s be honest: that flood of security alerts in your inbox can feel completely overwhelming. We’ve been there too. As a developer advocate and a product manager focused on security at GitHub, we’ve seen firsthand how overwhelming it can be to triage vulnerability alerts. Dependabot is fantastic at spotting vulnerabilities, but without a smart way to prioritize them, you might be burning time on minor issues or (worse) missing the critical ones buried in the pile. So, we’ve combined our perspectives—one from the security trenches and one from the developer workflow side—to share how we use Exploit Prediction Scoring System (EPSS) scores and repository properties to transform the chaos into clarity and make informed prioritization decisions. Understanding software supply chain security If you’re building software today, you’re not just writing code—you’re assembling it from countless open source packages. In fact, 96% of modern applications are powered by open source software. With such widespread adoption, open source software has become a prime target for malicious actors looking to exploit vulnerabilities at scale. Attackers continuously probe these projects for weaknesses, contributing to the thousands of Common Vulnerabilities and Exposures (CVEs) reported each year. But not all vulnerabilities carry the same level of risk. The key question becomes not just how to address vulnerabilities, but how to intelligently prioritize them based on your specific application architecture, deployment context, and business needs. Understanding EPSS: probability of exploitation with severity if it happens When it comes to prioritization, many teams still rely solely on severity scores like the Common Vulnerability Scoring System (CVSS). But not all “critical” vulnerabilities are equally likely to be exploited. That’s where EPSS comes in—it tells you the probability that a vulnerability will actually be exploited in the wild within the next 30 days. Think of it this way: CVSS tells you how bad the damage could be if someone broke into your house, while EPSS tells you how likely it is that someone is actually going to try. Both pieces of information are crucial! This approach allows you to focus resources effectively. As security pro Daniel Miessler points out in Efficient Security Principle, “The security baseline of an offering or system faces continuous downward pressure from customer excitement about, or reliance on, the offering in question.” Translation? We’re always balancing security with usability, and we need to be smart about where we focus our limited time and energy. EPSS helps us spot the vulnerabilities with a higher likelihood of exploitation, allowing us to fix the most pressing risks first. Smart prioritization steps 1. Combine EPSS with CVSS One approach is to look at both likelihood (EPSS) and potential impact (CVSS) together. It’s like comparing weather forecasts—you care about both the chance of rain and how severe the storm might be. For example, when prioritizing what to fix first, a vulnerability with: EPSS: 85% (highly likelihood of exploitation) CVSS: 9.8 (critical severity) …should almost always take priority over one with: EPSS: 0.5% (much less likely to be exploited) CVSS: 9.0 (critical severity) Despite both having red-alert CVSS ratings, the first vulnerability is the one keeping us up at night. 2. Leverage repository properties for context-aware prioritization Not all code is created equal when it comes to security risk. Ask yourself: Is this repo public or private? (Public repositories expose vulnerabilities to potential attackers) Does it handle sensitive data like customer info or payments? How often do you deploy? (Frequent deployments face tighter remediation times) One way to provide context-aware prioritization systematically is with custom repository properties, which allow you to add contextual information about your repositories with information such as compliance frameworks, data sensitivity, or project details. By applying these custom properties to your repositories, you create a structured classification system that helps you identify the “repos that matter,” so you can prioritize Dependabot alerts for your production code rather than getting distracted by your totally-not-a-priority test-vulnerabilities-local repo. 3. Establish clear response Service Level Agreements (SLAs) based on risk levels Once you’ve done your homework on both the vulnerability characteristics and your repository context in your organization, you can establish clear timelines for responses that make sense for your organization resources and risk tolerance. Let’s see how this works in real life: Here’s an example risk matrix that combines both EPSS (likelihood of exploitation) and CVSS (severity of impact). EPSS ↓ / CVSS → Low Medium High Low ✅ When convenient ⏳ Next sprint ⚠️ Fix Soon Medium ⏳ Next sprint ⚠️ Fix soon 🔥 Fix soon High ⚠️ Fix Soon 🔥 Fix soon 🚨 Fix first Say you get an alert about a vulnerability in your payment processing library that has both a high EPSS score and high CVSS rating. Red alert! Looking at our matrix, that’s a “Fix first” situation. You’ll probably drop what you’re doing, and put in some quick mitigations while the team works on a proper fix. But what about that low-risk vulnerability in some testing utility that nobody even uses in production? Low EPSS, low CVSS… that can probably wait until “when convenient” within the next few weeks. No need to sound the alarm or pull developers off important feature work. This kind of prioritization just makes sense. Applying the same urgency to every single vulnerability just leads to alert fatigue and wasted resources, and having clear guidelines helps your team know where to focus first. Integration with enterprise governance For enterprise organizations, GitHub’s auto-triage rules help provide consistent management of security alerts at scale across multiple teams and repositories. Auto-triage rules allow you to create custom criteria for automatically handling alerts based on factors like severity, EPSS, scope, package name, CVE, ecosystem, and manifest location. You can create your own custom rules to control how Dependabot auto-dismisses and reopens alerts, so you can focus on the alerts that matter. These rules are particularly powerful because they: Apply to both existing and future alerts. Allow for proactive filtering of false positives. Enable “snooze until patch” functionality for vulnerabilities without a fix available. Provide visibility

The role of agentic AI has grown rapidly over the past several months as organizational leaders seek ways to accelerate AI Transformation. We firmly believe that Agents + Copilot + Human Ambition can deliver real AI differentiation for our customers. By putting the autonomous capabilities of an agent to work for their businesses, our customers are unlocking AI opportunity to realize greater value. The recent introduction of Microsoft 365 Copilot Chat is delivering on our promise of “Copilot for all” by providing frontline workers with a free, secure and enterprise-ready AI chat interface. Our customers are building their own custom agents with the no-code, low-code features of Microsoft Copilot Studio, allowing citizen and professional developers to extend the capabilities of Copilot and deliver on the unique needs of their industry. We also offer the best prebuilt agent framework right out-of-the-box, such as Sales Agent that works autonomously to help sellers build pipeline and close more deals with greater speed. Similarly, we recently announced general purpose reasoning agents — such as Researcher and Analyst — and invite all of our Microsoft 365 Copilot users to try these in their environments. It is exciting to see how agents are driving pragmatic AI innovation for our customers by increasing productivity, creating capacity across every role and function and improving business processes. Below are a few highlights from the past quarter that underscore the impact of an agentic AI approach — from improving employee experiences to streamlined workflows and significant cost savings. Agentic service management software provider Atomicwork leveraged Azure AI Foundry to create Atom — an AI agent that transforms the digital workplace experience for employees and automates service delivery. Adopters of this agentic management platform recognize significant benefits, such as reduced operational costs and increased employee satisfaction, with one customer achieving a 65% deflection rate within six months of implementation and projections of 80% by the end of the year. Integration within Microsoft Teams and other enterprise tools have further streamlined service delivery, allowing employees easier access to information and support. The company’s AI-driven approach has resulted in a 20% increase in accuracy and 75% reduction in response latency when compared to competing solutions. To support employees as they manage the high demand of internal requests and to create a more satisfying work environment, BDO Colombia used Copilot Studio and Power Platform to develop BeTic 2.0 — an agent that centralizes and automates key payroll and finance processes. The agent reduced operational workload by 50%, optimized 78% of internal processes and showed 99.9% accuracy in managed requests. It also helped reduce duplicative work, optimized workflows, improved the employee-client experience and continues to serve as a competitive differentiator for the company in the market. Dow is using agents to automate the shipping invoice analysis process and streamline its global supply chain to unlock new efficiencies and value. Receiving more than 100,000 shipping invoices via PDF each year, Dow built an autonomous agent in Copilot Studio to scan for billing inaccuracies and surface them in a dashboard for employee review. Using Freight Agent — a second agent built in Copilot Studio — employees can investigate further by “dialoguing with the data” in natural language. The agents are helping employees solve the challenge of hidden losses autonomously within minutes rather than weeks or months. Dow expects to save millions of dollars on shipping costs through increased accuracy in logistic rates and billing within the first year. As a leading provider of sustainable energy in Belgium, Eneco serves over 1.5 million customers. Facing performance issues with their existing chatbot, Eneco developed a new AI-driven agent using the no-code, graphical interface in Copilot Studio. This multilingual agent was deployed on the company website in just three months, integrating seamlessly with its live chat platform. The new agent manages 24,000 chats per month — an increase of 140% over the previous solution — and resolves 70% more customer conversations without a handoff to a live representative. For requests that do require escalation, the agent provides an AI-generated summary of the conversation for a more optimized call center experience. To reimagine trend forecasting and consumer marketing, The Estée Lauder Companies Inc. leveraged Copilot Studio to develop ConsumerIQ — an agent that centralizes and streamlines consumer data to enable instant access to actionable insights. Using natural language prompts, the agent reduced the time required for marketers to gather data from hours to seconds, while accelerating decision-making and helping prevent duplicated research. Together with Azure OpenAI Service and Azure AI Search, teams can gather data, identify trends, build marketing assets, inform research and move products to market faster. To create proposals and streamline knowledge retrieval and organization, Fujitsu leveraged Azure AI Agent Service within Azure AI Foundry to develop an intelligent, scalable AI agent for sales automation. The agent boosted productivity of sales teams by 67% while addressing knowledge gaps and allowing them to build stronger customer relationships. This transformation allowed teams to shift from time-intensive tasks to strategic planning and customer relationship building, while also supporting new hires with product information and strategic guidance. To reduce manual tasks and help employees deliver exceptional experiences, global baker Grupo Bimbo established its first ever technology Center of Excellence. Using Power Platform solutions and Copilot Studio, teams created 7,000 power apps, 18,000 processes and 650 agents to reduce busy work and enhance consumer service. By automating low-value tasks, the company saved tens of millions of dollars annually in development efforts and operational efficiencies. Grupo Bimbo also migrated to Azure for its AI capabilities, scalability, security and rapid time to market for apps. KPMG developed Comply AI — an agent that helps identify environment, social and governance compliance. Using Microsoft AI technologies, the agent helps identify relevant obligations, generate statements in natural language, assess control effectiveness and redraft control descriptions. This has already helped one of its customers achieve 70% improvement in Controls and Risks descriptions, an 18-month reduction in compliance program timelines and a 50% cut in ongoing compliance efforts. KPMG is also using

To ensure that you have access to the best technology available, we’re continuously adding support for new models to GitHub Copilot. That being said, we know it can be hard to keep up with so many new models being released all the time. All of this raises an obvious question: Which model should you use? You can read our recent blog post for an overview of the models currently available in Copilot and their strengths, or check out our documentation for a deep dive comparing different models and tasks. But the AI landscape moves quickly. In this article we’ll explore a framework—including a few strategies—for evaluating whether any given AI model is a good fit for your use, even as new models continue to appear at a rapid pace. It’s hard to go wrong with our base model, which has been fine-tuned specifically for programming-related tasks. But depending on what you’re working on, you likely have varying needs and preferences. There’s no single “best” model. Some may favor a more verbose model for chat, while others prefer a terse one, for example. We spoke with several developers about their model selection process. Keep reading to discover how to apply their strategies to your own needs. 💡 Watch the video below for tips on prompt engineering to get the best results. Why use multiple models? There’s no reason you have to pick one model and stick with it. Since you can easily switch between models for both chat and code completion with GitHub Copilot, you can use different models for different use cases. It’s kind of like dogfooding your own stack: You won’t know if it really fits your workflow until you’ve shipped some real code with it. – Anand Chowdhary, FirstQuadrant CTO and co-founder Chat vs. code completion Using one model for chat and another for autocomplete is one of the most common patterns we see among developers. Generally, developers prefer autocompletion models because they’re fast and responsive, which they need if they’re looking for suggestions as they think and type. Developers are more tolerant of latency in chat, when they’re in more of an exploratory state of mind (like considering a complex refactoring job, for instance). Reasoning models for certain programming tasks Reasoning models like OpenAI o1 often respond slower than traditional LLMs such as GPT-4o or Claude Sonnet 3.5. That’s in large part because these models break a prompt down into parts and consider multiple approaches to a problem. That introduces latency in their response times, but makes them more effective at completing complex tasks. Many developers prefer these more deliberative models for particular tasks. For instance, Fatih Kadir Akın, a developer relations manager, uses o1 when starting new projects from scratch. “Reasoning models better ‘understand’ my vision and create more structured projects than non-reasoning models,” he explains. FirstQuadrant CTO and co-founder Anand Chowdhary favors reasoning models for large-scale code refactoring jobs. “A model that rewrites complex backend code without careful reasoning is rarely accurate the first time,” he says. “Seeing the thought process also helps me understand the changes.” When creating technical interview questions for her newsletter, GitHub Senior Director of Developer Advocacy, Cassidy Williams mixes models for certain tasks. When she writes a question, she uses GPT-4o to refine the prose, and then Claude 3.7 Sonnet Thinking to verify code accuracy. “Reasoning models help ensure technical correctness because of their multi-step process,” she says. “If they initially get something wrong, they often correct themselves in later steps so the final answer is more accurate.” There’s some subjectivity, but I compare model output based on the code structure, patterns, comments, and adherence to best practices. – Portilla Edo, cloud infrastructure engineering lead What to look for in a new AI model Let’s say a new model just dropped and you’re ready to try it out. Here are a few things to consider before making it your new go-to. Recentness Different models use different training data. That means one model might have more recent data than another, and therefore might be trained on new versions of the programming languages, frameworks, and libraries you use. “When I’m trying out a new model, one of the first things I do is check how up to date it is,” says Xavier Portilla Edo, a cloud infrastructure engineering lead. He typically does this by creating a project manifest file for the project to see what version numbers Copilot autocomplete suggests. “If the versions are quite old, I’ll move on,” he says. Speed and responsiveness As mentioned, developers tend to tolerate more latency in a chat than in autocomplete. But responsiveness is still important in chat. “I enjoy bouncing ideas off a model and getting feedback,” says Rishab Kumar, a staff developer evangelist at Twilio. “For that type of interaction, I need fast responses so I can stay in the flow.” Accuracy Naturally, you need to evaluate which models produce the best code. “There’s some subjectivity, but I compare model output based on the code structure, patterns, comments, and adherence to best practices,” Portilla Edo says. “I also look at how readable and maintainable the code is—does it follow naming conventions? Is it modular? Are the comments helpful or just restating what the code does? These are all signals of quality that go beyond whether the code simply runs.” How to test an AI model in your workflow OK, so now you know what to look for in a model. But how do you actually evaluate it for responsiveness and correctness? You use it, of course. Start with a simple app Akın will generally start with a simple todo app written in vanilla JavaScript. “I just check the code, and how well it’s structured,” he says. Similarly, Kumar will start with a websocket server in Python. The idea is to start with something that you understand well enough to evaluate, and then layer on more complexity. “Eventually I’ll see if it can build something in 3D using 3js,” Akın says. Portilla Edo

We are entering a new reality — one in which AI can reason and solve problems in remarkable ways. This intelligence on tap will rewrite the rules of business and transform knowledge work as we know it. Like the Industrial Revolution and the internet era, this transformation will take decades to show its full promise — and will bring broad technological, societal and economic change. The 2025 Work Trend Index Annual Report is designed to prepare leaders and employees for this shift. As in previous years, it draws on a large global survey, Microsoft 365 telemetry and LinkedIn hiring and labor trends. New this year are insights from AI-native startups, economists, scientists and academics — all pointing to a seismic shift already underway. In fact, 82% of leaders say this is a pivotal year to rethink core aspects of strategy and operations. The data reveals the emergence of a new kind of organization: the Frontier Firm — built around intelligence on tap, human-agent teams and a new role for everyone: agent boss. While the shift ahead is profound, human ambition, creativity and ingenuity will continue to create new economic value and opportunity. In fact, 71% of workers at these firms say their company is thriving, compared to just 37% globally. You can buy intelligence on tap Imagine if you knew, before the internet took off, just how much it would reshape business. That’s where we are with AI. Intelligence is no longer bound by headcount or expertise. It’s an essential durable good: abundant, affordable and scalable on-demand. As economic and shareholder pressures grow, this on-demand intelligence offers a new lever for growth — one that can close the growing gap between business demands and human capacity. While 53% of leaders say productivity must increase, 80% of the global workforce reports lacking the time or energy to do their job. And on average, employees are interrupted by a meeting, email or ping every 2 minutes. To bridge this Capacity Gap, 82% of leaders expect to use digital labor to expand their workforce in the next 12 to 18 months. Digital labor will spur the reinvention of even the most established firms — and the birth of new companies we haven’t even thought of yet. On LinkedIn, top AI startups are hiring at 2X the rate of Big Tech. Much of that talent is flowing out of Big Tech and staying in the startup world, pointing to a deeper shift where innovation — and opportunity — are rising. As incumbents adapt and challengers scale, like we saw in the .com boom, the rules of talent and competition are being rewritten in real time. Human-agent teams will upend the org chart As AI continues to democratize expertise, we’re seeing a move from rigid org charts to more fluid, outcome-driven Work Charts. These structures flex with the needs of the business, drawing on the right mix of humans and agents to get the job done. While every function will evolve at a different pace and scale, 46% of leaders say their organization is using agents to fully automate workstreams or business processes — with customer service, marketing and product development as the top AI investment priorities. To maximize the impact of these human-agent teams, organizations need a new metric: the human-agent ratio. Leaders must ask two critical questions: How many agents are needed for which roles and tasks? And how many humans are needed to guide them? Getting that ratio right will be critical — and task-specific. Organizations will need to consider if there are times when human and digital labor outperform AI alone, when customers prefer a human touch or when society expects people to be responsible for the consequences — like a high-stakes product or finance decision. Whether it’s a customer conversation, a strategic decision or a product launch, knowing how to staff the right mix of humans and agents will define how work gets done — and how success is measured. Every employee becomes an agent boss As agents increasingly join the workforce, we’ll see the rise of the agent boss: someone who builds, delegates to and manages agents to amplify their impact and take control of their career in the age of AI. From the boardroom to the frontline, every worker will need to think like the CEO of an agent-powered startup. In fact, leaders expect their teams will be training (41%) and managing (36%) agents within five years. For those ready to lean in, AI will be a career accelerator — but leaders are ahead. We measured the agent boss mindset across seven indicators — from regular use and trust to career impact. Leaders outpace employees on every measure: 67% are familiar with agents (vs. 40% of employees) and 79% believe AI will accelerate their careers (vs. 67%). But this shift won’t stop at the top. As agents become embedded into daily work, roles across every level and function will evolve — along with the broader workforce. While 33% of leaders are considering headcount reductions, 78% are considering hiring for new AI roles. And 83% say AI will enable employees to take on more complex and strategic work earlier in their careers. This shift is multifaceted — every industry and role will evolve differently as the technology diffuses across business and society. Just as the internet era created billions of new knowledge jobs — from social media managers to UX designers — the AI era is already giving rise to new roles, with many more to come. Preparing for what’s next is no longer optional. Employees must build AI skills and companies must support them with the right tools and training. This moment calls for honest conversations, intentional communication and real investment in reskilling. The companies that invest now won’t just keep up — they’ll shape what comes next. Copilot is the new UI for AI Today we’re announcing the Microsoft 365 Copilot Wave 2 Spring release — designed to power the next era of human–agent collaboration. The Microsoft 365 Copilot app is now your window into the world of agents, with new capabilities for this next phase — driven by more advanced models, adaptive memory and reasoning agents that work alongside you. Updates include: Researcher and Analyst agents powered by OpenAI’s deep reasoning models rolling