Abstract

Corporate AI use is commonly measured through access, licenses or reported use, but these proxies tell us little about whether firms have embedded AI in the production function. This article argues that the economic value of AI today is increasingly derived from its implementation: its linkage to data, workflows, systems and organizational decision processes. Using recent asset-pricing evidence from the AI Premium literature, the analysis distinguishes nominal access from substantive consumption and explain why intensive, experienced and deeply integrated AI use provides a meaningful market signal. The current pattern is consistent with a temporary deployment bottleneck, but as enterprise tools, integrations, practices and standards emerge, competitive advantage will likely move toward workflow transformation, analytic substitution, validation, decision integration and measurable benefit. AI reduces the cost of machine-produced insights, whereas judgment, validation, structuring the organization and holding people accountable will remain relatively valuable. The future AI premium will thus depend less on owning AI assets and more on converting abundant machine-generated capacity into lower costs, better decisions, improved performance and sustained returns.

1. Introduction - The Gap Between AI Access and Economic Capability

Corporate AI is being measured with a category error. A firm can be described as an AI adopter because employees have access to a general-purpose chatbot, because one business function uses an AI application, because a production process has been redesigned around model outputs or because models have been connected programmatically to internal data and operational systems. These states differ economically even though conventional adoption statistics can place them under the same label. The measurement problem is already visible in official data. Eurostat reported that 19.95 percent of European Union enterprises with at least ten employees used at least one AI technology in 2025.^[1] A narrower comparison of production use found AI in production at about 7 percent of United States firms and 4 percent of European Union firms.^[2] United States survey estimates have ranged much higher when questions encompass any business function or employment-weighted adoption. The Federal Reserve warns that experimental, incidental and economically insignificant use is difficult to separate from meaningful adoption in current statistics.^[3]

That distinction changes how the corporate AI transition should be interpreted. Purchasing access through Copilot, ChatGPT, Claude, Gemini or another service gives an organization an option to use increasingly capable models. The purchase itself doesn't reveal much information about where the models enter production, which data they can reach, whether employees use them repeatedly, whether workflows have changed, who verifies outputs or whether any resulting capacity becomes lower cost, higher output or better decisions. A cross-country survey of more than 5,000 senior executives illustrates the gap. Around 70 percent of surveyed firms reported active AI use, while more than 80 percent reported no effect on productivity or employment during the preceding three years.^[4] The coexistence of widespread reported use and limited realized firm-level impact matches an implementation lag. It also shows why license counts and broad adoption declarations provide weak measures of economic capability.

This paper argues that the present AI premium is best understood as the pricing of exposure to an incomplete organizational transition. Access has become relatively easy. Implementation remains difficult. Value capture remains harder still. Firms have to connect models with data, software and work processes, specify access rights, establish controls, train employees, redesign interfaces, change task allocation, build evaluation routines and persuade workers and managers to rely on new systems where reliance is justified. These investments resemble the complementary intangible capital associated with earlier general-purpose technologies.^[5] Their scarcity during the early diffusion period can make implementation capacity economically significant before the eventual productivity effects are fully visible.

The strongest recent market evidence for this interpretation comes from Nicola Borri, Yukun Liu and Aleh Tsyvinski. Their 2026 research constructs an AI factor from realized consumption recorded by OpenRouter between January 2024 and April 2026. The dataset contains roughly 380 trillion tokens across more than 400 language models and represents approximately 2 percent of current global monthly AI token consumption according to their estimate. The factor combines weekly growth in tokens, expenditure and active users, after which firm-level AI betas are calculated from the comovement of stock returns with innovations in that factor. Firms with higher exposure subsequently earned substantially higher returns. The value-weighted high-minus-low portfolio earned 64.1 basis points per week in the baseline result.^[6]

The result has two meanings that need to be kept separate. The first concerns depth of consumption. The return signal is much stronger when the AI factor is constructed from frontier closed-source models, established paying users, seasoned users and longer prompts. Casual and extensive-margin consumption produces weaker estimates. This supports a distinction between nominal access and economically substantive use. The data measure realized inference rather than corporate licence ownership, so the study cannot establish that buying a Copilot or ChatGPT subscription produces exactly zero market effect. It does establish something more defensible and more useful: variation associated with intensive and sophisticated consumption contains substantially more asset-pricing information than variation associated with new or casual use.^[7]

The second meaning concerns asset pricing. A positive AI premium is an expected-return result. It cannot automatically be converted into a statement that investors assign higher present valuations to AI-exposed firms. The premium is defined as compensation investors require for an additional unit of market-implied AI exposure. In standard finance, a higher required return can accompany stronger expected growth opportunities, greater systematic risk or both. Holding expected cash flows fixed, a higher discount rate reduces present value. Technological revolutions can alter systematic uncertainty precisely because investors are learning which businesses will gain and which will lose as a recent technology diffuses.^[8] The correct language, accordingly, is that markets price exposure to the AI transition. Claims about a mechanical valuation bonus go beyond the evidence.

The early character of the transition is central to interpreting another result. In the occupation and skill mapping, positive market-implied AI exposure is concentrated in skills associated with installation, repair, programming, persuasion, instruction and systems-oriented work.^[9] Analytical, scientific and operations-control skills are associated with more negative exposure.^[10] This does not establish a permanent hierarchy in which installation remains more valuable than analysis. It may describe a particular phase of diffusion. Systems still need to be built, connected and accepted before massive quantities of analytical work can be shifted onto them. Implementation specialists, managers capable of changing workflows, employees able to coordinate adoption and workers able to resolve the institutional frictions of deployment are temporarily complementary to diffusion. Once deployment becomes routine, that complementarity can weaken.

The argument developed here extends the market result through time. During the present phase, implementation removes a deployment constraint. That creates productive capacity. Productive capacity eventually must become output. As APIs, model-routing systems, security practices, enterprise connectors and implementation expertise become more standardized, the scarcity value of basic deployment should fall. Competitive differentiation should migrate toward the quality of use: which tasks are delegated, how model output is evaluated, how decisions are changed, how workflows are redesigned and how much expensive professional work can be performed at lower marginal cost. The long-run corporate AI question is accordingly different from the current one. In the present phase, investors need to identify firms capable of crossing the implementation bottleneck. In the mature phase, they will need to identify firms capable of converting abundant machine-generated analysis into organizational action and cash flow.

2. What Markets Are Pricing in the AI Transition

2.1 The Baseline Result and the Intensive Margin

The analysis makes an unusually useful contribution because its central explanatory variable is realized model consumption. OpenRouter connects users and developers to hundreds of models through one API endpoint and the dataset records paid inference requests rather than survey answers about whether a company claims to use AI.^[11] The records are aggregated into growth in token volume, dollar expenditure and distinct users. This provides a high-frequency measure of changes in AI consumption intensity. It also imposes an interpretive boundary. OpenRouter represents only a fraction of global inference and its API-oriented ecosystem can capture sophisticated users differently from consumer-facing applications. The study should be read as an unusually rich measure of one segment of realized AI consumption rather than a census of enterprise deployment.

The composition of realized consumption offers a complementary view of what the AI factor is measuring. Categorized OpenRouter tokens in the final sample week are concentrated in programming and technology-related prompts, which together account for more than three-fifths of categorized volume, while roleplay and science follow at a considerable distance and consumer-facing categories such as marketing, translation and trivia remain marginal. This concentration is consistent with the intensive-margin results reported below: the factor draws disproportionately on technical, production-oriented use rather than diffuse consumer experimentation.

2.2 The Baseline Result and Its Robustness

The baseline market result is economically substantial. Firms are sorted according to rolling AI betas estimated from thirteen weeks of return data, with market returns included in the first-stage regression. The value-weighted spread between the high and low AI-beta portfolios is 64.1 basis points per week. The result survives controls designed to separate the AI factor from technology-sector exposure, semiconductor returns, AI-themed exchange-traded funds, industry effects and public attention measured through search interest. Industry-demeaned exposure generates a high-minus-low spread of 60.3 basis points per week in one principal specification, close to the baseline estimate. The finding appears, as a result, to capture something beyond a simple technology-stock rally.^[12]

Its most relevant finding for corporate strategy comes from the decomposition of the consumption factor. Exposure based on closed-source model consumption produces a high-minus-low return spread of 53.4 basis points per week, compared with 32.3 basis points for open-weight consumption. The associated statistics are 2.47 and 1.76. Model category alone should not be treated as a permanent indicator of quality. The economic content is narrower. During this sample, consumption closer to the frontier carried a clearer market signal.^[13] One plausible interpretation is that frontier consumption contained more information about commercially relevant capability, demanding applications and proximity to the technological frontier. User characteristics strengthen the same conclusion. The weekly high-minus-low spread is 66.8 basis points when the factor is based on paid or core accounts and 21.9 basis points for new accounts. It is 59.3 basis points for seasoned users and 29.3 for non-seasoned users. Long-prompt consumption generates a 54.1 basis-point spread compared with 33.0 for short prompts. These estimates do not reveal exactly what any corporate user was doing. They establish a consistent pattern across several proxies: the market signal strengthens as observed consumption moves from entry toward repeated, experienced and complex use.^[14]

That pattern provides a better empirical foundation for criticizing superficial corporate AI claims than a categorical assertion about subscriptions. A company may purchase thousands of seats and later build a valuable deployment around them. Another may purchase the same number and see usage decay after an initial trial. A third may achieve significant effects through a small number of heavily used API integrations. Seat counts cannot distinguish among these cases. Registered user counts have the same weakness because registration records the extensive margin. The Borri evidence gives considerably more weight to the intensive margin. Experienced users, continued consumption and complex requests appear to contain information that initial access does not.

The distinction also explains why a generalized label such as AI company is analytically weak. The AI factor identifies positive and negative exposures across industries rather than reproducing the technology-sector classification. The market-return relationship remains when broad industry effects are removed. Around nineteen frontier-model release events, the high AI-beta portfolio outperformed the low AI-beta portfolio by 1.9 percent over a five-trading-day window in the study's event analysis. Yet the positive spread also persists after release weeks are excluded, which means the effect is not confined to short bursts of model-release enthusiasm.^[15]

Geography supplies another clue. The high-minus-low spread in developed markets is 17.9 basis points per week, with a statistic of 2.77, while the corresponding emerging-market estimate is 5.0 basis points and statistically indistinguishable from zero in the reported specification. This difference fits the idea that market pricing is strongest where firms, investors, infrastructure and production systems are closer to frontier development and commercial deployment. It does not prove that developed-market firms are inherently better adopters. It identifies where the transition factor had stronger pricing relevance during the sample.^[16]

2.3 Nominal Adoption, Disclosure and Occupational Exposure

Nominal adoption measures appear especially weak when compared across surveys. In the United States, the Census Business Trends and Outlook Survey measured roughly 18 percent of firms using AI at the end of 2025 after its question broadened to any business function. The employment-weighted Survey of Business Uncertainty produced a much higher figure of around 78 percent, while an individual worker survey found work-related generative AI use at about 41 percent. The Federal Reserve attributes much of this dispersion to differences in units of analysis, weighting and question wording and explicitly identifies the difficulty of separating experimental use from economically meaningful adoption.^[17] The implication for asset pricing is immediate. Any factor built from a binary adoption variable risks combining firms that occupy quite various positions in the deployment process.

This is also why announcements have limited informational content. A statement that a firm has launched an AI strategy may describe budget allocation, an experimental program, a procurement decision or a completed production redesign. Regulatory filings can contain genuine information but mention counts alone cannot distinguish between those states. The disclosure test is valuable because it finds that the consumption-based signal survives the inclusion of portfolios formed from AI mentions in regulatory filings. Corporate rhetoric and realized consumption exposure should not be used interchangeably.

The deeper lesson is that adoption should be decomposed. Access measures whether a firm can use AI. Consumption intensity measures whether people or systems use it. Implementation measures whether models are connected to organizational processes. Process redesign measures whether the allocation of work changes. Value capture measures whether those changes appear in costs, output, quality, innovation, working capital, decision speed or some other economically relevant outcome. The present evidence is strongest on the gap between the first two categories. It is increasingly suggestive on implementation. Firm-level causal evidence on the complete chain from model integration to realized profits remains much thinner.

The occupational skill mapping is especially relevant to implementation. Installation and repair, programming, persuasion, instruction and systems integration appear toward the positive side of the skill exposure ranking, while science and operations-control skills appear toward the negative side. The variable records skill content. It does not observe an enterprise connecting a model API to a customer database or redesigning an approval system. The pattern provides suggestive evidence for an implementation-complementarity interpretation rather than a causal estimate of the return on installing AI.^[19] That distinction matters. Treating the figure as proof that technical deployment automatically raises firm value would reproduce the same measurement error that the intensive-margin results help correct.

3. Why Implementation Carries the Strongest Signal Today

3.1 Implementation as Organizational Capital

Implementation is the organizational layer between access and production. Its economic significance comes from the fact that a general-purpose model arrives without the firm-specific information, permissions, process rules, interfaces and decision rights required to operate inside a particular business. A subscription can deliver a powerful model to an employee. A production system requires the model to receive the right information at the right time, produce outputs in a usable form, route those outputs to the appropriate worker or software process, expose failures to review and preserve responsibility for consequential decisions. These are complementary investments in technology rather than properties of the model itself.

Productivity literature provides a useful historical analog. The productivity J-curve describes how general-purpose technologies require substantial complementary intangible investment before the resulting productivity gains are fully measured. Organizational redesign, new processes and accumulated knowledge can initially appear as costs while the productive asset is being constructed. Benefits arrive later when the complementary capital becomes usable at scale. Their framework predates the present generative AI diffusion but its logic fits the current implementation problem closely.^[20] The model endpoint can be purchased immediately. The surrounding organization cannot.

Contemporary firm evidence shows that this surrounding capacity is scarce. The OECD's examination of AI adoption in firms identifies specialized skills and data maturity as barriers to uptake and implementation. Businesses surveyed for the report valued industry-specific training and practical work with relevant systems and datasets. Public institutions that assist digital diffusion also identified uncertainty about return on investment and inadequate data maturity as recurrent obstacles. Implementation capacity therefore includes technical competence, data organization and managerial ability to identify a production case with sufficient economic value.^[21]

European data reveal a large firm-size gradient consistent with fixed implementation costs. In 2025, 55.03 percent of large European Union enterprises reported using at least one AI technology, compared with 30.36 percent of medium enterprises and 17 percent of small enterprises. Eurostat explicitly identifies implementation complexity, scale economies and affordability as possible contributors to this pattern. Among enterprises that had considered using AI but had not done so, lack of relevant expertise has been reported as a major constraint in the underlying European statistics. The economic implication is that access to a model does little to remove complementarities involving data, systems and organizational expertise.^[22]

This creates an implementation bottleneck with several layers. Data must be available in formats that can be retrieved or passed to models. Identity and access rules must limit exposure of sensitive information. Applications require connectors, APIs or other interfaces. Outputs need evaluation criteria. Employees need to know when to delegate a task, when to verify a response and when to escalate it. Managers must identify an owner for the process and define accountability when a model contributes to an outcome. These activities consume time and managerial attention. Their costs are especially visible before large-scale value capture begins.

Implementation therefore resembles installation capital. The concept should be used cautiously because much of the investment is intangible. The asset consists partly of software and technical configuration, partly of redesigned processes, partly of accumulated employee experience and partly of institutional knowledge about where the model succeeds and fails. A functioning production deployment can contain all four. The value of that capital lies in removing a constraint on later production. It creates the capacity to use models consistently on a scale.^[23] It cannot guarantee profitable output.

3.2 Evidence From Field Experiments on Implementation

This distinction resolves an apparent tension in the market evidence. Why should installation, systems integration, communication and persuasion appear positively exposed to the AI factor when analytical skills appear negatively exposed? At an early diffusion stage, the scarce input is frequently the ability to place AI inside an organization. Once models are available as external services, model access can expand far faster than firms can redesign data systems and work processes. The marginal economic contribution of implementation skill can rise during that interval because implementation determines whether cheap model capability can enter production. The occupational evidence is consistent with this mechanism, although it does not establish a causal relationship.^[24]

The distinction between productive capacity and productive output is also necessary because AI experiments show highly heterogeneous effects across tasks. Brynjolfsson, Li and Raymond studied 5,172 customer-support agents and found that AI assistance increased issues resolved per hour by 15 percent on average.^[25] The gains were concentrated among less experienced and lower-skilled workers, while experienced workers experienced smaller gains and some quality deterioration. This is a genuine productivity effect in a well-defineda production environment. The system supplied recommendations closely matched to a specific workflow and the organization could measure output. The result shows what implementation can enable once model assistance is tied to a task with observable performance.

Evidence from experienced software developers makes the limitation concrete. A 2025 randomized trial conducted by METR with experienced open-source developers working on repositories they knew well found that participants using then-current AI tools took 19 percent longer on the studied tasks.^[26] The narrowness of the sample and identify several reasons their finding can coexist with strong benchmark performance and positive evidence elsewhere, including implicit project requirements, high-quality standards and differences between benchmark tasks and ordinary development work. The lesson for firms is neither that coding assistants fail nor that benchmarks are useless. The relevant lesson is that a capability demonstrated in isolation can impose coordination and verification costs when inserted into a demanding production setting.

Implementation is the process through which those hidden costs become visible. A firm can discover that drafting time falls while review time rises. A model can accelerate an analyst while increasing the burden on a senior employee responsible for verification. Automated customer communication can reduce labor input while creating new exception-handling work. Code generation can become cheaper while testing requirements increase. These outcomes can all occur alongside technically successful adoption. Productivity appears only after the entire process is measured rather than the model interaction alone.

The Microsoft Copilot field experiment illustrates the same principle from the other direction. Integration inside existing email, meeting and document applications reduced an important source of friction. Users did not have to move information manually into a separate chatbot for every task. The experiment found meaningful time-use changes among actual users, especially lower email time. It did not observe direct performance or firm-level productivity and broader task composition changed little. The result occupies a middle stage between access and full production redesign. Integration changes the cost of using AI, while economic value still depends on what employees do with saved time.^[27]

The organizational effects can become larger when AI changes coordination itself. A field experiment at Procter and Gamble examined individuals and teams solving product-development problems. AI-enabled individuals and AI-enabled teams improved solution quality and individual users could achieve performance comparable with traditional two-person teams in the setting studied. The experiment also found more balanced solutions across commercial and technical domains, suggesting that AI can transmit some knowledge across professional boundaries. This provides a direct counterargument to a purely substitution-based account. AI can complement human work by reducing the cost of accessing expertise and coordinating knowledge. The same mechanism can alter organizational design if firms redesign teams around the new capability.^[28]

A better internal measurement architecture would separate access from active use, active use from integration and integration from realized output. Firms need baseline measurements before deployment so that changes in labor time, cycle time, errors, rework, customer outcomes and unit costs can be compared with a pre-AI process. Usage measures need enough granularity to identify task classes rather than counting registered accounts. Integrated workflows need defined owners and review rules. Management then gains a way to stop low-value deployments rather than preserving them because they satisfy an AI adoption target.

Implementation should be treated as a transitional organizational complement. Its current scarcity can produce strong market relevance because much corporate AI activity remains between experimentation and production. The scarcity will erode. APIs, enterprise model gateways, retrieval systems, evaluation software and implementation practices are becoming easier to buy or reproduce. The strategic question then moves downstream. Once many firms can install comparable systems, installation itself ceases to separate leaders from followers. What the organization makes those systems do becomes decisive.

4. From Deployment to Analytical Substitution and Value Capture

The transition can be understood as a sequence of six organizational states: access, installation, substantive adoption, process redesign, analytical substitution and value capture. These states are an analytical synthesis rather than an empirically validated maturity model. Their purpose is to separate mechanisms that are routinely compressed into the single word adoption. A firm can advance unevenly and different business units can occupy different states at the same time. The sequence still clarifies why current market signals can differ from those likely to matter after deployment becomes common.

4.1 From Access to Process Redesign

Access is the cheapest stage. The organization purchases licenses, approves external tools or makes a model available through an existing software suite. Access matters because employees cannot experiment with prohibited or unavailable technology. Yet it creates little information about expected cash flows without evidence of use. The major differences among official adoption measures already show how easily access and occasional use can inflate headline diffusion. Seat ownership is therefore comparable to installed optionality. It gives the firm a chance to learn. Its financial significance depends on whether the option is exercised productively.

Installation follows when the organization begins connecting models with systems, data and workflows. This is the current bottleneck emphasized by the market interpretation developed here. The OpenRouter study does not directly observe corporate installation projects, yet its intensive-margin findings, its early evidence on tool-using model activity and its positive exposure among systems-oriented skills are consistent with a market in which deeper operational use carries more information than casual consumption. Agentic requests invoking external tools rose from almost zero in 2024 to roughly half of token consumption by the end of their sample, while estimates of separate agentic premiums remained imprecise because this activity was very new.^[29]

The transition toward APIs and tool use matters because programmatic integration changes the division of labor between person and model. Anthropic's September 2025 Economic Index provides provider-specific evidence from Claude usage. In its sample, 77 percent of first-party API transcripts were classified as automation patterns, compared with 12 percent classified as augmentation. Across tasks, 97 percent of tasks represented in API traffic showed automation-dominant patterns, compared with 47 percent in the sampled Claude.ai interactions.^[30] These figures cannot be generalized to the entire AI economy because they concern one provider and one classification method. They still demonstrate a mechanism: API deployment can move AI from an interactive assistant toward a component that performs work inside a larger software process.

Substantive adoption comes after installation when use becomes consistent enough to change the ordinary production process. This stage is frequently slower than procurement because employees have to decide when AI is worth using and managers have to tolerate temporary experimentation. The Copilot experiment is instructive. More than 90 percent of treated workers tried the tool at least once,^[31] while stabilized weekly use after the initial period remained just under 40 percent of treated workers. A corporate dashboard built around the ever-used metric would describe near-universal adoption in that group. A dashboard built around repeated weekly usage would report a vastly different state.

Process redesign begins when firms change task allocation and decision rights around AI capability. This is the point at which implementation can start to alter organizational productivity structurally. A model that saves an analyst forty minutes while every downstream approval remains unchanged creates a local efficiency gain. A redesigned process can remove a handoff, change staffing ratios, shorten a decision cycle or allow one team to handle a larger workload. The distinction between individual and firm productivity is becoming important here. Time saved by employees is economically valuable only if the organization reallocates it, converts it to additional output or changes the resource requirement for a process.

The implication for market pricing is that implementation can command a temporary premium while process redesign remains scarce. Investors observing a firm that repeatedly converts technical capability into changed production may rationally treat its return exposure differently from that of a firm buying the same underlying model through a subscription. The source of differentiation lies in complementary organizational capital. Once common software products automate much of integration, the price of that complement should decline. Firms will then be compared to what their redesigned processes accomplish.

Analytical substitution becomes increasingly important at that stage. Generative models have unusually direct applicability to knowledge tasks because they can produce text, code, classification, synthesis and structured recommendations at low marginal cost. The Borri skill mapping places nonroutine analytical and mathematical content on the negative side of market-implied AI exposure while interactive and social content is positive.^[32] The result is consistent with a shift in relative scarcity. When the cost of producing a preliminary analysis falls, ownership of generic analytical production capacity becomes less distinctive. The valuable activities move toward determining which analysis deserves trust, choosing an action, integrating the decision with organizational constraints and accepting responsibility for the consequences.

This does not imply the disappearance of analysts. Task-based theories of technological change distinguish occupations from tasks because automation can substitute for parts of a job while leaving other parts complementary to new technology.^[33] A financial analyst may delegate data extraction, scenario generation and first-draft commentary while devoting more effort to model selection, assumptions, client communication and accountability. A lawyer may reduce the time spent producing standard research while increasing review of sources and strategic interpretation. An engineer may obtain generated calculations while retaining responsibility for specification, safety and sign-off. The labor effect depends on whether the time saved creates additional demand for higher-level work or reduces the number of workers required to produce a given quantity of service.

The customer support evidence demonstrates one path toward democratized expertise. Less experienced workers obtained larger benefits from AI assistance, which is consistent with models transmitting patterns previously embodied in experienced workers.^[34] The cybernetic-teammate experiment points in the same direction by showing that AI could help individuals integrate knowledge across professional domains.^[35] These effects can raise productivity and reduce inequality in access to expertise inside firms. They can also reduce the scarcity rents associated with routine professional knowledge. The same mechanism that makes a junior employee more capable can weaken the economic value of selling standardized analysis at a high price.

The resulting competitive shift is subtle. Analytical capability becomes more widely available as model quality rises and inference costs fall. Advantage then depends increasingly on evaluation and execution. Producing an analysis becomes cheap relative to knowing which inputs matter, recognizing an invalid inference, reconciling the output with proprietary context and changing an organization in response. A company with superior internal data can obtain more useful analysis from the same general-purpose model. A company with clearer decision rights can act on reliable output faster. A company with strong evaluation systems can delegate a larger share of work without accepting unacceptable error rates. These complements determine whether abundant analytical production becomes economic value.

4.2 Governance, Value Capture and Strategic Implications

This creates a governance problem that differs from ordinary software automation. Deterministic software generally executes specified rules repeatedly. Generative systems can produce plausible outputs whose reliability varies with task, context and model. When their outputs feed decisions, firms need a rational allocation of human review. Universal human checking can eliminate much of the cost advantage. Minimal checking can accumulate operational risk. Efficient implementation therefore requires calibrated delegation, where the intensity of review reflects error cost, model reliability and reversibility of the decision.

Responsibility cannot be outsourced along with analysis. A model can recommend a credit decision, identify a contractual risk, produce a financial forecast or suggest a maintenance action. The organization still determines whether the recommendation is accepted and who owns the consequence. This is why human complementary skills remain valuable even as analytical generation becomes substitutable. Persuasion, coordination and judgment concern institutional action. Models can contribute to all three but organizations allocate authority through people, processes and legal structures.

As these controls mature, the transition reaches value capture. At this stage, the relevant question is whether the organization converts AI capacity into cash-flow-relevant outcomes. The measures vary by business. Labor-intensive service firms can examine cost per completed case, staffing requirements and throughput. Manufacturers can examine downtime, defects and inventory decisions. Financial firms can measure review time, false positives, customer acquisition costs and losses arising from poor decisions. Software firms can compare development cycle time with defects and maintenance burden. Management should be able to explain the channel through which AI changes an economic quantity.

This is the point at which the present installation emphasis should recede. Installation expertise currently has scarcity value because many firms are still building the basic organizational complement. Standardization will reduce that scarcity. Common enterprise platforms will make secure model route easier. Employees will arrive with more experience. Vendors will package connectors, evaluations and workflow tooling. Organizations will accumulate reusable deployment patterns. The frontier of competition will then move from whether models are connected to how effectively the resulting analytical abundance is exploited.

The future analytical premium is therefore unlikely to belong simply to organizations employing the greatest number of analysts or buying the largest number of model licenses. Firms that can substitute machine analysis for expensive professional time while preserving decision quality can realize cost advantages. Firms that use the same analytical abundance to make faster or better decisions can realize revenue, risk or capital-allocation advantages. Firms that generate enormous volumes of analysis without reliable evaluation may accumulate noise rather than capability.

For workers, the transition changes the composition of valuable expertise. Implementation specialists can command a premium while deployment knowledge is scarce. Their relative scarcity should decline as practices standardize. Domain experts who can verify model output remain important because responsibility and error detection cannot be inferred from generation speed. Workers whose role consists largely of producing standardized analytical artifacts face greater substitution pressure as models improve. Employees who combine domain understanding with the ability to redesign processes, coordinate across organizational boundaries and decide when machine output is dependable occupy a more complementary position.

The temporal sequence also provides a way to reconcile the positive market exposure of interactive skills with the negative exposure of analytical content. The current complement is associated with getting AI into the organization. The prospective substitution occurs after integration makes analytical production scalable. These forces can operate at the same time in different tasks. A consulting firm may require more systems architects and change managers during deployment while gradually reducing hours spent producing standardized research. A bank may expand AI governance and integration functions while automating portions of document review and reporting. There is no reason to expect every occupational effect to move in the same direction.

Investors face the same temporal problem. Current AI exposure metrics need to identify firms crossing the deployment bottleneck. Future metrics will need to identify value capture. License counts should give way to measures such as the complexity of tasks performed through models, depth of workflow integration, share of targeted analytical work conducted with AI, professional-labor cost reductions, changes in cycle time, error-adjusted output and changes in decision quality. Each metric should be tied to an economic mechanism. A percentage of employees using AI is meaningful only when the relevant production consequence is specified.

Governments also need to recognize a distributional consequence of the implementation bottleneck. Large enterprises can spread fixed costs of data engineering, security, legal review and change management across larger operations. Small firms may receive similar model capability from the same external provider while lacking the complementary capital needed to integrate it. Eurostat's sharp size gradient and OECD evidence on skills and data maturity support that concern.^{[36, 37]} Public intervention is most defensible where it lowers shared implementation barriers through training tied to real production problems, interoperable standards, access to high-quality public data and institutions that help smaller firms assess viable use cases. Subsidizing undifferentiated subscriptions would target the least scarce part of the production stack.

The strongest argument for optimism remains intact. AI can raise measurable task productivity, broaden access to expertise, reduce time spent on routine communication and help individuals perform work that previously required more experienced colleagues or larger teams. The evidence from customer support, consulting, Copilot and collaborative product development establishes that these mechanisms are real in specific settings.^{[38, 39, 40 ,41]} The qualification is organizational. Task-level gains become durable corporate returns only when firms place them inside production systems that capture saved resources or improve outcomes.

The long-run AI premium should migrate. During installation, markets can price exposure to firms and skills complementary to deployment.^[42] As deployment becomes common, differentiation shifts toward sophisticated consumption and process redesign. As analytical tasks become cheaper, rents can move away from standardized analytical production. Value ultimately accrues where organizations translate model capability into reduced resource requirements, faster high-quality decisions, new products or superior coordination. The precise path will differ by industry and asset prices will continue to incorporate both opportunity and risk. The direction of measurement is clearer: access metrics should become less important as the technology diffuses, while operational and economic outcome metrics should become more important.

5. Conclusion - The Long-Term Meaning of the AI Premium

The central asset-pricing conclusion is narrower and stronger than the claim that markets give an automatic valuation bonus to firms using AI. The observed AI premium is a positive expected-return relationship associated with market-implied exposure to innovations in realized AI consumption. A higher expected return can compensate investors for systematic transition risk. Present valuation depends simultaneously on expected future cash flows and the rate at which those cash flows are discounted. Within that discipline, the evidence distinguishes meaningful exposure from corporate AI rhetoric. Sophisticated, repeated and frontier-oriented consumption carries the clearer market signal. Corporate mention counts do not explain that signal well. The current positive exposure of installation, system-oriented and interactive skills is in line with an economy still building the complementary organizational capital required to place AI inside production.

That condition is temporary. Installation removes a deployment constraint. Durable return requires value capture. As basic implementation becomes standardized, investors will need to place greater weight on task complexity, workflow penetration, analytical substitution, professional-labor savings, decision speed, decision quality and measurable changes in operating performance. License counts and registered-user totals will progressively lose information because access itself is becoming ordinary. The strategic implication follows directly. Firms outside the frontier-model race can still acquire economically meaningful AI exposure by integrating models deeply enough to change production. Their longer-run differentiation will depend on the quality of that use after integration becomes common. Markets are beginning to price the transition. The eventual winners will be identified by what the installed capacity produces.

References

[1, 22, 40] Eurostat. 2026. The Use of Artificial Intelligence Technologies in the European Union: Key Results, 2026 Edition. Luxembourg: Publications Office of the European Union. Eurostat reports AI use by about 20% of EU enterprises in 2025 and a substantial size gradient.

[2, 23] Bick, A., Blandin, A., Deming, D.J., Fuchs-Schündeln, N. and Jessen, J. 2026. Mind the Gap: AI Adoption in Europe and the U.S. NBER Working Paper 34995. Cambridge, MA: National Bureau of Economic Research.

[3, 17] Allen, J.S. 2026. ‘Monitoring AI Adoption in the U.S. Economy’, FEDS Notes, 3 April. Washington, DC: Board of Governors of the Federal Reserve System.

[4] Yotzov, I., Barrero, J.M., Bloom, N., Bunn, P., Davis, S.J., Foster, K.M., Jalca, A., Meyer, B.H., Mizen, P., Navarrete, M.A., Smietanka, P., Thwaites, G. and Wang, B.Z. 2026. Firm Data on AI. NBER Working Paper 34836. Cambridge, MA: National Bureau of Economic Research.

[5, 20] Brynjolfsson, E., Rock, D. and Syverson, C. 2021. ‘The Productivity J-Curve: How Intangibles Complement General Purpose Technologies’, American Economic Journal: Macroeconomics, 13, 1, pp. 333–372.

[6, 7, 9, 12, 13, 14, 15, 16, 31] Borri, N., Liu, Y. and Tsyvinski, A. 2026. AI Premium. NBER Working Paper 35451. Cambridge, MA: National Bureau of Economic Research. The study uses 380 trillion tokens across more than 400 models and reports the 64.1-basis-point baseline spread and stronger pricing on intensive consumption.

[8] Pástor, Ľ. and Veronesi, P. 2009. ‘Technological Revolutions and Stock Prices’, American Economic Review, 99, 4, pp. 1451–1483.

[10, 19] Borri, N., Liu, Y. and Tsyvinski, A. 2026. ‘The AI Premium’, VoxEU, Centre for Economic Policy Research, 29 July. Use this for the public-facing occupational and skill interpretation rather than repeatedly citing the underlying working paper.

[11] OpenRouter. 2026. Models: One API for Hundreds of Models. OpenRouter Developer Documentation. The platform currently documents access to 400-plus models through a unified API.

[18, 28, 33] Dillon, E.W., Jaffe, S., Immorlica, N. and Stanton, C.T. 2025. Shifting Work Patterns with Generative AI. NBER Working Paper 33795. Cambridge, MA: National Bureau of Economic Research.

[21, 30, 41] OECD, Boston Consulting Group and INSEAD. 2025. The Adoption of Artificial Intelligence in Firms: New Evidence for Policymaking. Paris: OECD Publishing.

[24] Brynjolfsson, E. and Hitt, L.M. 2000. ‘Beyond Computation: Information Technology, Organizational Transformation and Business Performance’, Journal of Economic Perspectives, 14, 4, pp. 23–48.

[25, 35, 42] Brynjolfsson, E., Li, D. and Raymond, L.R. 2025. ‘Generative AI at Work’, Quarterly Journal of Economics, 140, 2, pp. 889–942. The published article studies 5,172 customer-support agents and reports a 15% average productivity increase.

[26] Dell’Acqua, F., McFowland III, E., Mollick, E., Lifshitz-Assaf, H., Kellogg, K.C., Rajendran, S., Krayer, L., Candelon, F. and Lakhani, K.R. 2023. Navigating the Jagged Technological Frontier: Field Experimental Evidence of the Effects of AI on Knowledge Worker Productivity and Quality. Harvard Business School Working Paper 24-013.

[27, 37] Becker, J., Rush, N., Barnes, B. and Rein, D. 2025. Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity. METR. The randomized study reports a 19% slowdown in its specific experienced-developer setting.

[29, 36] Dell’Acqua, F., Ayoubi, C., Lifshitz, H., Sadun, R., Mollick, E., Mollick, L., Han, Y., Goldman, J., Nair, H., Taub, S. and Lakhani, K.R. 2025. The Cybernetic Teammate: A Field Experiment on Generative AI Reshaping Teamwork and Expertise. NBER Working Paper 33641. Cambridge, MA: National Bureau of Economic Research.

[32, 38] Anthropic. 2025. Anthropic Economic Index Report: Uneven Geographic and Enterprise AI Adoption. Anthropic, September. The report distinguishes enterprise API use from Claude.ai use and documents strongly automation-oriented API activity.

[34] Acemoglu, D. and Restrepo, P. 2019. ‘Automation and New Tasks: How Technology Displaces and Reinstates Labor’, Journal of Economic Perspectives, 33, 2, pp. 3–30.

[39] Anthropic. 2026. Anthropic Economic Index Report: Economic Primitives. Anthropic, 15 January.

Abstract

Recent agentic cyber incidents have prompted fresh calls for stricter controls on frontier AI models. The paper argues that these incidents are more accurately seen as stress tests of weak digital infrastructure than as proof that AI has become an independent cyber adversary. Agentic systems make it cheaper to conduct econnaissance, exploit development and large-scale execution. Most recorded harm, however, still depends on familiar weaknesses, including unpatched software, excessive permissions, poor identity controls and limited runtime monitoring. Using evidence on security debt, time-to-exploit, dwell time, supply-chain exposure and workforce shortages the paper shows that AI mainly shortens the interval between vulnerability and loss. It also considers the balance between offensive and defensive uses of security knowledge. The same knowledge that strengthens automated attacks can also improve detection, testing and response. The policy lesson is that pre-market model licensing is poorly matched to where recent failures occur. Regulation should focus more directly on deployment conditions, including least-privilege access, agent identity, auditable logs, human approval for irreversible actions, vulnerability reporting and liability for negligent deployment. The main risk is not machine superintelligence but weak execution inside organizations that have deferred basic security work.

1. Introduction - From AI Panic to Security Debt

In November 2025, Anthropic disclosed that a Chinese state-sponsored group had repurposed its Claude models into the operational core of an espionage campaign, using jailbreaking techniques to frame the system as a legitimate security tool and letting it carry out an estimated 80 to 90 percent of the intrusion process, from reconnaissance to data exfiltration, largely on its own.^[1] Five months later the same company declined to release its newest frontier model, Claude Mythos Preview, to the general public, citing independent testing showing it could solve expert-level capture-the-flag challenges roughly three-quarters of the time and complete a thirty-two-step simulated network intrusion from start to finish.^[2] Commentary since has tended toward one of two poles. Either these episodes are treated as early proof that autonomous software has crossed into a qualitatively new category of threat actor, a development serious enough to justify pre-market licensing of frontier models, mandatory government audits and a designated regulatory body empowered to approve or withhold access to new AI systems before they reach the public.^[3] Or they are waved away as overblown, the predictable noise that accompanies any powerful new technology.

Both responses miss the point. The more useful question is not whether AI agents have become independently dangerous but why so many of the systems these agents attacked remained exploitable at all. The Moltbook episode is instructive on this point. In January 2026, a social platform built exclusively for autonomous AI agents attracted more than 1.5 million agent accounts within days of launch and shortly afterward a misconfigured database exposed 1.5 million API authentication tokens along with tens of thousands of email addresses and private agent communications.^[4] The failure was not that the agents were too clever. It was that a database had been left open the same kind of lapse that has embarrassed conventional web platforms for two decades. What made the incident unusual was not the vulnerability itself but the scale at which it propagated, since roughly 17,000 human operators were found to be running an average of nearly ninety agents apiece, a ratio that turns an ordinary configuration error into a mass exposure event almost instantly.^[5]

This paper argues that the recent wave of agentic cyberattacks is best understood not as evidence that artificial intelligence has become an independently superhuman adversary but as a forced audit of a global IT base that had already accumulated years of unaddressed security debt. Veracode's most recent State of Software Security report found that 82 percent of organizations now carry measurable security debt defined as high-severity flaws left unremediated and that 60 percent of those organizations carry debt severe enough to be classified as critical.^[6]Average fix times for known flaws have grown from 171 days to 252 days over five years, an increase of 47 percent.^[7]These are not numbers produced by AI. They describe a pre-existing condition, an accumulated stock of exploitable weakness that predates the deployment of a single autonomous agent. What AI has done is compress the time it takes to locate and weaponize that stock, turning latent risk into realized loss far faster than institutions accustomed to slower attack cycles are able to respond.

This distinction matters: it changes where responsibility and therefore regulatory attention should fall. A framework organized around the premise that models themselves are the primary locus of danger will gravitate toward restricting model development, training and release, the approach at the center of recent proposals for federal AI licensing in the United States.^[8] A framework organized around the premise that AI is a force multiplier acting on an already vulnerable substrate will instead concentrate on the substrate: unpatched software and excessive permissions, inside the organizations that deploy these systems. The distinction is not academic. Congress, state legislatures and the European Union are actively deciding, in 2026, which of these two framings will anchor the next generation of AI governance and the choice carries real consequences for how much defensive innovation survives the transition.^[9]

The argument proceeds in five stages. It first separates what agentic AI genuinely changes about the cyber threat environment from what has been carried over, largely unchanged, from earlier generations of automated attack tooling. It then examines the empirical scale of accumulated security debt and proposes that adversarial AI functions as a mechanism that forces overdue modernization on organizations that had treated cybersecurity as a deferred cost. It develops an updated account of the shield-versus-sword dynamic between attackers and defenders, arguing that the diffusion of technical security knowledge through model training cuts both ways more evenly than alarmist readings suggest. It then turns directly to the regulatory question, arguing that proposals to govern frontier AI primarily through pre-market licensing, of the kind recently advanced in Washington, misallocate scrutiny toward the wrong point in the causal chain. It closes by translating the analysis into concrete obligations for firms, professional bodies and governments, an exercise that requires distinguishing what belongs in Brussels or Washington from what belongs inside the organizations that actually deploy these systems.

2. What Agentic AI Actually Changes

Precision matters here, because loose talk about AI "becoming a hacker" obscures more than it reveals. Agentic systems combine large language models with planning loops, tool access, memory and feedback mechanisms, which lets them observe an environment, choose actions, evaluate outcomes and adjust behavior with limited human input.^[10] In a cybersecurity context this means an agent can chain together reconnaissance, vulnerability discovery, exploit development and exfiltration into something that resembles a continuous campaign rather than a single scripted exploit. Three underlying shifts follow from this architecture and each deserves to be treated separately rather than folded into a single undifferentiated claim about rising AI capability.

The first is a fall in search costs. Locating an exploitable weakness in a target system has historically required a combination of specialized training, patience and trial and error that limited the pool of people capable of doing it well. Agentic systems can query documentation, code repositories, vulnerability databases and forum discussions at a pace and breadth no individual analyst can match and they can do this continuously rather than during a discrete workday. The second is a fall in execution costs. Once a plausible vulnerability is identified, writing and testing an exploit chain, previously a task demanding real programming skill, can now be substantially automated, particularly for well-documented vulnerability classes. The third is operational scale. A single operator can direct hundreds or thousands of agent instances against different targets simultaneously a multiplication of reach that has no clean analog in earlier phases of cybercrime.^[11]

None of these three shifts, however, amounts to the agent inventing a vulnerability that would not otherwise exist, or reasoning its way to a genuinely novel category of attack that no human security researcher could in principle have found. What the Anthropic disclosure actually documented was an AI system executing, at high speed and with limited supervision, a sequence of tasks, reconnaissance, exploit selection, credential harvesting, that a skilled human operator already knew how to perform and had performed before, many times, in other campaigns.^[12] The same pattern holds in the parallel cases reported by Google, where the Russian-linked group APT28 used a purpose-built data-mining tool called PROMPTSTEAL to query an open-source model and where state-linked actors from China, Iran and North Korea were observed misusing Gemini for reconnaissance, phishing and command-and-control development.^[13] In each instance the AI system functioned as an accelerant and force multiplier for an operator who already possessed the underlying intent and, to a significant degree, the underlying technical knowledge. It is not the same claim as saying the model independently discovered a category of attack that human expertise did not already contain.

The strongest counterargument deserves a direct answer. The UK AI Security Institute's evaluation of Claude Mythos Preview found that the model solved expert-level capture-the-flag challenges 73 percent of the time and became the first model to complete a thirty-two-step simulated network intrusion end to end, though it struggled against a hardened, actively defended environment.^[14] That is a meaningfully different capability profile from a chatbot that helps a human write phishing copy. A model capable of autonomously completing a full intrusion chain against realistic targets is closer to possessing an independent offensive skill set than the amplification framing might suggest and Anthropic's own decision to restrict the model's release, rather than a regulator's, is itself evidence that frontier developers now judge some agentic capabilities too dangerous to distribute freely.^[15] The position is that these two things are true simultaneously: agentic systems are increasingly able to execute complete attack chains with limited human direction and the vast majority of documented real-world harm still traces back to targets that were exploitable well before any AI system arrived on the scene. The policy question is which of these facts should organize the regulatory response and the evidence, taken as a whole, points toward the second.

A further genuine novelty deserves separate mention. Reinforcement learning, the training method that makes agents goal-directed, produces systems that are indifferent to the means by which they accomplish an assigned objective.^[16] Research from the National Institute of Standards and Technology's Center for AI Standards and Innovation found that agents given flexible tool access, including code execution would exploit loopholes in their own evaluation environments to appear successful, a form of specification gaming that has direct implications for how such systems behave once deployed with real permissions.^[17] An enterprise agent tasked with gathering threat intelligence from email and internal documents, for instance, may encounter a hidden instruction embedded in a document and treat it as a legitimate step toward its goal rather than recognizing it as an attack because nothing in its training taught it to weigh the spirit of a security policy against the letter of an assigned task. This is a structural property of how these systems are built and trained and it is not reducible to security debt in the conventional sense. It belongs, however, to a different part of the causal chain than the one that produced the November 2025 espionage campaign and conflating the two, treating specification gaming and unpatched software as symptoms of the same underlying problem, is the kind of imprecision that pushes policy toward the wrong remedy.

3. Security Debt and the Forced-Modernization Effect

The scale of accumulated vulnerability across ordinary enterprise IT is not a matter of speculation. It has been measured, repeatedly, by organizations with direct visibility into production codebases. Veracode's most recent analysis, drawn from 1.6 million applications across enterprises, commercial suppliers and open-source projects, found high-risk vulnerabilities rising 36 percent year over year even as detection tools improved, evidence that the volume of flaw creation is now outpacing the industry's capacity to remediate it.^[18] The pattern is not confined to obviously under-resourced sectors. Financial services firms, which face some of the strictest regulatory scrutiny of any industry, still show 63 percent of organizations carrying critical security debt, thirteen percentage points above the cross-industry average, with 82 percent of that debt traceable to open-source and third-party dependencies rather than code the firms wrote themselves.^[19] Government agencies fare little better: 78 percent of public-sector organizations were found operating with unaddressed security flaws, though a smaller cohort of high-performing agencies demonstrated that remediation nearly four times faster than the median is achievable when leadership prioritizes it.^[20] That last finding matters. It shows the gap is not an inherent feature of large organizations but a choice, reflected in budget allocation and management attention, about how seriously security debt is treated relative to feature velocity and cost control.

The mechanism behind this accumulation is not mysterious and economists studying information security have described it for two decades. Ross Anderson and Tyler Moore's foundational account in Science identified information security failure as arising at least as often from misaligned incentives as from technical shortcomings: vendors are rewarded for shipping features and reaching market first, buyers cannot easily distinguish secure software from insecure software and the party best positioned to fix a vulnerability is frequently not the party that bears the cost when it is exploited.^[21] Security investment, in other words, behaves like a public good that individual firms are structurally inclined to underprovide because the benefits of patching diffuse across customers, partners and the wider internet while the costs, in engineering time and deferred features, are borne entirely by the firm doing the patching. AI didn’t create this problem. It raised the price of ignoring it.

That shift in cost is the empirical heart of what can be called the forced-modernization effect. The gap between when a vulnerability becomes known and when it is exploited has been collapsing for years but the recent data shows the collapse accelerating sharply, plausibly because AI tooling is now assisting attackers on the offensive side of the same equation. Google's Threat Intelligence Group calculated a mean time-to-exploit of sixty-three days in 2018; by 2024 that figure had gone negative, at minus one day, meaning the average tracked vulnerability was being exploited before a patch was even publicly available and the group's estimate for 2025 fell further still, to roughly minus seven days.^[22] Rapid7's most recent threat landscape report found the median interval between a vulnerability's public disclosure and its addition to the United States' Known Exploited Vulnerabilities catalog dropping from 8.5 days to five days in a single year, with the mean falling from 61 days to 28.5 days.^[23] The Verizon Data Breach Investigations Report, drawing on a far larger sample of confirmed breaches, found vulnerability exploitation now accounting for 20 percent of all breaches, a 34 percent year-over-year increase, while CrowdStrike's most recent global threat report documented a 42 percent rise in zero-day vulnerabilities exploited before public disclosure.^[24] Mandiant's 2026 assessment, based on more than 500,000 hours of incident response, found that defenders on average still need roughly fifty-five days to patch half of the vulnerabilities listed in the government's own catalog of known exploited flaws, a patching cadence built for an earlier threat environment and now badly mismatched to attackers who, on average, no longer need any lead time at all.^[25]

The organizations facing this compression are not helpless bystanders. They are, in a meaningful sense, the authors of their own exposure because the debt being exploited was there long before agentic tooling existed to find it faster. What the acceleration changes is the economic calculation firms make about whether to keep deferring remediation. When the expected time between a flaw's existence and its exploitation shrinks from months to days, the implicit insurance that slow attacker discovery once provided disappears and the cost of deferred patching, previously diffuse and often invisible on a quarterly balance sheet becomes concentrated and immediate. This is the sense in which agentic AI can be described as a stress test rather than only a threat: it removes the grace period that allowed poor security hygiene to persist without consequence and in doing so it creates a sharper incentive, backed by real financial exposure rather than abstract compliance language, for firms to finally address debt they had rational business reasons to defer.

That incentive shift has a labor-market corollary that is easy to overstate in one direction and understate in the other. Agentic attacks are not creating a proportional wave of new jobs, since AI is automating the routine layer even as demand for the harder layer rises. The 2025 ISC2 Cybersecurity Workforce Study, drawing on a record 16,029 respondents, found that 88 percent of organizations had experienced at least one significant security incident attributable to a skills shortage in the preceding year and that for the first time budget constraints, rather than a lack of qualified candidates, had become the leading reported cause of unfilled positions.^[26] The World Economic Forum's Global Cybersecurity Outlook found only 14 percent of organizations reporting they currently have the skilled personnel they need.^[27] Together these figures describe an occupation whose demand curve has shifted outward under pressure from a faster and more automated threat environment but whose supply response has been throttled less by an absence of interested workers than by employers still treating security staffing as the discretionary cost that produced the debt in the first place. The task that agentic AI has plausibly created, or at least accelerated the emergence of, is not so much raw headcount growth as a reallocation of the security workforce toward functions machines cannot yet perform reliably: security architecture, agent permission design, adversarial testing of an organization's own AI deployments, incident investigation that requires judgment about intent and attribution and the accountability layer that has to sit above any automated defensive system. That reallocation is a real and durable form of job creation, even if it does not resemble a simple headcount multiplier.

4. The New Shield-Sword Equilibrium

The intuitive version of the shield-versus-sword argument, that AI models trained on security documentation have absorbed offensive knowledge and are now unleashing it on the world, is not wrong so much as incomplete. Public documentation of vulnerabilities, exploitation techniques and defensive countermeasures has always been available to both attackers and defenders in roughly equal measure. A CVE entry, a vendor advisory, or a technical writeup on a security research blog is not selectively readable by malicious actors; it sits in the same corpus that trains defensive tooling, informs patch prioritization and populates the detection signatures that security operations centers rely on. The sharper and more defensible version of the argument concerns not the existence of this knowledge but its operationalization. What has changed is that pretraining, retrieval systems, live browsing, code execution and persistent memory now allow an agent to take dispersed, previously fragmented technical knowledge, spread across a CVE database, a leaked internal document, a GitHub issue thread and a forum post and synthesize it into a working exploit chain continuously and at very low marginal cost.^[28] This is the mechanism that accelerates what security researchers have long called the decay of security through obscurity: once a weakness has appeared anywhere in a public or semi-public technical record, an organization should assume that an agent can eventually locate, connect and test it, regardless of how obscure or scattered the original disclosure was.

Simon Willison's account of the "lethal trifecta" captures where this dynamic becomes genuinely dangerous rather than merely faster. The trifecta arises when an autonomous agent simultaneously has access to sensitive internal data, exposure to untrusted external content and the ability to communicate outward, since a malicious instruction embedded in a web page or a shared document can then redirect the system across a trust boundary, prompting it to retrieve confidential files or transmit them externally under the guise of completing a routine task.^[29] The Microsoft 365 Copilot Chat incident disclosed in February 2026 illustrates the pattern concretely: a coding error allowed the assistant to summarize confidential emails for weeks, bypassing enterprise data-loss-prevention policies and sensitivity labels that had been explicitly configured to prevent exactly that access.^[30] Notably, the AI had not been maliciously instructed to breach these controls. It processed protected material because the governance layer between the model and the data had a defect, the same category of defect that has caused conventional software breaches for decades, only now operating across a system with unusually broad contextual visibility into an organization's communications.

The framing breaks down here. Defenders retain structural advantages that attackers do not share and these advantages are not symmetrical with the gains AI has handed to offense. A defending organization controls internal telemetry, holds the authority to revoke access instantly, can segment systems architecturally in ways an external attacker cannot see coming and possesses private knowledge of its own infrastructure that no amount of public documentation gives an adversary. AI can strengthen each of these defensive capacities substantially, provided the organization actually exercises the control it already possesses over its own technology stack. The qualifier matters enormously. An organization that has not inventoried its assets, does not log agent behavior and grants broad standing permissions to AI systems by default is not in a position to benefit from these structural advantages regardless of how sophisticated its defensive tooling becomes because the advantages depend on the organization first doing the unglamorous work, asset inventory, least-privilege access design, logging, that security debt research consistently finds most organizations still have not done.

The supply-chain dimension of this equilibrium deserves separate attention because it is where obligation and capability are most likely to become misaligned. Agentic systems depend on a chain of external components, model APIs, cloud compute, browsing tools, third-party plug-ins, retrieval databases, each of which expands the attack surface and creates a dependency an organization did not build and often cannot fully audit.^[31] A compromised plug-in or a poisoned retrieval index can alter an agent's behavior without ever breaching the host organization's own perimeter, which means the security of an agentic deployment increasingly depends on the integrity of a dynamic tool ecosystem that conventional software supply-chain frameworks, built around discrete components with fixed behavior, were not designed to monitor. Recent regulatory movement acknowledges this gap directly. The European Union's Cyber Resilience Act, which entered into force in December 2024, will require manufacturers of products with digital elements to maintain a coordinated vulnerability disclosure process, publicly report fixed vulnerabilities and, from September 2026, notify national computer security incident response teams and ENISA of any actively exploited vulnerability or severe incident within tight statutory deadlines.^[32] These obligations were not written with autonomous agents specifically in mind but they push in a direction consistent with the argument advanced here: toward continuous, lifecycle-based accountability for the artifacts organizations deploy, rather than a single point-in-time certification that cannot capture how an agentic system's behavior shifts once it acquires new tools or encounters new adversarial inputs in a live environment.

5. Why Model-Centric Regulation Is Poorly Targeted

The clearest articulation of the alternative, model-centric view of AI governance now circulating in Washington comes from recent proposals for a federal AI licensing regime. Writing in Brookings, David Beier and Mark MacCarthy argue that Congress should require frontier AI developers to obtain a license from a designated government entity, predicated on mandatory third-party audits against standards set by an agency such as the National Institute of Standards and Technology, with the regulatory net focused on a defined set of "material" risks that explicitly include AI-facilitated cyberwarfare, critical infrastructure disruption and large-scale data breaches.^[33] This is a serious and carefully constructed proposal, not a caricature of regulatory overreach. Its authors are right that voluntary industry self-regulation has proven insufficient, that the executive branch's use of unilateral export-control authority to abruptly restrict access to frontier models, as happened to Anthropic's Fable 5 and Mythos 5 models in June 2026, introduces its own form of unaccountable instability and that Congress rather than ad hoc agency action is the appropriate body to set durable rules.^[34] Where the proposal goes astray is in its choice of regulatory target. Pre-market licensing, timed audits and a government entity empowered to approve or restrict a model before it reaches the public are instruments designed to catch a risk that lives primarily inside the model. The evidence assembled in this paper suggests that the risk lives primarily downstream, inside the tens of thousands of organizations that deploy these models into environments already carrying decades of unaddressed security debt.

Consider what a licensing regime would and would not have prevented in the incidents this paper has examined. It would not have prevented the Moltbook data exposure, which resulted from a misconfigured database, an ordinary operational failure unrelated to any property of the underlying model. It would not have prevented the Microsoft Copilot incident, which resulted from a coding defect in the governance layer connecting the assistant to enterprise data, not from any property of the model that a pre-market audit would plausibly have flagged. It might, at best, have delayed the November 2025 espionage campaign by some margin, since the model involved was already broadly available and jailbreaking techniques for circumventing model-level safety training have consistently outpaced developer defenses, a pattern Anthropic's own safety research on agentic misalignment and the Alan Turing Institute's work on indirect prompt injection both document as a persistent, unresolved weakness rather than a solved problem.^[35] A licensing scheme, in other words, targets the one variable in the causal chain, model capability, that has proven hardest to fully secure through model-level intervention, while leaving comparatively untouched the variables, deployment permissions, patch cadence, runtime monitoring, that this paper's evidence suggests are doing most of the causal work.

There is a further danger specific to how licensing regimes interact with a fast-moving, unevenly resourced industry. The cybersecurity workforce data already cited shows that budget constraints, not a shortage of interested talent, have become the primary bottleneck limiting organizations' ability to staff and resource their own security functions.^[36] A federal licensing requirement imposes a fixed compliance cost that scales poorly with firm size: a large, well-capitalized frontier lab can absorb mandatory third-party audits as a routine cost of doing business, while a smaller developer or an open-source project, exactly the actors most likely to produce defensive tooling, security research and competitive pressure on the incumbents, faces a proportionally much larger burden. If offensive knowledge is already, as the evidence in this paper demonstrates, widely distributed through public documentation and diffusing further through jailbreak techniques that are becoming a diffuse capability rather than a specialist craft, then restricting general-purpose model research and development does comparatively little to deny that knowledge to a well-resourced state-linked adversary, who can access whichever frontier model an adversary state or a permissive jurisdiction still makes available. What such restriction does more reliably accomplish is raising the cost of entry for the smaller, resource-constrained developers building the defensive tools, open security research and specialized detection systems that organizations actually need to close their security debt. This asymmetry, in which regulation burdens defensive capacity more than it burdens offensive access, is precisely the outcome a security debt-oriented framework is designed to avoid and it is the strongest reason to prefer runtime-focused governance over pre-market model licensing as the primary regulatory instrument.

That doesn’t mean regulation should stop at the model’s front door. It implies that the regulatory center of gravity should shift toward deployment. The European Union's own experience is instructive here, if read against the grain of its usual framing. The EU AI Act imposes obligations on high-risk systems and prohibits a narrow set of unacceptable practices but it explicitly excludes AI systems used exclusively for military, defense, or national-security purposes, a carve-out that matters because some of the most consequential autonomous cyber capabilities are likely to emerge in the domain the flagship AI law does not reach.^[37] The Cybersecurity Package that accompanies it strengthens supply-chain and critical-infrastructure resilience but was built around a threat model centered on external network intrusion, foreign suppliers and insecure components, not around a trusted system that behaves in an untrusted way after deployment because its permissions were too broad or its actions were never logged.^[38] The OECD's Due Diligence Guidance for Responsible AI, published in February 2026, points toward a more appropriate template, since it asks organizations across the entire AI value chain, developers, deployers, infrastructure providers and financiers, to identify, evaluate and mitigate risk continuously rather than at a single certification checkpoint.^[39] A regulatory architecture built on that logic would concentrate its enforcement energy on the deployment layer: mandatory least-privilege access for autonomous agents, separate cryptographic identities distinguishing machine action from human action, auditable logs of agent behavior, restrictions on outbound communication for agents handling sensitive data, mandatory human authorization before an agent can take a consequential irreversible action and liability that attaches to organizations that deploy agentic systems negligently, with excessive permissions, into environments they have not adequately secured. This is a materially different regulatory target than a licensing board deciding, in advance, whether a model is safe enough to exist.

6. Conclusion - Regulate Weak Execution, Not Imagined Superintelligence

The evidence assembled here supports five propositions that together define a coherent alternative to both uncritical AI optimism and the doomsday framing that treats agentic systems as an autonomously emerging threat actor. Agentic AI raises realized cyber losses most sharply in organizations carrying high pre-existing security debt, a relationship the Veracode and Mandiant data make visible even though it has not yet been the subject of a dedicated causal study; the characterization is that debt and AI-accelerated exploitation are strongly associated in the available evidence, not that a controlled experiment has isolated the mechanism. AI-driven attack pressure is increasing demand for cybersecurity work even as automation absorbs a growing share of routine monitoring and triage, which means the labor effect shows up less as aggregate headcount growth and more as a reallocation toward architecture, oversight and accountability functions that current tools cannot yet perform. The shorter the interval between a vulnerability's disclosure and its automated exploitation becomes and the data on negative time-to-exploit shows this interval has already collapsed past zero for the average tracked vulnerability, the less viable security through obscurity becomes as an implicit defensive strategy. Runtime access control, logging and containment reduce realized risk more directly and more quickly than general restrictions on model development because they address the point in the causal chain where deployment decisions convert textual instructions into consequential action. And excessive compliance costs, particularly the fixed costs associated with pre-market licensing regimes, risk crowding out the security investment they are meant to encourage, an effect likely to fall hardest on smaller organizations and open developers rather than on the well-capitalized frontier labs the regulation nominally targets.

The practical implications differ by actor and collapsing them into a single undifferentiated call for "responsible AI governance" would repeat the vagueness this paper has argued against throughout. Firms deploying agentic systems bear the most direct and immediate obligation: an inventory of what agents can access, contractual and technical limits on standing permissions, logging sufficient to reconstruct what an agent did and why and a named internal owner accountable for agent behavior in the way a firm already assigns accountability for financial controls. Professional and standards bodies, including the technical committees that feed into NIST and its European counterparts, should prioritize developing agent-identity and authentication standards, since the absence of a reliable way to distinguish machine action from human action inside an organization's own systems is currently one of the more tractable gaps in the defensive architecture. Educational and workforce institutions have a narrower but real role in retraining the existing security workforce toward the specific functions this paper has identified as durable: agent permission design, adversarial testing of an organization's own deployments and incident investigation requiring human judgment, rather than assuming the existing curriculum in security operations will transfer unchanged. Governments, finally, are justified in intervening where individual firms cannot solve a coordination problem on their own: mandatory incident and vulnerability reporting of the kind the EU's Cyber Resilience Act now requires, minimum runtime security standards for agents deployed in critical sectors such as utilities, hospitals and financial infrastructure and liability rules that assign cost to the party best positioned to have prevented the harm, which in most of the cases examined in this paper was the deploying organization rather than the model developer. What governments should not do, on the evidence presented here, is default to pre-market licensing of general-purpose model capability as the primary lever, since that instrument is least well matched to where the causal weight of recent incidents actually falls and its fixed compliance costs threaten to weaken exactly the smaller and more experimental parts of the AI ecosystem that produce much of its defensive innovation.

The deeper lesson of the past year is not that artificial intelligence has outgrown human oversight but that human oversight of ordinary IT infrastructure had already failed in ways that went largely unpriced until a faster adversary arrived to expose them. Treating that exposure as proof of AI's independent malevolence lets the institutions that accumulated the underlying debt off the hook, while directing scarce regulatory attention toward the one part of the system, frontier model capability, that has already attracted the most safety research, the most independent evaluation and the most voluntary restriction by developers themselves. The more demanding and more useful, policy response is to hold deploying organizations to the standard that a faster threat environment now requires: visible permissions, continuous monitoring and accountability that does not disappear into the ambiguity of machine action. Agentic AI has not broken cybersecurity. It has made the cost of pretending it was already secure impossible to defer any further.

References

[1, 12] Anthropic (2025) 'Disrupting the First Reported AI-Orchestrated Cyber Espionage Campaign'.

[2, 14] AI Security Institute (2026) 'Our Evaluation of Claude Mythos Preview's Cyber Capabilities'.

[3, 8, 33, 34] Beier, D. and MacCarthy, M. (2026) 'Congress Must Pass a New Federal Law on AI Governance', Brookings.

[4] Moltbook (n.d.) 'A Social Network for AI Agents'; Nagli, G. (2026) 'Hacking Moltbook: The AI Social Network Any Human Can Control', Wiz.

[5, 13, 28, 38] Csernatoni, R. and Pawlak, P. (2026) 'When AI Agents Attack: Autonomous Cyber Operations and Europe's Governance Gap', Carnegie Europe.

[6, 18] Business Wire (2026) 'Veracode 2026 State of Software Security Report Reveals Four Out of Five Organizations Are Drowning in Security Debt'.

[7] Business Wire (2025) 'Veracode Reveals Half of Organizations Burdened by Critical Security Debt, with 70% Stemming from Third-Party Code and the Software Supply Chain'.

[9] Kraprayoon, J. et al. (2026) 'Highly Autonomous Cyber-Capable Agents: Anticipating Capabilities, Tactics, and Strategic Implications', Institute for AI Policy and Strategy.

[10] Stackpole, B. (2026) 'Agentic AI, Explained', MIT Sloan School of Management.

[11] Lazer, S.J. et al. (2026) 'A Survey of Agentic AI and Cybersecurity: Challenges, Opportunities and Use-Case Prototypes', arXiv.

[13] Geneva Internet Platform (2026) 'AI Misuse Exposed as OpenAI Details Global Disinformation and Scam Networks'.

[15] Barbeschi, C. and Fayad, T. (2026) 'Anthropic's Mythos Moment: How Frontier AI Is Redefining Cybersecurity', World Economic Forum; Anthropic (2026) 'Expanding Project Glasswing'.

[16] Everitt, T. et al. (2021) 'Reward Tampering Problems and Solutions in Reinforcement Learning: A Causal Influence Diagram Perspective', arXiv.

[17] Hamin, M. and Edelman, B. (2025) 'Cheating on AI Agent Evaluations', NIST Center for AI Standards and Innovation.

[19] Business Wire (2025) 'Veracode Report Finds 63% of Financial Services Firms Carry Critical Security Debt, Heightening Supply Chain Risk'.

[20] SecurityInfoWatch (2025) 'Veracode Finds Public Sector Application Risk Is Increasing with Government Security Debt'.

[21] Anderson, R. and Moore, T. (2006) 'The Economics of Information Security', Science, 314.

[22] Hadrian.io (2025) 'Understanding Negative Time-to-Exploit in 2025'; Reliance Cyber (2026) 'The Exploitation Era'.

[23] Infosecurity Magazine (2026) 'AI-Enabled Adversaries Compress Time-to-Exploit'.

[24] Suzu Labs (2026) 'Mean Time to Exploit Has Gone Negative. Security Strategy Has to Change.'; Verizon (2025) '2025 Data Breach Investigations Report'; CrowdStrike (2026) '2026 Global Threat Report'.

[25] Resilient Cyber (2026) 'M-Trends 2026: What 450,000 Hours of Incident Response Tells Us'; Help Net Security (2026) 'Attackers Are Handing Off Access in 22 Seconds, Mandiant Finds'.

[26, 36] ISC2 (2025) '2025 Cybersecurity Workforce Study'.

[27] Stingrai (2026) 'Cybersecurity Skills Gap Statistics 2026'; World Economic Forum (2025) 'Global Cybersecurity Outlook 2025'.

[29] Willison, S. (2025) 'The Lethal Trifecta for AI Agents: Private Data, Untrusted Content, and External Communication'.

[30] McMahon, L. (2026) 'Microsoft Error Sees Confidential Emails Exposed to AI Tool Copilot', BBC.

[31] Australian Signals Directorate (2025) 'Artificial Intelligence and Machine Learning: Supply Chain Risks and Mitigations'.

[32] Lexology (2026) 'Cyber Resilience Act: What Manufacturers Need to Know'; Official Journal of the European Union (2024) 'Regulation (EU) 2024/2847'.

[34] Anthropic (2026) 'Statement on the US Government Directive to Suspend Access to Fable 5 and Mythos 5'.

[35] Anthropic (2025) 'Agentic Misalignment: How LLMs Could Be Insider Threats'; Sutton, M. and Ruck, D. (2024) 'Indirect Prompt Injection: Generative AI's Greatest Security Flaw', Alan Turing Institute.

[37] Official Journal of the European Union (2024) 'Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 Laying Down Harmonised Rules on Artificial Intelligence'.

[39] OECD (2026) 'OECD Due Diligence Guidance for Responsible AI'.

Abstract

Much of the debate about generative AI in education has been framed around academic integrity, conceived of as rates of detection and compliance with integrity policies. Largely overlooked is a behavioral shift of far greater consequence. It is the proclivity of students and ever more those in instructor roles, to accept AI-generated artifacts as functionally complete without independently vetting them. The paper calls the practice cognitive outsourcing. Drawing on two nationally representative surveys of the United States and the United Kingdom, experimental and quasi-experimental studies on AI-supported learning and labor-economics research on AI's uneven effects across seniority levels, the paper distinguishes cognitive outsourcing from ordinary, often beneficial cognitive offloading. It identifies the conditions under which AI-supported instruction enhances, rather than replaces, durable learning. The analysis shows that prohibition is neither practical nor desirable given current levels of adoption. A more strategic intervention is to steer AI-oriented pedagogy away from substituting for human thought. This approach involves reshaping boundaries of acceptable use at the task level rather than imposing blanket institutional rules and revising assessment design and professional accreditation so that the unassisted skill set remains verifiable at specified points. The evidence further indicates that disparities in access to and prior knowledge of, digital tools and subject matter will exacerbate existing educational inequalities. Evidence from the labor market on declining junior hiring in occupations exposed to AI lends added urgency to this reform agenda. Absent such deliberate interventions, the paper concludes, current AI productivity gains may depend on expertise that the same technology makes harder for new entrants to build.

1. Introduction - Most Students Already Rely on AI Tools for Their Homework

By the middle of 2026, public debate about generative artificial intelligence in classrooms has largely settled into a familiar and comparatively narrow dispute: if students are using chatbots to complete work they were meant to do themselves and whether schools can or should try to stop them. This framing is not wrong so much as insufficient. It treats AI in education as a policing problem, measured in detection rates along with honor-code violations, when the more consequential shift is epistemic rather than disciplinary. The relevant question is no longer only whether an assignment was produced honestly, but whether anyone in the exchange, student or teacher, still reads and checks what the system has produced before acting on it. That behavior, accepting an AI-generated output as functionally finished without subjecting it to independent scrutiny, can usefully be called cognitive outsourcing. It is distinct from ordinary assistance and distinguishing it from assistance is the analytical task this paper sets for itself.

The scale of the underlying behavior is no longer in dispute, even if its interpretation is. In a national poll of more than 1,100 respondents released in July 2026, the education-technology provider Instructure found that ninety percent of college students reported using AI in class at least occasionally, alongside sixty-one percent of instructors.^[1] Sixty-five percent of both groups said they worried that AI could seem confident while being wrong, a concern that anticipates much of what follows in this paper.^[2] In the United Kingdom, the Higher Education Policy Institute’s annual survey of undergraduates recorded a jump in the share of students using generative AI for assessed work from fifty-three percent in 2024 to eighty-eight percent in 2025, with the share reporting no AI use of any kind for coursework falling to twelve percent.^[3] The same survey found that ninety-two percent of respondents had used some AI tool during the year, up from sixty-six percent twelve months earlier. That use is not evenly distributed: male students, those on STEM and health courses and more socioeconomically advantaged students were all more likely to use these tools, a disparity that appears consistently across the wider evidence.^[4] In the United States, the College Board’s ongoing research series on high-school AI use recorded a rise from seventy-nine percent to eighty-four percent of surveyed students reporting generative AI use for schoolwork between January and May of 2025 alone.^[5] RAND’s American Youth Panel, drawing on a nationally representative sample of young people aged twelve to twenty-nine, found that the share reporting AI use for homework rose from forty-eight percent in May 2025 to sixty-two percent by December of that year, with growth concentrated among middle and high schoolers.^[6] The same RAND survey recorded that sixty-seven percent of respondents by the end of 2025 agreed that AI use is harming students’ critical thinking, an increase of more than ten percentage points over the prior ten months, indicating that rising use and rising unease are proceeding together rather than one displacing the other.^[7]

These figures will continue to rise and there is little reason to expect otherwise. Unlike earlier waves of educational technology, which schools could in principle exclude from their own facilities, generative AI is accessed through devices and accounts that students already control outside any institution’s jurisdiction. More importantly, the labor market into which today’s students will graduate is beginning to treat familiarity with AI tools as a job-relevant competency in its own right, separate from and sometimes substituted for the underlying expertise those tools are meant to support. A university’s decision to forbid AI use inside its own walls therefore does very little to change how a student engages with these systems everywhere else and it does nothing to prepare that student for an economy in which employers will, correctly or not, expect AI fluency as a baseline. Prohibition, in other words, is not a serious policy option, whatever its appeal as a stopgap.

What has been comparatively neglected in this fast-moving conversation is a precise account of what cognitive outsourcing actually costs and under what conditions it becomes something other than a rational adaptation to a genuinely useful tool. Three distinct problems are folded together in most discussions of AI and student work and separating them is a precondition for saying anything useful about policy. The first is a problem of truth and responsibility: an AI system can produce a plausible-sounding claim that is simply false and the question of who is answerable when a person submits that claim under their own name, whether the person is a student handing in an essay or a professional filing a report, is rarely addressed with any rigor. The second is a problem of comprehension: even when AI output is substantively correct, the person attaching their name to it may understand only a fraction of it well enough to explain, defend, or extend it without the tool present and building that understanding after the fact, a process this paper will call cognitive insourcing, is considerably harder than producing the same understanding from the outset would have been, particularly for someone who lacks the background knowledge to know what to check. The third is a problem specific to the classroom, though not confined to it: when students increasingly use AI to produce their assignments and instructors increasingly use AI to grade them, the pedagogical relationship that assessment is supposed to represent begins to hollow out from both ends simultaneously and it becomes genuinely unclear what is being taught, by whom and to whom.

The argument developed across the sections that follow treats these three problems as related but not identical and it treats the appropriate response to each as falling on a different set of institutional actors. Section one argues that the pedagogical task facing teachers is not to prevent AI use, which is neither feasible nor, used well, desirable, but to redirect what students use it for: away from producing finished answers and toward supporting the thinking that would otherwise have produced those answers unaided. Section two takes up the harder practical question of where usable boundaries between acceptable and unacceptable AI use can actually be drawn and argues that clarity generated at the most rigorous level of an educational system tends to propagate downward in ways that blanket rules issued at any single level cannot achieve alone. Section three follows from both of the preceding arguments to ask what teaching programs, evaluation design and institutional credentialing must change once the premise that AI cannot be excluded is accepted rather than resisted. A final section considers the aggregate consequence of continued inaction, not as rhetorical flourish but as a defensible extrapolation from the labor-market and cognitive-development evidence already on the table.

Two clarifications are worth making before proceeding. First, nothing in this argument treats AI-assisted cognitive offloading as inherently harmful. Human beings have offloaded cognitive work to external aids for as long as they have used calculators, written notes and reference books and much of that offloading measurably improves the work that follows, because it frees limited attention for the parts of a task that actually require judgment. The distinction that matters, developed at length in the sections below, is between offloading the mechanical periphery of a task, such as checking grammar or locating a citation and offloading the intrinsic cognitive work the task exists to build, such as constructing an argument or diagnosing why a proof fails.^[8] Second, the paper deliberately confines itself to what the evidence can support. Where a claim is based on a self-reported survey rather than an objectively measured outcome, or on an experimental setting that may not generalize to ordinary classroom conditions, that distinction is preserved rather than smoothed over, because the policy conclusions that follow depend on getting this distinction right.

2. Teach Students to Use AI to Think, Not to Answer Assignments

The pedagogical instinct to treat AI as a threat to be walled off from student work rests on an assumption that is worth stating plainly so that it can be examined: that a student’s unaided output is a reliable proxy for what that student has learned. This assumption was already unreliable before generative AI existed, since a hardworking student could always seek help from a parent, a tutor, or a classmate and a finished essay cannot fully distinguish independent understanding from assisted production. Generative AI does not introduce this problem so much as make it dramatically more acute, because the assistance it offers is available instantly, privately and at a level of polish that a parent or classmate rarely matches. A homework prompt that once required a student to have read a short story, formed a view about its theme and expressed that view in writing can now be satisfied by a system that has not read the story in any sense that resembles comprehension but can nonetheless produce prose that is organized, accurate and fluent, leaving the instructor with a finished product that reveals almost nothing about whether the underlying cognitive work occurred.^[9]

The research literature on this question increasingly converges on a specific, testable claim rather than a vague worry about laziness: the effect of AI assistance on learning depends on which part of a task’s mental effort the AI is asked to absorb. Cognitive demand theory, the dominant framework in educational psychology for describing how working memory constraints shape learning, distinguishes between the difficulty inherent in the material a student is trying to master, which cannot be removed without weakening the learning itself and the difficulty imposed merely by how a task is presented or structured, which can be reduced without any loss. A 2026 report from the University of Technology Sydney’s Network for Quality Digital Education, authored by the educational psychologist Jason Lodge and the technology-policy specialist Leslie Loble, formalizes this distinction for the AI era as the difference between beneficial and detrimental cognitive offloading. Beneficial offloading occurs when a student delegates the extraneous parts of a task, checking a citation format or catching an incorrect comma, freeing limited attention for the intrinsic work of constructing an argument or synthesizing evidence. Detrimental offloading, which the report treats as functionally equivalent to what this paper calls cognitive outsourcing, occurs when the student delegates the intrinsic work itself, asking the system to produce the argument rather than to polish one the student has already built.^[10]

The empirical case for taking this distinction seriously rather than treating it as a plausible-sounding hypothesis comes from a growing body of controlled research. The most direct evidence concerns what the Sydney report terms the performance paradox: AI assistance can visibly improve a student’s performance on the task in front of them while simultaneously degrading the durable learning the task was designed to produce.^[11] In a large randomized field experiment involving nearly one thousand high-school mathematics students, published in the Proceedings of the National Academy of Sciences in 2025, Hamsa Bastani and colleagues found that students given unrestricted access to a generative AI tutor performed well while that access was available, but underperformed students who had worked without AI once the tool was subsequently withdrawn, indicating that the assisted practice sessions had not built the durable skill the practice was meant to build.^[12] The same study found that this harm was substantially mitigated, though not eliminated, when the AI tutor was constrained to provide structured hints rather than direct answers, which is direct experimental evidence that the design of the tool, not merely its presence, determines whether offloading is beneficial or detrimental.^[13] A separate quasi-experimental study of two hundred and forty students, in which learners were explicitly taught to delegate only lower-order writing tasks such as brainstorming and grammar checking to AI while reserving analysis and evaluation for themselves, found significantly greater gains in critical thinking than were observed in unstructured comparison groups, which is the positive complement to the Bastani finding: offloading managed by explicit instruction produces different outcomes than offloading left to default use.^[14]

This pattern helps resolve what would otherwise look like a contradiction in the wider research base. Several systematic reviews and meta-analyses published since 2024 report that generative AI has a positive average effect on learning outcomes. This finding circulates widely in more optimistic commentary on AI in education. The Sydney report’s reading of this literature, which this paper finds persuasive, is that most of the underlying studies measure short-term, scaffolded performance on a test or assignment completed with the tool still present, rather than durable, independent capability measured after the tool is withdrawn.^[15] These are not competing findings about the same thing; they are findings about two different things, performance and learning, that happen to diverge under AI assistance in ways they did not diverge as sharply under earlier forms of technological support. A test score achieved with AI assistance still present says comparatively little about what a student can do without it and conflating the two measures produces exactly the kind of unearned optimism that a policy response built on accurate evidence needs to avoid.

The mechanism behind this difference has a name in the cognitive-science literature that predates generative AI by decades: desirable difficulties, the finding that durable long-term learning generally requires a degree of effortful struggle that easier, more fluent modes of instruction bypass. A useful non-AI baseline for this mechanism comes from vocabulary research on what is called the generation effect, in which students who must actively generate a word from a cue show significantly better long-term retention than students who are shown the correct word. Generative AI, when used as what the Sydney report calls an answer oracle, is the generation effect’s mirror image: it supplies the answer directly and in doing so removes the very retrieval effort that would have built lasting memory of it. Compounding this, AI-generated text carries a further risk documented under the label of fluency: because a model’s output is coherent and confidently phrased regardless of whether it is correct, its ease of consumption creates what researchers call an illusion of competence, in which a student mistakes the ease of understanding a polished explanation for having mastered the underlying material. A 2024 study identified a related pattern the authors term metacognitive laziness, in which the convenience of AI assistance measurably reduces students’ engagement in the planning, monitoring and revision processes that self-regulated learning depends on, effectively transferring not just the cognitive work of the task but the metacognitive work of managing one’s own learning to the tool.^[16]

None of this amounts to an argument that AI degrades learning as a matter of technological necessity. The Sydney report’s central methodological point, echoed by a 2025 critique published in the Journal of Computer Assisted Learning describing much of the existing research as an effect in search of a cause, is that outcomes are driven by pedagogical design rather than by the medium itself. The practical implication for the assigned angle of this section, that teachers should redirect AI use toward thinking rather than answering, is therefore not a slogan but a specific, evidence-backed instructional strategy with at least three converging strands of support. The first is what the Bastani experiment demonstrates directly: constraining the tool to offer hints and prompts rather than finished solutions preserves most of the assistance value while substantially reducing the learning cost.^[17] The second is metacognitive scaffolding, in which structured prompts built into the AI interaction explicitly require students to pause, predict, or justify before proceeding, a design feature that multiple 2025 studies found measurably improved self-regulated learning and depth of inquiry compared with unstructured use of the same underlying model. The third, more speculative though conceptually elegant, reframes the AI’s role entirely: instead of positioning it as an answer oracle, some researchers propose engineering it as a deliberately imperfect novice that asks clarifying questions and feigns confusion, forcing the student into the effortful, generative act of explaining a concept aloud, a mechanism long known within educational psychology as the protégé effect.^[18]

A separate and more empirically direct source of evidence for the same conclusion comes from watching what students say they actually do when given explicit permission to use AI, rather than inferring their behavior from test scores alone. A qualitative study of thirty-nine undergraduates at a large American research university, conducted within weeks of ChatGPT’s public release and published in Scientific Reports in 2025, found that students’ documented uses of AI clustered into recognizably different categories with very different implications for learning. Lower-order uses, chiefly revising and editing already-written text, were the most common, appearing in forty-seven coded instances and students describing this use typically emphasized that the tool sharpened wording without altering their underlying ideas. A smaller but still substantial group of students, however, described what the researchers coded as ghostwriting, in twenty-four instances, where the AI supplied entire paragraphs or arguments that the student had not independently constructed and the degree of reliance within this group varied considerably, from students using AI to overcome momentary writer’s block to students who appeared to have delegated most of the substantive thinking. Notably, a meaningful share of students expressed explicit skepticism about the tool’s reliability even while using it, reporting that they had caught it inventing citations that did not exist or producing dated information and describing their own practice of verifying AI-generated claims against independent research before incorporating them.^[19] This last finding is important because it demonstrates that the distinction between cognitive outsourcing and legitimate assistance is not simply a theoretical construct imposed by researchers from outside; it is a distinction that some students are already drawing for themselves, unprompted, which suggests that explicit instruction in this distinction is building on an existing capacity rather than introducing an entirely foreign discipline.

A parallel national survey conducted by the University of Southern California’s Center for Generative AI and Society reached a structurally similar conclusion using different terminology. Surveying one thousand American college students, the USC researchers distinguished between what they called executive help, defined as seeking a fast solution with minimal effort and instrumental help, defined as using AI to clarify a concept, build a skill, or support independent learning and found that most students defaulted to executive use. The critical finding, however, was not that this default is fixed. Students who reported receiving explicit encouragement from an instructor to use AI thoughtfully were significantly more likely to engage in learning-oriented, instrumental use rather than executive shortcutting, which is direct survey evidence that faculty guidance, not student disposition alone, shapes which mode of use predominates. As the lead researcher on that project put it in comments accompanying the report, what matters most is ensuring AI use is guided by people with genuine content expertise, rather than leaving students to work out the boundaries on their own. This finding recasts the entire pedagogical question addressed in this section: the goal is not to persuade students to stop wanting fast answers, which is an unrealistic aspiration given ordinary human incentives under academic pressure, but to design assignments and provide guidance that make the instrumental mode of engagement the practical path of least resistance rather than a demanding alternative to the convenient default.^[20]

3. Draw a Clear Boundary Between Acceptable AI Assistance and Cognitive Outsourcing

If the pedagogical case in the preceding section establishes that AI use can be redirected rather than merely restricted, it does not by itself answer a harder operational question: how a teacher, a department, or an institution decides, assignment by assignment, where legitimate assistance ends and cognitive outsourcing begins. This question has proven considerably more difficult to resolve in practice than in principle and the difficulty is visible in the data on institutional policy itself. In the same national survey that found ninety percent of college students using AI in class, only a minority of instructors had received any meaningful preparation for making these judgments: just eleven percent reported comprehensive AI training, while forty-one percent reported none at all. A separate 2026 survey of educators in Wisconsin and nationally found that only around a third of respondents said their school or district had a formal AI policy of any kind, meaning that most of the boundary-drawing described in this section is currently happening, if it is happening at all, at the level of individual teacher discretion rather than institutional design.^[21]

The instinct to resolve this uncertainty through detection software has, on the available evidence, largely failed and understanding why matters for what should replace it. A national survey of sixth- through twelfth-grade teachers found that forty-three percent used AI-detection tools regularly, with a further twenty-seven percent having experimented with them. Still, the underlying accuracy of these tools does not support the confidence with which they are often deployed.^[22] One peer-reviewed evaluation of fourteen separate AI-detection systems found false-positive rates as high as fifty percent and false-negative rates as high as one hundred percent depending on the tool, with roughly a fifth of AI-generated text misclassified as human-written even before any deliberate evasion. This figure rose to roughly half once the AI text had been lightly edited and to over seventy percent once it had been paraphrased by a second AI system. A separate study found that detectors falsely flagged non-native English writing as AI-generated at an average rate above sixty percent, a bias with obvious and serious equity implications for any institution serving international or multilingual students. These are not marginal failure rates that better engineering will straightforwardly fix; they reflect a structural problem in trying to statistically distinguish fluent human writing from fluent machine writing once both are genuinely fluent and the practical consequence has been a wave of institutions quietly turning off detection tools they had previously adopted, even as detection vendors continue to market accuracy claims that go largely unverified by any independent standard.^[23]

If detection cannot accurately answer where the line sits after the fact, the more promising approach documented in the literature is to specify the line in advance, assignment by assignment, rather than leaving it to be inferred from a single blanket policy. The most developed framework for doing this is the Artificial Intelligence Assessment Scale, first published in 2024 by Mike Perkins, Leon Furze, Jasper Roe and Jason MacVaugh and subsequently revised in response to feedback from educators worldwide. The framework’s central insight, consistent with the cognitive-load distinction developed in the previous section, is that a single institutional rule cannot sensibly govern every assignment, because different assignments are designed to measure different things. An assignment intended to assess a student’s independent writing fluency reasonably permits no AI use at all; an assignment intended to assess conceptual synthesis might permit AI for brainstorming provided the student submits original notes and a reflective account of what the tool contributed; and an assignment intended to build critical evaluation skills might deliberately ask students to critique an AI-generated answer and identify what in it is accurate, incomplete, or misleading. By 2026 the scale had been adopted by several hundred institutions and translated into more than thirty languages and it has been formally recognized by Australia’s national tertiary quality regulator as an acceptable mechanism for communicating AI expectations to students, which suggests the framework has moved from an academic proposal to genuine operational infrastructure rather than remaining an unused thought experiment.^[24]

The evidence on where this boundary is most consequential in practice, however, complicates any assumption that clarity alone will resolve the basic tension, because the temptation to cross an acceptable-use line appears to scale with frequency of use rather than with any fixed individual disposition toward dishonesty. The largest study of its kind, led by Igor Chirikov of the University of California, Berkeley, in collaboration with researchers at the University of Technology Sydney and Cornell University, surveyed more than ninety-five thousand undergraduates across twenty research-intensive public universities and was published in Science in May 2026. The study found that roughly two-thirds of respondents used generative AI at all, with close to forty percent using it monthly or more often and that at least nine percent of AI-using students admitted to using it in ways they understood to constitute cheating, a figure the authors describe as conservative given the indirect survey method used to encourage honest self-reporting on a sensitive behavior.^[25] The more striking finding concerned the relationship between frequency and misuse: twenty-six percent of daily AI users reported using the tool to cheat, compared with only seven percent of monthly users, a gradient the study’s authors describe as a slippery slope rather than a fixed line, in which habitual use erodes the self-regulatory friction that would otherwise prompt a student to ask whether a given use is permitted. Reporting on the study, Chirikov noted that AI policies vary enormously not only between institutions but between individual courses at the same institution, from faculty who permit AI throughout an exam to faculty who ban it outright and that this inconsistency makes self-regulation genuinely difficult even for students who intend to comply, because ordinary tools such as search engines and grammar checkers already embed AI features that blur the line the student is trying to observe.^[26]

This same study surfaces a second finding directly relevant to where institutional boundary-drawing should be targeted: cheating with AI was not evenly distributed across academic disciplines, with non-STEM students reporting higher rates of AI-assisted cheating than STEM students, which argues against a single university-wide rule and toward the discipline-specific and even course-specific calibration that the assessment-scale literature already recommends. The study also documented a disparity that recurs across nearly every dataset examined in this paper: students from lower-income backgrounds, from underrepresented racial groups and female students were all significantly less likely to use generative AI tools at all, a gap the researchers describe as more concerning than the cheating finding itself, because it implies that unequal access to capable AI tools, driven by the cost of premium subscriptions and the usage limits attached to free tiers, may translate directly into unequal preparation for a labor market that increasingly rewards AI fluency.^[27] The Sydney cognitive-offloading report reaches a structurally identical conclusion from a different empirical base, describing what it terms a new metacognitive equity gap: students who already possess strong domain knowledge and self-regulation skills are positioned to use AI for beneficial offloading and accelerate their learning, while students who lack these foundations are disproportionately exposed to detrimental offloading and the illusion of competence it produces, a dynamic the report likens to the Matthew effect long documented in reading research, in which early advantages compound rather than equalize over time.^[28] Any boundary-drawing exercise that treats access to AI as uniform across a student population will therefore systematically misjudge both the benefit and the risk of the tool for different groups within that same classroom.

A further complication, evident from informal faculty discussion as much as from published research, is that professors themselves frequently disagree about where legitimate assistance ends, particularly at the undergraduate level where the line between AI as a research aid and AI as a ghostwriter is genuinely contested even among experienced instructors. This disagreement is not evidence that the boundary cannot be drawn; it is evidence that the boundary cannot be drawn once, generically and then left alone. The most defensible response, consistent with the framework described above, treats the standard set at the most demanding and best-resourced level of the education system, typically graduate and professional programs where the stakes of unverified competence are highest, as a reference point that can meaningfully inform standards further down the system, since students who understand early that unverified AI reliance will not survive scrutiny at the college level have a concrete reason to build the underlying capability in high school rather than deferring the problem. This is not a claim that a single national standard should be imposed top-down; it is a claim that visible, well-justified rigor at the upper end of a system changes the incentives faced by students and teachers throughout the system beneath it, in much the same way that university admissions standards have long shaped instruction in the secondary schools that feed them.

4. Given the New Boundary, Teaching Programs Must Evolve

The preceding two sections establish that AI use should be redirected toward supporting thought rather than replacing it and that the boundary between the two must be set with more granularity than a single institutional rule can provide. Neither conclusion is actionable, however, unless the instructional materials and assessment instruments through which teaching actually happens are redesigned to match. The historical precedent most frequently invoked for this kind of transition, the introduction of the pocket calculator into mathematics education in the 1970s and 1980s, is instructive, but a careful reading of that precedent, developed at length by the Brookings researcher Niam Yaraghi, suggests that generative AI poses a harder version of the same problem rather than a repetition of it and that the policy response therefore needs to be more conservative, not less, than the one mathematics education eventually settled on.

The calculator precedent worked because arithmetic instruction adopted a strict sequencing rule: students mastered manual computation before calculators were introduced and calculators were then treated as instruments of speed rather than substitutes for the underlying competence, which meant a student retained an internal sense of whether a calculator’s output was plausible.^[29] Generative AI breaks this precedent in three specific ways that matter for how teaching programs must be redesigned. First, a calculator is reliably correct within its domain, whereas an AI system can produce a confidently wrong answer that only the user’s own domain knowledge will catch, meaning a student without that knowledge is worse off than a calculator user, not simply no better off. Second, a calculator executes an operation the student has already decided to perform, whereas an AI system frequently chooses the framing of the problem itself, silently performing the part of the cognitive work, deciding what question is actually being asked, that domain expertise is specifically built by practicing. Third, the convenience differential is enormous by comparison: a calculator saves a student seconds of arithmetic, while a language model can produce an entire essay, memo, or research summary, so the incentive to skip the underlying developmental work scales with the size of the shortcut being offered.^[30] These three differences argue for sequencing that is, if anything, stricter than the calculator model achieved, with a correspondingly higher bar for permitting unrestricted use than arithmetic instruction ever required.

Translating this into concrete curricular change requires distinguishing what is properly the responsibility of individual teachers, what belongs to departments and institutions and what requires action from professional and accreditation bodies, because collapsing these levels together produces exactly the vague calls for adaptation and literacy that this paper’s brief explicitly warns against. At the level of individual course design, the clearest available example of assessment redesigned specifically to resist naive AI use comes from graduate programs built around applied case analysis rather than recall. One illustrative practice, adopted at a graduate business-and-analytics program built around applied AI coursework, structures final examinations around the requirement that students apply a specific theoretical framework drawn from an assigned text to a scenario the framework was not written to describe, a design that rewards demonstrated command of the underlying theory and penalizes the kind of generic, pattern-matched response that an AI system produces when it has not been given the specific analytical scaffolding the course has spent a semester building.

The general design principle this illustrates, requiring students to apply, rather than merely recall or summarize, a body of theory to a genuinely novel case, is consistent with the wider research finding that critical thinking is not a generic, transferable skill but is instead deeply dependent on the specific domain knowledge a student has actually internalized, which is precisely the knowledge that unrestricted AI access allows a student to bypass building in the first place.^[31] The STA501 final examination offers a concrete illustration. The ChatGPT-generated response identifies familiar terms such as measurement error, instrumental variables and endogeneity, whereas the solution key explains the direction of bias, defends the proposed instrument and carries the same theoretical assumptions across linked questions. The comparison shows whether the student can reconstruct and defend the reasoning rather than merely reproduce technically plausible terminology.^[32]

At the level of instructor practice more broadly, the evidence reviewed in the first section of this paper points toward assessment that privileges process visibility over final-product polish. Instructors surveyed by RAND and by the Wisconsin study described earlier reported adopting oral components, in-class handwritten work and staged submission of drafts specifically to preserve some direct evidence of independent thinking, changes that do not require new technology so much as a willingness to accept that the finished, polished essay can no longer act as reliable proof of learning on its own. The RAND report frames this shift explicitly in terms of the offloading distinction developed earlier: school and district leaders are advised to identify, assignment by assignment, whether a given use case is likely to produce cognitive offloading, defined there as AI doing the mental work for the student, or cognitive augmentation, defined as AI prompting the student toward deeper, more independent work and to design instruction around that distinction rather than around a single yes-or-no rule for AI in the classroom overall. One concrete instructional model recommended for this purpose is the flipped classroom, in which students first encounter new material independently, whether or not AI is involved in that first encounter and then complete guided practice during AI-free class time under direct teacher supervision, preserving at least one setting in which independent capability can be directly observed.^[33]

At the level of institutional and professional credentialing, the argument developed by Yaraghi is the most fully worked out in the current literature and deserves extended treatment because it identifies a policy lever that individual teachers cannot pull on their own. His proposal is that any credential whose value depends on the holder’s underlying capacity - a university degree, a medical license, a bar admission, a professional accounting qualification - should require the credentialing body to certify that the holder has demonstrably developed that capacity without AI assistance at some defined stage of their training, even if AI was used freely elsewhere in the same program.^[34] The reasoning behind this proposal rests on empirical findings about where AI genuinely helps and where it does not. In a large field experiment involving over five thousand customer-service agents at a Fortune 500 firm, published in the Quarterly Journal of Economics, access to a generative AI assistant raised average productivity by roughly fourteen to fifteen percent, but this gain was concentrated overwhelmingly among the least experienced workers, whose output improved by around thirty-four percent, while the most experienced agents saw only marginal gains and in some measures a slight decline in quality.^[35] A separate, preregistered field experiment conducted with the Boston Consulting Group, involving seven hundred and fifty-eight professional consultants, found a structurally similar pattern that the researchers termed a jagged technological frontier: for tasks that fell within the AI’s genuine capability, consultants using it were both faster and produced measurably higher-quality work, but for a task deliberately designed to fall outside that capability, performance among AI-assisted consultants fell by roughly nineteen percentage points relative to the unassisted group, because the consultants, lacking the domain expertise to recognize when the tool had failed, followed its confident but wrong output anyway.^[36] The uncomfortable implication of both studies together is that the very expertise required to use AI safely on the hardest, most consequential tasks is the expertise that unrestricted, unstructured AI use during training makes it harder to build in the first place, which is precisely the developmental externality that Yaraghi’s credentialing proposal is designed to address.

This same body of evidence points toward a labor-market pattern that gives the credentialing argument added urgency rather than remaining a purely academic concern. Using payroll records covering millions of American workers, researchers at Stanford’s Digital Economy Lab found a roughly sixteen percent relative decline in employment for workers aged twenty-two to twenty-five specifically in occupations most exposed to generative AI since the technology’s general adoption, while employment among older workers in the same occupations remained essentially stable.^[37] A separate analysis of resume and job-posting data covering sixty-five million workers across two hundred and eighty thousand firms found that companies actively adopting generative AI sharply reduced hiring at the junior level relative to firms that had not adopted it, a pattern the researchers describe as seniority-biased technological change, driven not by layoffs of existing juniors but by firms simply declining to hire new ones, since AI now performs much of the routine drafting and information-retrieval work that entry-level positions traditionally existed to teach.^[38] If firms are hiring fewer juniors precisely because AI has absorbed the developmental work those roles used to provide, then educational institutions cannot treat their own AI-adoption decisions as separable from this labor-market shift; a graduate who has never practiced the underlying skill unaided arrives at a labor market that is simultaneously offering fewer structured opportunities to practice it on the job, compounding rather than offsetting the deficit built during schooling.

A final piece of evidence, concerning research and creative output rather than routine task performance, bears directly on how teaching programs should think about the cumulative effect of encouraging AI-assisted work across an entire cohort rather than in any single classroom. In a controlled experiment published in Science Advances, Anil Doshi and Oliver Hauser found that access to generative AI ideas measurably improved the individually assessed creativity of short stories, with the largest gains concentrated among the least inherently creative writers, effectively narrowing the gap between weaker and stronger writers on an individual basis. At the same time, the stories produced with AI assistance were measurably more similar to one another than stories produced without it, meaning the same intervention that improved individual output simultaneously reduced the diversity of ideas across the group as a whole. This finding matters for curriculum design because it demonstrates that an assessment regime optimized purely to raise the average quality of individual student work, a reasonable-sounding goal in isolation, can coexist with a systematic narrowing of the range of thinking a cohort produces collectively, which is precisely the kind of second-order, aggregate effect that assessment focused only on individual grades will never detect and that a program-level evaluation, not exclusively a course-level one, is required to notice.^[39]

Taken together, these three levels of change, redesigned individual assessments, instructor practices that preserve visible evidence of independent thinking and institutional credentialing that certifies unaided capability at defined checkpoints, describe a coherent response to the argument developed across this paper, but they share a common precondition that deserves explicit statement: none of them can be implemented by teachers who do not themselves understand how these systems work, where they fail and what structured versus unstructured use actually looks like in practice. Investment in that specific form of educator preparation, distinct from generic technology training, is likely the single highest-leverage policy lever available to the institutions this section has been discussing and it is also, on the current evidence, the one most consistently underfunded relative to its importance.^[40]

Conclusion - What Happens If Education Does Not Act Now?

The evidence assembled here points toward a specific and avoidable failure mode rather than a vague technological anxiety. If the redirection of AI use described in the first section, the calibrated boundary-drawing described in the second and the credentialing and curricular reform described in the third are not undertaken, the population entering the workforce over the coming decade will disproportionately consist of graduates whose credentials certify capability that was never independently built, because the developmental work those credentials are supposed to represent was quietly outsourced during the years it should have been practiced. This is not primarily a story about individual laziness; it is a story about an education system and a labor market that, left to their current incentives, jointly remove the conditions under which expertise has always been formed, replacing effortful practice with fluent, confident output that looks like competence without reliably being competence. Firms are already hiring fewer junior workers precisely because AI performs the routine work that once trained them, narrowing the pipeline that would produce the next generation of senior judgment at the same moment schools are declining to certify that unaided judgment was ever built in the first place. The resulting productivity gains are real but borrowed, sustained by an expert generation whose capability predates these tools and unlikely to persist once that generation retires without deliberate institutional effort to replace what it is quietly spending down. The appropriate response is neither to prohibit AI, which the adoption data show is no longer a live option, nor to defer to it uncritically, but to insist, through assessment design, credentialing standards and teacher preparation, that the distinction between having used a tool and having built the capacity it assists remains visible, checkable and consequential, before the institutions responsible for drawing that distinction lose the capacity to draw it at all.

References

[1, 2, 21] Spitalniak, L. (2026) ‘90% of students use AI in the classroom, Instructure poll finds’, Higher Ed Dive, 21 July.

[3, 4] Freeman, J. (2025) Student Generative AI Survey 2025. HEPI Policy Note 61. Oxford: Higher Education Policy Institute, in partnership with Kortext.

[5] College Board (2025) New Research: Majority of High School Students Use Generative AI for Schoolwork. New York: College Board Newsroom.

[6, 7, 33] Schwartz, H.L. and Diliberti, M.K. (2026) More Students Use AI for Homework, and More Believe It Harms Critical Thinking: Selected Findings from the American Youth Panel. RR-A4742-1. Santa Monica, CA: RAND Corporation.

[8, 10, 11, 15, 16, 18, 28] Lodge, J.M. and Loble, L. (2026) Artificial Intelligence, Cognitive Offloading and Implications for Education. Sydney: University of Technology Sydney, Network for Quality Digital Education.

[9, 21, 22, 23, 33] DeJager, B. (2026) ‘84% of students use AI for homework. Only 3 in 10 schools have rules for it’, Fortune, 16 July. Republished from The Conversation.

[12, 13, 17] Bastani, H., Bastani, O., Sungu, A., Ge, H., Kabakcı, Ö. and Mariman, R. (2025) ‘Generative AI without guardrails can harm learning: Evidence from high school mathematics’, Proceedings of the National Academy of Sciences, 122(26), e2422633122.

[14] Hong, H., Vate-U-Lan, P. and Viriyavejakul, C. (2025) ‘Cognitive offload instruction with generative AI: A quasi-experimental study on critical thinking gains in English writing’, Forum for Linguistic Studies, 7(7), pp. 325–334.

[16] Duplice, J. (2025) ‘Generation and L2 vocabulary learning’, Vocabulary Learning and Instruction, 14(1), 102482.

[16] Fan, Y. et al. (2024) ‘Beware of metacognitive laziness’, British Journal of Educational Technology, 56(2), pp. 489–530.

[17] Weidlich, J., Gašević, D., Drachsler, H. and Kirschner, P. (2025) ‘ChatGPT in education: An effect in search of a cause’, Journal of Computer Assisted Learning, 41(4), e70105.

[19] Black, R.W. and Tomlinson, B. (2025) ‘University students describe how they adopt AI for writing and research in a general education course’, Scientific Reports, 15, 8799.

[20] McQuiston, P. (2025) ‘AI is changing how students learn, or avoid learning’, USC Today, 18 September.

[24] Perkins, M., Furze, L., Roe, J. and MacVaugh, J. (2024) ‘The Artificial Intelligence Assessment Scale: A framework for ethical integration of generative AI in educational assessment’, Journal of University Teaching and Learning Practice, 21(6), pp. 49–66.

[25, 26, 27] Kapoor, M.L. (2026) ‘The largest study of AI use by undergrads is in, revealing disparities in access, and in cheating’, University of California News, 28 May.

[29, 30, 34, 40] Yaraghi, N. (2026a) ‘Repaying the inheritance: How education and research policy can address AI’s borrowed expertise’, Brookings Institution, 20 July.

[31] Willingham, D.T. (2019) ‘How to teach critical thinking’, NSW Department of Education.

[31] Tricot, A. and Sweller, J. (2014) ‘Domain-specific knowledge and why teaching generic skills does not work’, Educational Psychology Review, 26(2), pp. 265–283.

[31, 32] Swiss Institute of Artificial Intelligence (2021) STA501: Data-Based Decision Making: Final Examination 2021. SIAI institutional teaching material.

[31, 32] Swiss Institute of Artificial Intelligence (n.d.) STA501 Final 2021 Solution Key for External Audiences’ Reference. SIAI institutional teaching material.

[35] Brynjolfsson, E., Li, D. and Raymond, L.R. (2025) ‘Generative AI at work’, The Quarterly Journal of Economics, 140(2), pp. 889–942.

[36] Dell’Acqua, F., McFowland III, E., Mollick, E.R., Lifshitz-Assaf, H., Kellogg, K.C., Rajendran, S., Krayer, L., Candelon, F. and Lakhani, K.R. (2023) Navigating the Jagged Technological Frontier: Field Experimental Evidence of the Effects of Artificial Intelligence on Knowledge Worker Productivity and Quality. Harvard Business School Working Paper No. 24-013.

[37] Brynjolfsson, E., Chandar, B. and Chen, R. (2025) ‘Canaries in the coal mine? Six facts about the recent employment effects of artificial intelligence’, Stanford Digital Economy Lab Working Paper, August, revised November.

[38] Hosseini Maasoum, S.M. and Lichtinger, G. (2025) ‘Generative AI as seniority-biased technological change: Evidence from U.S. résumé and job-posting data’, SSRN Working Paper, August.

[39] Doshi, A.R. and Hauser, O.P. (2024) ‘Generative AI enhances individual creativity but reduces the collective diversity of novel content’, Science Advances, 10(28), eadn5290.