Box

47% of organizations have already experienced a security incident involving an AI agent, according to the Cloud Security Alliance. And yet most enterprise security strategies were not built for this reality. The patterns showing up across security teams right now: → The threat is not an external attacker. It is an agent inside your environment with legitimate credentials, doing things it was never supposed to do. Prompt injection hidden inside documents can turn a helpful agent into a data exfiltration vector that perimeter defenses do not catch. → Agents without guardrails can act at machine speed. They can access content outside their intended scope, add external collaborators to sensitive folders, or take bulk actions before anyone notices. Define operational boundaries before deployment, not after an incident. → If you cannot audit it, you cannot govern it. Visibility into what agents actually did is one of the most common gaps practitioners flagged. Immutable audit trails are becoming non-negotiable for compliance and eDiscovery readiness. These insights came out of a recent Box community roundtable on AI agent security and governance. Be sure to check out our full recap if you are responsible for governing AI agents in your organization.

We evaluated Anthropic’s Claude Fable 5.1 on Box's Complex Work Eval. Real document tasks, end to end, graded against a detailed rubric with confidently-wrong answers penalized. Fable 5.1 scores 72% overall to Fable 5's 65% winning a clear majority of tasks head to head. What stood out to us: → Financial Services (82% vs 63%): held a multi-step financial projection chain correctly where a single wrong calculation would cascade through every downstream number. → Technology (74% vs 36%): hedged correctly on an ambiguous metric normalization, computing both forms and presenting the right one without triggering penalty criteria. → Public Sector (74% vs 58%): inferred category membership from contextual clues and recomputed scores under a revised scheme without cascading errors. → Data Analysis (69% vs 56%): the sharpest gain by type of work, reflecting reliability on tasks where one wrong step invalidates everything downstream. And it did all of this 23% faster and with 25% fewer total tokens than Fable 5. More accurate and more efficient at the same time.

Box is proud to be a signatory of OpenAI's call for collective action on cyber defense, alongside more than 150 other industry leaders. At Box, our contribution starts with the content layer. Governing what AI agents can access, read, and act on, with classification-based controls, immutable audit trails, and prompt injection defenses, is how we help organizations strengthen their security posture as agents become a larger part of their environment. Enterprise content is where the most sensitive data lives. It is also where the most important security decisions get made. Read the full letter here: https://lnkd.in/gFeKj4Q7

The defining conversation on where AI and the enterprise content are headed next is happening live on the main stage at BoxWorks, and you’ll definitely want a front-row seat. We are thrilled about this years’ extraordinary keynote lineup featuring three of the industry’s most visionary minds: • Aaron Levie- Co-Founder & CEO, Box • Jensen Huang - Founder & CEO, NVIDIA • Lip-Bu Tan - CEO, Intel Hear them unpack today’s biggest business challenges, and see how one secure AI platform turns content into your competitive advantage with trusted insights and powerful agent automations. Don’t miss out. Mark your calendar today and register to join us on November 5-6! Register here: https://lnkd.in/gFHAAFxN

Box Drive now connects directly to Cursor from your desktop. If you have the Cursor desktop app installed, you can right-click any file or folder in Box Drive and open it directly in Cursor, giving you instant access to your Box content inside your IDE without downloading files or switching between tools. Here’s what that looks like. A developer right-clicks a PRD stored in Box Drive, opens it in Cursor, and asks it to build an app based on the specs. Cursor reads the full requirements document and generates the results, all without the spec ever leaving Box. Your product specs and your development environment finally in the same flow, with your Box content governed and accessible the whole way through.

AI is only as useful as the context it can access. With Claudeforce, Claude can tap into live Salesforce data, workflows, and business logic through Headless 360. But some of the most important context behind those business processes lives in enterprise content — contracts, proposals, policies, presentations, and more. That’s where Box comes in. Through the Box MCP Server, Claude can securely access and work with governed content in Box while respecting existing permissions and access policies. Together, these independent connections give Claude the context to understand not just what’s happening in the business, but the content behind it. Box + Claudeforce: bringing governed enterprise content to every AI agent.

Blocking AI across your company does not make you safer. It only makes the AI your employees use invisible to you. When security teams issue blanket bans, adoption does not stop. People still look for ways to work faster, but they turn to personal accounts, unmonitored tools, and shadow workflows touching sensitive business data. During a recent discussion with Manoj Asnani (VP of Product Management for Security & Compliance at Box), Bain Capital CISO Mark Sutton pointed out that prompt injection is not a routine bug you patch and forget. It is a permanent risk class, much like phishing. The practical baseline: treat every document as potentially hostile and build your architecture around that assumption. Effective governance works like guardrails on the shoulder of a highway rather than speed bumps in the middle lane. Controls should step in only when activity crosses defined boundaries, backed by solid data classification and clear access controls. What is the biggest operational hurdle stopping your security team from shifting from outright bans to active governance?

Productions manage an extraordinary amount of information beyond what ultimately appears on screen: scripts, pitches, schedules, budgets, reports, contracts…the list is endless. And at every step of the way, that information needs to be secure, accessible, and organized so key decisions can be made confidently and efficiently. Today, Showrunnr and Box are working together to give production teams and their collaborators a smarter way to manage information and structure data, without adding complexity to an already demanding workflow. Whether you’re an industry veteran at a studio or a first-time line producer on an indie project, or anyone in between - the Showrunnr-Box integration is a game-changer. Showrunnr is the first execution platform purpose-built to support the business of production in media and entertainment. Giving teams a centralized place to coordinate the operational work behind a production, it dynamically connects all the people, resources, schedules, suppliers and workflows required to bring projects from concept to the screen. Box is an industry leader in Intelligent Content Management, helping production companies and studios securely store, manage, collaborate, and get more value from their content. With both platforms offering enterprise-grade security, flexible integrations, workflow capabilities and AI-powered tools, Showrunnr and Box are now working together to close the gap for customers between managing production content and actionable production intelligence. “Production teams are under increasing pressure to move faster and make smarter decisions, and that requires technology that connects the content, data, and workflows behind every project rather than keeping them siloed,” said Jamie Young Perlman, Vice President of Global GTM Partnerships at Box. “We’re excited to work with Showrunnr to create a more connected experience for production teams and explore what’s possible when the tools they rely on every day work seamlessly together.” We’re thrilled to work with Box to deliver the next-generation step in connected production workflows for the industry. The future of production technology isn't about adding more tools, it’s about making the tools you already depend on work better together for you. #Showrunnr #Box #FilmProduction #EntertainmentTech #ProductionIntelligence #ContentManagement

DeepSeek AI’s new V4 Flash Vision experiment accepts images as well as text. Developers can submit screenshots and charts in prompts, then reuse uploaded images across requests. That puts more of the content businesses rely on — scans, charts, forms and other visually complex files — within reach of AI models. But model access alone does not make a scan ready for automation. The information still needs to be identified, structured, checked and routed to the right system or person. A recent Box Extract Product Showcase demonstrated that workflow. OCR first makes the document machine-readable. The system then identifies the document and relevant information, extracts and refines the data, validates the result, sends uncertain cases for human review, and delivers structured output through APIs and integrations. Box’s 2026 State of AI in the Enterprise research shows why this matters. Almost half of IT decision-makers, 49%, said automated structured-data extraction was very important to powering downstream workflows. Among leading-edge organisations, that figure rose to 70%. As vision models improve, more contracts, forms, charts, scans and other business content will enter AI workflows. The IT challenge is making sure the resulting data is trustworthy enough to act on.