From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Billy Hurley

itbrew.com

ChatGPT offers fast help to coders with questions

As Microsoft announces greater access to ChatGPT, developers see possibilities for coders.

Brianna Monsanto

It’s all fun and games until the person in charge of managing your organization’s AI subscriptions decides to leave.

The above scenario is not so far-fetched. As companies 

, it may seem natural to designate the responsibility for the tools to one tech-savvy person in the organization. But what happens when that person’s time at the company comes to an end?

Zander Deitz, VP of sales at AI and SaaS portfolio management company Productiv, told IT Brew that documentation comes in handy for companies in the era of AI, especially when transitioning AI-related responsibilities from one person to another.

“If you don’t have a good system in place that is easy for someone to pick up and understand on day one, whether it’s the person directly managing AI or some other process…you’ve just backlogged their work by months,” Deitz said.

 So, who’s ultimately responsible for an organization’s AI products and subscriptions? Deitz said the answer will vary from organization to organization.

“If it’s a smaller startup-type company, this is going to typically fall immediately on the CIO or CISO,” Deitz said. “They’re going to be in charge of building a governance policy when it comes to AI, selecting approved tools, reviewing embedded AI within applications, [and] ensuring contract terms are in line with what their policy is.”

A larger organization may have more resources for managing AI responsibilities, Deitz said, adding that a 

 may be responsible for this, or tasks might even be delegated to a specific AI task force.

Neuralogics Group CTO Christian O. Petersen cautions against dumping the responsibility of AI products and applications solely on the IT department.

“All AI needs to have both the business owner and a tech owner. That’s really fundamental,” Petersen said. “And it’s never been more important than now because…we’re moving towards a future where there’s nothing we do in a business that’s not going to be somewhat or largely AI-powered.”

Petersen said documentation is essential for 

, and that companies need to approach it from both a business and tech perspective. On the business side, Petersen said companies need to identify the objectives of the department using an AI application and how AI contributes to them.

“Now you actually have complete agreement on why we have this AI in the first place,” Petersen said. “Based on that, it’s really easy to decide what it [is] that we want to use it for. Are there things we don’t want to use it for?”

On the tech side, Petersen said departments should also document which AI tools can access which data. Having this information written down informs incoming employees about who’s responsible for overseeing and securing AI.

“There’s no surprises,” Petersen said. “We know why we have it. We know what it’s supposed to do. We know how we’re supposed to use it.”

Unclear documentation of AI within the organization can cause problems for organizations down the line, according to Deitz.

“You don’t necessarily have to have rigid policies against everything, but if you don’t know what’s going on and what people are using approved and unapproved [tools], and if you’re not bringing those unapproved things behind SSO [single sign-on], you expose yourself to giant lawsuits if somebody puts sensitive data into a system, even by accident.”

Photo collage of an AI icon in between two hands pointing at each other contained within abstract shapes.

Who really controls AI in an organization?

One professional says documentation is key to sharing AI protocols and approved usage with incoming employees.

Caroline Nihill

OpenAI is expecting to see more attackers use ChatGPT and other AI models to produce malicious code and tools, according to a new report. However, the company sees no evidence that attackers are using its AI models to produce novel offensive capabilities.

, OpenAI outlined several instances where it disrupted bad actors, including nation-state actors and criminal groups, who were attempting to use ChatGPT’s capabilities to produce malware or engage in other nefarious activities against what the company called “the democratic principles America has always stood for.”

“[Promoting democratic AI] includes preventing the use of AI tools by authoritarian regimes to amass power and control their citizens, or to threaten or coerce other states; as well as activities that may result in society-scale harms such as malicious cyber activity, organized crime and scams, and covert influence operations,” the report stated.

 to the White House Office of Science and Technology Policy’s AI Action Plan as evidence of the company’s commitment to building and maintaining “democratic AI.”

OpenAI did not respond to a request for comment in time for publication.

The company reportedly found individuals linked to People’s Republic of China (PRC) government entities using ChatGPT to help with “development, profiling, and bureaucratic functions.”

Specifically, some of those accounts were trying to use ChatGPT for large-scale monitoring activities, such as analyzing datasets gathered from social media platforms. OpenAI reported users asked the model to help design tools and generate promotional materials, but hadn’t put actual monitoring into practice.

“For example, we recently banned a user, possibly using a VPN to access our services from China, who was asking ChatGPT to help design promotional materials and project plans for a social media listening tool, purportedly for use by a government client,” the report said.

OpenAI described its disruption tactics as banning users who appeared to be linked to PRCe government entities and seemed to be using ChatGPT for “more bespoke” targeted profiling and online research. According to the report, the models only returned publicly available information instead of sensitive details when utilized by political actors.

In another case study, OpenAI pointed to a Russian-language malware tool developed through vibe coding. The company disrupted the use of the tool, which it linked to Russian-speaking criminal groups.

According to the report, OpenAI discovered accounts trying to use ChatGPT to develop and refine malicious tools that included credential stealers, a remote-access trojan, and features to evade detection. With safeguards in place, the models “refused requests that were clearly malicious and lacked any legitimate application,” and didn’t execute any threat actor tooling and workflows.

 OpenAI reported that it interrupted threat actors who seem to be using various AI models for recidivism, or repeated harmful activity, and phishing.

The company reported individuals involved in these harmful activities have been adapting their behavior, including scrubbing signs of AI usage from their content—specifically manually removing the use of em-dashes before publication.

Zohaib Ahmed, CEO of deepfake detection platform Resemble.ai, told IT Brew in an email that OpenAI’s approach to preventing misuse is at the model level, and the industry still needs additional detection capabilities.

“That’s important, but the report shows bad actors are using multiple AI providers and hopping between models when they get banned,” Ahmed wrote. “This is why detection infrastructure is critical—you can’t rely on model-level restrictions alone.”

OpenAI releases disruption report for malicious uses of AI

OpenAI reports bad actors have been scrubbing the better known signs of AI usage from their content.

Curiosity may have killed the cat…but for Microsoft veteran Stefan Weitz, it opened a lot of doors.

Curiosity is what led Weitz, who described his younger self as the “prototypical ’80s nerd kid” who loved his computer and 

, to his first gig outside of college with Andersen Consulting, a premier consulting firm.

“I did that because I like the idea of trying different things,” Weitz told IT Brew. “Part of my problem, honestly, is I love to learn different things, which is great, but also from a career perspective, it can be kind of sketchy, because you kind of bounce around.”

His knack for trying new things is what attracted him to Microsoft after Andersen embedded him in the tech giant as a consultant.

“When I was there, I was sitting in RedWest, which was a new building at the time…I looked around as I was having lunch with these people and said, ‘These are all people like me. They’re all just nerds who really just loved the work and loved the puzzles and loved the challenges,’” Weitz recalled.

After six months, a Microsoft recruiter approached Weitz to make his stay permanent with one line: “You can either stay with the Navy or join the pirates” (Microsoft being the pirates in this analogy).

“That was the pitch that got me over,” Weitz said.

Weitz’s time at Microsoft spanned almost two decades, during which he juggled several titles and opportunities.

“I would basically ingratiate myself with different organizations and then they’d say, ‘Well, okay, just come run it then,’” Weitz said.

One of Weitz’s most notable projects as a Microsoftie: helping launch Microsoft’s Bing search engine, which was designed to compete against Google. Part of the challenge of launching a brand-new search engine was not only the need to build something different from the competition, but also persuade people to try it, he said.

“That was literally building a product that nobody said they wanted and then convincing people they actually wanted it,” Weitz said.

The team ended up producing a “decision engine” designed to help users quickly move past “basic” search to find and utilize the information they needed. “So, if you looked at flights to Boston from Seattle, we would give you all the stuff you’d usually see, but we then have a prediction as to whether or not you should buy it now or wait,” Weitz said.

While Bing’s market share was never able to surpass Google’s, the work that Weitz’s team did had a lasting impact.

“It’s helped a lot with the AI efforts because a lot of the work we did in Bing early days…kind of laid the groundwork for a lot of the work in how AI operates today,” Weitz said.

In 2016, Weitz closed his chapter at Microsoft to focus on his love of building. Since then, he has been up to just about everything under the sun, including running the e-commerce fulfillment solution provider Radial for a few years, co-founding a PTSD treatment company, and starting up a music superfans platform.

“I love to go from zero to one,” Weitz said. “I love to have the idea and then get the thing running, and get it all stood up, and then hand it off to somebody to actually really run it. That’s my throughline there, for sure.”

Weitz’s journey after Microsoft hasn’t followed the traditional playbook of ex-Microsofties, but isn’t out of character for Weitz, according to Matt Wallaert, chief experience officer at outsourcing company Oceans and former Microsoft colleague of Weitz, who said Microsoft employees tend to stay with the company long-term or leave the tech giant to chase roles at similar companies.

“You just don't see that many people who go and do something entrepreneurial and do it really well and dive into that with discipline,” Wallaert said. “Stefan is a really shining example of what it looks like to find a second act that is meaningful and thoughtful.”

 These days, Weitz is known for his event-planning skills. Earlier this year, he tried his hand in the conference industry, co-founding the HumanX conference, an AI-centric conference. Inspiration for the conference came after he noticed some industry leaders’ AI investments remained stagnant, as well as a lack of general-purpose AI gatherings.

“I said, ‘Well, shoot, if we’re relying on enterprises to figure their way through this cacophony of innovation that’s happening every single day, we are going to, at best, under-deliver on the promise of what AI can do,” Weitz said.

The conference’s inaugural year went better than Weitz expected, who said the conference industry is not for the “faint of heart.” Even so, he sees room for improvement for year two, including the type of content the conference will focus on.

“It’s very much more focused on the role of the person, not the industry in which they find themselves,” Weitz said. “We’ll have some that are more geared towards that, but the majority is going to be focusing on the people and the job they have to do.”

As a co-founder of one of the largest AI conferences, he advised young AI talent to remain curious and open to challenges, two of the skills that worked in his favor in his own career.

“That curiosity and that lack of determinism is what’s missing in a lot of young people today, but also is the opportunity for those who identify that to thrive.”

A portrait of co-founder and CEO of Human X, an AI conference, Stefan Weitz.

Why this Microsoft veteran’s next act is AI conferences

The Microsoft veteran recalls what it was like to launch the Bing search engine.

As many employees use GenAI platforms to find the right answers to tech and business conundrums, some of their colleagues see value in collecting the right questions.

Three IT professionals shared what they learned after implementing “prompt libraries” for their organizations. Whether adding 50 new prompts in one month like West Monroe’s Reva Busby, or stopping at around 5 like PR-firm pro Emily Koehn, a collection of go-to chatbot inputs offers a helpful head start for a variety of tasks within an organization.

“I think a prompt library is important because it allows the use of AI to scale faster,” Busby, director of the commercial growth team at business and technology consulting firm West Monroe, told IT Brew. “You are getting pre-built and well-engineered prompts that you can use right off the bat, without having to have all that knowledge about building a prompt yourself.”

In 2023, West Monroe introduced Nigel, an internal chat platform assisting the company’s 2,000 employees with tasks like drafting emails, writing code, and analyzing datasets.

The platform holds a library of 278 prompts, and has about 12,000 all-time uses (and 8,000 just in 2025), according to data shared by WM.

While Busby did not reveal exact prompts, the director said one prompt for generating a sales email includes case-specific factors for the user to input, including: background information about a client, tone, and output format.

While some prompts may be a sentence long, Busby said, others related to sales or consultant teams are “robust” and may require lots of extra details “because you’re trying to execute a very specific workflow in the context of some repeatable service.”

Busby uses a specific prompt when organizing notes after a candidate interview—one that pulls data like job role, notes, and feedback into desired table formats.

For Koehn, PR account director at Crackle PR, the prompt library is a smaller guide for the nine or so full-time employees using tools like ChatGPT, Perplexity, or Gemini. Prompts exist for main categories like:

 from analytics consulting firm Trust Insights, which factors role, action, context, and execution into the prompts. One helpful prompt for Koehn, she said, pulls the most headline-worthy findings from an uploaded client report.

“Now that gives me a fantastic starting point in minutes,” Koehn said. “Do I still go through every single tab of data and verify that AI didn’t hallucinate? Absolutely. Do I still look at the data to make sure that AI didn’t miss any things that are really significant or interesting? Absolutely.”

A report from the US Chamber of Commerce, which polled over 3,800 businesses in June 2025, found that 58% of small businesses (250 or fewer employees) use GenAI—up from 40% in 2024 and more than double compared to 2023 (23%).

Generative AI is also popular with the companies who are investing heavily in creating it. Microsoft CEO Satya Nadella revealed some 

 recently on LinkedIn, including “Based on my prior interactions with [/person], give me 5 things likely top of mind for our next meeting.”

West Monroe’s library, built “from scratch,” according to Busby, organizes prompts by topics (productivity and performance management, for example) and job role (like sales). A search bar gives employees suggestions for helpful inputs, and prompts can also be ranked and sorted by usage and popularity, Reva said; employees can pin their favorites.

“You need to be able to narrow down quickly to what’s relevant to you,” Busby said.

Recommendation #2. Get everyone involved.

When West Monroe’s Nigel came online, the team noticed a trend: a few people were writing all the prompts. Busby stressed the importance of letting employees “cocreate” on prompts; the firm has even recently offered a prompt-building “wizard” for the non-experts.

As long as a prompt doesn’t include a restricted topic like financials and compensation, Busby noted in a follow-up email to IT Brew, it will appear in the library, and employees can offer ideas and commentary to the prompt author. (The company also highlights standout prompts each month on the company’s homepage, Busby told us.)

Brady Lewis, senior director of AI innovation at marketing consultancy Marketri, has led the refinement of a prompt library that he says has reached 150 full prompts.

Lewis also meets every Monday with a six-person, cross-department AI council to investigate any problems with deployment, and to review new prompts for vague or otherwise troubling results.

And some prompts require…more prompts. Lewis advises employees with frustrating results to copy the output that 

work and try a new LLM (or start over with the same one) “to reframe the question.”

Lewis also has a collection—a small library if you will—of 10 or so prompt blocks. These little promptlets can aid in the construction of new prompts: “I want this formatted specifically in a CSV table format,” for example.

It’s a challenge, Lewis admits—balancing continuous education while not trying to “bombard the employees” with hours of training.

“We can’t control every single aspect of what every single employee does at all times. We’re trying to provide as many guardrails and make things as easy as possible,” Lewis said.

Illustration of an opened book laying on a book shelf with floating ai prompts above.

Best practices for building a prompt library

Three pros share what they learned about collecting good queries.

Something old, something new, something borrowed, something 

. That’s essentially Adaptive Security’s approach to preparing working professionals to keep themselves and their organizations safe against AI-powered attacks.

The newcomer security training company, founded in 2024, provides users with training content to help users better identify threats like 

. However, instead of traditional learning modules, Adaptive delivers customized simulated attacks to employees, such as a phone call with a real-time deepfake of someone within the organization requesting a favor.

Brian Long, Adaptive co-founder and CEO, told IT Brew that the technology used to execute these types of attacks is constantly evolving, making it easier for threat actors to strike—and more crucial for organizations to up their game against such threats.

“Anyone from an eight-year-old to an 80-year-old can make [deepfakes] now in just a few minutes,” he said.

Adaptive’s entry into the industry comes at a time when security awareness training administrators aren’t entirely satisfied with their training content. A recent 

 found that 44% of security awareness training (SAT) professionals feel their 

 is either often or always outdated or irrelevant. A number of security companies, such as Breacher.ai and Arsen Security, are attempting to fill this gap by providing educational content focused on AI-related threats. IT Brew previously reported that 

, a longtime player in the security awareness training space, has plans to release deepfake educational content in 2026.

“Organizations need to understand that, unfortunately, there’s a lot of successful attacks today and they’re growing really, really quickly,” Long said. “We just need to make sure that our workforce across every type of vertical is ready for this threat, because they are not.”

IT Brew caught up with Long to hear his thoughts on how the 

 will change in the next decade and how Adaptive’s content compares to traditional security training incumbents.

These responses have been edited for length and clarity.

Do you think legacy SAT companies still have place and value in today’s threat landscape?

There’s still value because there’s still traditional attacks happening, but organizations need to adjust for where most attacks are going now, and the attackers unfortunately are moving a lot faster right now than many organizations are. So, organizations need to act with urgency in order to get ready for this threat because unfortunately a lot of successful attacks are not reported in the press today.

If a company gets attacked and loses something, they generally don’t tell anyone. They tend to keep it to themselves. So, unless it’s a public entity that has to do some sort of disclosure…it’s generally not being published anywhere. But what I’ll tell you is that if you asked a CISO…a year ago, if they had had this type of deepfake attack be successful at their organization, you probably would hear one in 10. Today if you ask them, it’s over half.

Have you seen a difference in the way users respond to educational content from Adaptive compared to traditional SAT?

To be effective, it has to be relevant and it has to impact the life of the individual. And what’s different about what we’re doing and what you’re able to do now with AI is that I can really personalize the training to you. I can have it be an interactive voice deepfake that’s tailored to just you. I can have all the materials and the trainings specific to you and your organization. And it’s a radical difference from what was the traditional sort of batch and blast, everyone gets the same training…It’s a pretty radical change and as a result, I think that you’re seeing employees actually learn and become aware of something that is changing very, very quickly, which is AI-powered threats.

What are your thoughts on where the security awareness training training industry is heading in the next five years or so?

I think it’s headed for massive innovation. Because social engineering is still part of 90% of successful attacks, we have not done a grand enough job to protect organizations from these attacks. And unfortunately, that’s only going to increase significantly with these new AI tools. The tools are just going to get cheaper. They’re going to proliferate everywhere…The models themselves that allow these attacks to happen, they’re now available open-source, which means anyone can access it and they can run it on their own computer.

So, there’s no moderation…That’s having a huge, huge impact on the volume of attacks that we’re going to see. So, I think you’re going to see companies that play in the security awareness phase having to innovate really quickly in order to make it relevant for where these attacks are going.

A portrait of Adaptive Security CEO Brian Long

How Adaptive Security CEO Brian Long thinks AI-powered attacks will change the SAT industry.

Adaptive Security specializes in security awareness training against AI-powered threats, including deepfakes and vishing.

How Adaptive Security CEO Brian Long thinks AI-powered attacks will change the SAT industry

As if we needed another reason to dislike CAPTCHAs, those site-access tests that make you prove you’re human by selecting blurry photos of traffic lights, motorcycles, staircases, and vertically oriented rivers.

As it turns out, AI bots can solve CAPTCHA challenges, too, even when their programming says 

Dorian Schultz, red-team data scientist at AI security platform provider SPLX, recently 

 in misdirecting a ChatGPT agent to complete some image- and text-based CAPTCHA tests. His secret? A bit of coaxing and prompt injection.

While the SPLX demo revealed that a ChatGPT agent still needs help sliding a puzzle piece or reading some distorted text, recent research has shown AI models figuring out CAPTCHA faster than cybersecurity professionals would like.

The success rate is forcing industry pros to explore new methods of answering the bot-or-not question, including systems that analyze behavior like mouse movements, typing speed, and IP reputation, rather than asking users to select all motorcycles.

“The future is deeper integrations with applications to monitor the behavior of the interaction, and deciding whether that’s a bot or not,” Christos Kalantzis, chief technology and product officer at HUMAN, told IT Brew. “AI is evolving faster than today’s traditional CAPTCHAs can evolve to protect sites.”

A CAPTCHA, or “Completely Automated Public Turing test to tell Computers and Humans Apart,” presents site entrants with a task that’s easy for a human and difficult for a bot to solve, at least in theory. Without CAPTCHAs, a malicious bot could easily gain access to a site, then perform operations like spreading spam or pulling content and credentials.

Cybersecurity company Imperva, in a recent report, found that 51% of all 2024’s internet activity was bot-based.

AI has shown success in completing image- and text-based challenges, even tougher ones. In 2024, Singapore’s Nanyang Technological University researchers revealed how LLMs could solve emerging CAPTCHAs, including one requiring minor Bingo knowledge. An ETH Zurich university team also reported using their “YOLO” imaging model to pass image-based challenges related to Google’s second-generation mechanism, reCAPTCHAv2.

If that wasn’t bad enough for CAPTCHA, they’ve also become a favorite target for threat actors trying to get victims to 

Google’s reCAPTCHAv3, released in 2018, calculates a reliability score rather than presenting a CAPTCHA challenge, determining bots based on “interactions with your site.”

Reid Tatoris, senior director of product at Cloudflare, shared how the company’s CAPTCHA-less Turnstile mechanism (

) uses on-page JavaScript to analyze actions like mouse movement and browser plugins. Cloudflare detections also monitor actions indicating suspicious behavior, such as:

How often does this device access an account sign-up page across the entire Cloudflare network?

“The idea of classifying behaviors and helping customers block a behavior, rather than just blocking automation, I think, is where security needs to move,” Tatoris said, considering the SPLX demonstration.

“Let’s say LLMs [large language models] can now get to a point where they perfectly mimic human interaction on the site. What you would still identify is, what’s the behavior they’re trying to do? And then, if that behavior comes from a bad human or a bad agent or a bad program, that you could block that bad behavior either way.”

HUMAN’s “Precheck” mechanism also uses behavioral analysis (and no CAPTCHA challenge) to detect bots. According to the company’s site, suspicious traffic (like a request that’s missing a cookie) gets flagged and further inspected with “invisible” device challenges.

Analytics tools will be needed, too, to regulate bot behavior as agentic AI—a kind of approved, if not automatically “good” bot—is utilized more frequently to inspect websites.

Kalantzis said the company is currently partnering with OpenAI to integrate a protocol for cryptographically verifying ChatGPT-agent interactions. The company’s new AgenticTrust feature, released in July 2025, evaluates the behavior of agent activity. (Cloudflare also in July announced the 

“That’s where the market is moving to allow agents,” Kalantzis said. “It’s really knowing the provenance and the intent of the agent and, based on how much data is being provided, a customer then can choose how the level of trust they require to interact and transact with their website.”

As AI solves CAPTCHAs, what’s next?

Some IT pros see more invisible challenges replacing “select all motorcycles.”

Like a Draw Four card in Uno, Oracle’s monumental deal with OpenAI is expected to shake things up—and not just for Oracle’s reputation, but for the greater tech ecosystem, according to industry experts.

 OpenAI had signed a contract with Oracle, agreeing to purchase $300 billion worth of computing power over approximately five years. The contract is slated to come into effect in 2027.

The Wall Street Journal said the OpenAI–Oracle deal is one of the largest cloud contracts signed to date, requiring 4.5 gigawatts of data center power capacity. Oracle shares jumped more than 35% following news of the deal.

However, Anetac security platform co-founder and CEO Timothy Eades argued the deal is actually not as expensive for Oracle as it seems. That’s because Eades said the arrangement will give the data giant a leg up in the industry’s trek towards deglobalization and 

 65% of governments worldwide will have some form of digital sovereignty by 2028.

Eades said the recent deal positions Oracle well for the AI era, a much-needed move given that the company had “missed out on some really big waves.”

“Part of it’s defensive,” Eades said. “Imagine if they didn’t do it right. I mean, they were left out of the hyperscaler world. Imagine if they weren’t involved in the AI world.”

Eades said that the deal also will award Oracle additional relevancy, transforming its identity beyond a “40-year-old database company.”

“This is a cheap deal…If you look at it in a 10 year time frame, holy cow,” Eades said.

Shishir Shrivastava, a practice director at TEKsystems Global Services, said the deal signifies a wave of consolidation within the AI infrastructure industry, similar to what occurred during the 

 in Intel, announced on Sept. 18, as another indicator of this.

“For the next few years, that’s what we’ll see,” Shrivastava, a former Oracle employee, said. He added that the combination of Oracle’s flagship database product, its enterprise applications, and its infrastructure will allow it to cater to large enterprises.

“With the advent of cloud, all they have to do is just take all of that infrastructure and the muscle in the power and boost it to the cloud so that they can provide that AI optimized ecosystem,” Shrivastava said.

Eades said deals on such a large scale will likely continue moving forward.

“This is just the start of something massive,” he said.

 Some may be wondering what the monumental deal means for the 

. Shrivastava said the recent deal will help catapult Oracle’s reputation in the cloud computing industry to the heights of the hyperscaler trio.

“Sooner or later, you will see that among AWS, and Microsoft, and Google, Oracle’s name will pop up as well quite frequently,” Shrivastava said.

Eades, however, predicts the OpenAI–Oracle deal won’t shake things up too much for the hyperscalers because the industry is currently in the “first innings of AI” and companies likely will establish deals with multiple cloud providers.

“It’s not like musical chairs where everybody’s going to find one at the last minute, and this is your lock to that one chair,” Eades said. “Right now, people are trying to circle around and find the right chair that’s going to be relevant for them on the product suite that they have and the markets that they see.”

 While the $300 billion deal is regarded as a win for Oracle by some, others remain skeptical. Following the news of the agreement and the market’s subsequent reaction, discussions of an oncoming AI bubble burst 

“I don’t think it’s a bubble, but if it is a bubble, then deals like these are put as a risk,” Shrivastava said.

 ratings highlighted the counterparty risk (i.e., the risk that a party will not fulfill its end of the bargain) associated with the deal. Moody’s does not mention OpenAI by name in the report, and disclosed its risk assessment is “subjective at best,” given their lack of financial information on the unnamed party.

Moody’s report also acknowledged Oracle’s high debt standing and how it could impact the company following the pending deal: “Oracle’s AI infrastructure business has tremendous potential in our view, but we note that this exponential growth and the already high debt burden at Oracle could result in an extended period of high leverage and negative cash flow.”

Correction 09/26/2025: Shishir Shrivastava's title has been corrected to "practice director."

AI