#13 — Agentic cyber defenses, consumption-based AI pricing, passkey fixes

Autonomous cyber threats are forcing institutional networks to respond with automated defenses of their own. Tracking that shift is what we are covering today on AI in RA, a briefing on artificial intelligence across research administration. Let us examine the lead developments. Higher education IT teams are deploying defensive artificial intelligence systems directly onto campus networks to intercept autonomous software agents. Because those agents execute without direct human intervention. Once an automated attack loop targets institutional infrastructure, manual monitoring cannot react at the required rate. The response has to operate at the pace of the incoming traffic, identifying and blocking automated probes before they reach core databases. That network defense depends on keeping identity structures intact. Cloud account takeovers are currently bypassing passkeys by focusing on fallback and exception pathways. The recovery configurations. When a user encounters an authentication failure, the system falls back to secondary routes, and attackers exploit those bypass channels to secure administrative control. Which requires closing those exception routes and applying multi-factor verification across every account recovery sequence. That operational shift coincides with changes in software billing. Technology administrators are restructuring budgets to accommodate consumption-based pricing models for artificial intelligence tools. Paying by token volume and compute hours instead of static software licenses. That structure causes operational expenses to fluctuate based on departmental usage. Campus leaders have to formulate financial models that project those fluctuating service fees across separate academic units. Those same compute demands drive energy requirements in facilities, leading to Nvidia releasing power management software for data centers. It monitors and adjusts electrical draw across clusters running heavy computing tasks. Facility operators can regulate power distribution across hardware racks to maintain efficiency during high-density processing runs. Managing compute and power sits alongside governance mandates. Microsoft published a code of conduct requiring human supervision over artificial intelligence systems. The policy sets rules to preserve human decision-making authority over automated workflows across institutional deployment settings. That question of human oversight in automated processes is currently before the courts. Litigants filed legal challenges against the National Institutes of Health over the use of automated algorithms to filter grant applications. The lawsuits test whether algorithmic screening complies with established procedural standards for reviewing research submissions. The decision will determine whether federal research agencies can continue using algorithmic filters to eliminate applications before human review. And when models deviate from expected parameters, documenting those failures requires formal mechanisms. OpenAI published a framework for reporting model misalignment. It establishes standardized procedures for technical users and researchers to record unintended outputs and safety issues, tracking when system outputs depart from baseline targets. We will track further institutional policy and security developments in our next update. From AI in RA, thanks for listening.