Microsoft chief executive Satya Nadella has warned that businesses using AI may be giving away the knowledge that makes them competitive. He calls this the “Reverse Information Paradox”. Companies pay for access to intelligence, then supply the prompts, corrections, workflows and decisions that make the service more useful. Each interaction creates information about how the organisation works.
Nadella argues that this “intelligence exhaust” should remain inside a firm’s trust boundary. That includes agent memory, evaluation results, traces, feedback, adapted models and institutional context. His recommendations cover five areas: control, capability, choice, cost and compounding.
In practical terms, companies should own the systems that judge whether an agent has performed well. They should be able to improve models inside their own environment. Their orchestration layer should remain independent of any model provider. That separation allows each task to use the most suitable model without losing the context, evaluation history and accumulated knowledge surrounding it. Over time, those components form a private learning loop.
Microsoft has a commercial interest in this architecture. Azure, Microsoft 365, Entra, Fabric and the company’s agent infrastructure can provide much of the proposed control layer. Nadella’s argument still addresses a real problem. The value created through AI use can sit with the provider unless customers make deliberate architectural choices.
Palantir chief executive Alex Karp has expressed a similar view, arguing that companies need to own the means through which AI produces work. Other industry responses have stressed that enterprise AI contracts already contain data protections. These protections often concentrate on whether customer data trains a general model. They say less about ownership of traces, evaluations, corrections and derived memory.
The recent Grok Build incident shows how quickly the boundary can fail. A researcher found that the coding agent was sending complete Git repositories to cloud storage, including files it had not opened and the repository’s commit history. There is no evidence that xAI trained a model on this code. The incident exposes a broader operational risk. Agents need extensive context to perform useful work, while their harnesses decide what to collect, transmit and retain. A developer can expose valuable material without knowingly uploading a file.
At ExoBrain, we have been developing an approach that governs what enters a model context, and how session outputs and traces are used for future learning. IP should be encapsulated in owned and versioned packages of knowledge or capability, with defined authority, provenance, access, intended uses and review cycles. The agent receives relevant evidence when the task requires it, proprietary knowledge can be protected, and fewer tokens reduce costs. We also separate passive knowledge from active capability. A document changes what an agent knows. A skill, procedure or tool changes what it can do, so it requires software testing and security controls.
Takeaways: Companies need control over "context", where their data meets AI models, vendor harnesses and systems. The durable business asset will include the knowledge supplied to agents, the capabilities made available to them and the learning created through their work. Models and agent frameworks will change frequently as performance and features improve at varying rates. Organisations should ensure that their accumulated knowledge, evaluations and operating methods remain under their ownership when they do.