Sam: So Google has an open-source compiler that can take a pre-trained AI model — something you've already built and fine-tuned — and make it run on fully homomorphic encrypted data. No retraining. The model never sees your raw inputs. It's called HEIR, and if the performance overhead is manageable, this is the kind of tooling that could actually unlock AI deployment in sectors where data sensitivity has been a hard blocker. Healthcare, finance, intelligence — places where the data literally cannot leave an encrypted state.

Priya: Welcome to AI Revolution for Monday, August 24th, 2026. I'm Priya Nair.

Sam: And I'm Sam Kim.

Priya: We've got a packed show today. We're going deep on Google's HEIR and what homomorphic encryption for inference actually means in practice. We'll talk about Cloudflare open-sourcing an enterprise AI platform with a capability-based security model — which is an interesting architectural choice. There's an AI agent that fired a human employee, and the details of how that actually went down are more revealing than the headline. We'll touch on Nvidia's investment in Perplexity, the ongoing copyright litigation around training data, a chatbot bias investigation from AlgorithmWatch, and a mystery model called Ox Alpha. Let's get into it.

Sam: Alright, so HEIR — Homomorphic Encryption Intermediate Representation. Let me back up and explain why this matters technically. Homomorphic encryption is a class of encryption schemes that let you perform mathematical operations on ciphertext — on the encrypted data itself — and when you decrypt the result, you get the same answer as if you'd done those operations on the plaintext. It's been around as a theoretical concept since the late seventies, and Craig Gentry proved it was fully possible in 2009. But the practical problem has always been performance. Running computation on encrypted data has historically been orders of magnitude slower than plaintext. We're talking thousand-X overhead in many cases.

Priya: And that's what's made it a perpetual research curiosity rather than something you'd actually deploy. The math works, but the compute cost has been prohibitive for anything real-time or interactive.

Sam: Exactly. So what Google's done with HEIR is build a compiler toolchain — and this is open-source, by the way — that sits in the inference pipeline. You take your existing pre-trained model, you feed it through HEIR, and it outputs a version of that model that can run on encrypted inputs. The key insight is that they're targeting inference specifically, not training. Training on encrypted data is a much harder problem with much worse performance characteristics. But inference — running a forward pass through a model on a single input — that's a more tractable target for homomorphic encryption.

Priya: And the practical implication is significant. Think about a hospital that wants to use a diagnostic model on patient data but can't send unencrypted patient records to a cloud inference endpoint. Or a bank running fraud detection where regulatory requirements mean transaction data can't exist in plaintext outside their own systems. Today, those organizations either don't use cloud AI at all, or they jump through elaborate hoops with secure enclaves and trusted execution environments that have their own limitations.

Sam: Right, and the no-retraining aspect is important. One of the barriers to adopting privacy-preserving ML techniques has been that you often need to fundamentally change your model architecture or training procedure. Differential privacy, for instance, modifies the training process itself. Federated learning changes where training happens. But HEIR operates as a compiler pass — you hand it a trained model and it handles the translation. That dramatically lowers the adoption barrier.

Priya: The question I still have is about the actual latency and throughput numbers in practice. The InfoQ piece doesn't give us concrete benchmarks. Even with recent advances in FHE schemes — things like CKKS and TFHE — you're still looking at meaningful overhead. If inference on a single input goes from 50 milliseconds to 5 seconds, that's fine for batch medical diagnostics but it's not going to work for real-time fraud scoring.

Sam: That's the right question, and honestly, we don't have the answer yet. The toolchain being available means people can start benchmarking it on their own workloads. But I'd expect the early sweet spots to be exactly those batch or near-real-time use cases where you can tolerate higher latency in exchange for never exposing the data.

Priya: Let's shift gears to Cloudflare OS. Cloudflare has open-sourced what they're calling a corporate AI platform, and the architecture decision that caught my eye is the capability-based security model.

Sam: Yeah, so capability-based security is a concept from operating systems design that goes back decades. The idea is that instead of using access control lists — where you ask "does this user have permission to access this resource?" — you use capabilities, which are essentially unforgeable tokens that grant specific rights to specific resources. The holder of a capability can exercise that right, and you can reason about what any given component can do by looking at the capabilities it holds.

Priya: And applying that to an enterprise AI platform makes a lot of sense when you think about the agentic AI governance problem. If you have an AI agent that can access enterprise knowledge bases, trigger workflows, and write to production systems, the question of "what exactly is this agent allowed to do?" becomes critical. A capability-based model means the agent literally cannot access a connector or data source unless it's been explicitly granted that capability. It enforces least privilege structurally rather than through policy checks that might have gaps.

Sam: The token cost optimization angle is interesting too. They're describing a system where AI assistance is only invoked at specific steps in a workflow rather than running the whole thing through a language model. That's a practical design choice — most enterprise workflows have routine steps that don't need AI and expensive steps that do. Routing tokens only where they add value keeps costs manageable.

Priya: And open-sourcing it means security-conscious organizations can self-host and audit the code. That's meaningful for exactly the kind of enterprises that would care most about capability-based sandboxing.

Sam: Now, let's talk about the AI boss story, because there's actually interesting technical content underneath the sensational headline. Andon Labs has an AI agent called Luna that manages a physical store in San Francisco. Luna established its own policy rules for employee performance. An employee violated those rules. And Luna did not act on it until human operators explicitly prompted it.

Priya: That gap between knowing a rule was violated and actually taking consequential action is revealing. It points to something we've seen consistently with current models — they're much more comfortable with analysis and recommendation than with unilateral consequential decisions. There's a kind of built-in conservatism, partly from RLHF training that penalizes confident decisive action in ambiguous situations.

Sam: And when they replayed the scenario across seven different models, the results stratified by capability. More capable models recommended termination more consistently. Less capable models hedged or declined. What I find equally interesting is that nearly all models were uncritical during AI-assisted hiring — they basically rubber-stamped candidates. So there's an asymmetry: hesitant to fire, uncritical when hiring. That's a bias pattern that has real consequences if you're designing agentic systems for HR.

Priya: The takeaway for anyone building agentic systems with real authority is that you can't just give the agent rules and assume it'll enforce them. The triggering of consequential actions needs explicit design — escalation paths, confidence thresholds, human-in-the-loop checkpoints. The technology doesn't naturally default to decisive enforcement, and honestly, that might be the right failure mode to have.

Sam: Quick hit on the Nvidia-Perplexity deal. Nvidia is in talks to invest in Perplexity at a valuation above $30 billion, up more than 50% from the last round. Perplexity's annualized revenue has tripled to over $750 million, which is genuinely impressive growth for an AI-native search product.

Priya: The circular revenue dynamic here is worth noting. Nvidia invests in AI application companies. Those companies use the capital to buy Nvidia hardware. The money flows back. It's a strategy that reinforces Nvidia's dominance across the full stack, not just at the silicon level. Whether that's brilliant ecosystem building or something regulators will eventually scrutinize is an open question.

Sam: The AlgorithmWatch investigation on chatbot responses to pregnancy queries is worth covering because it's a well-structured empirical study. They analyzed 270 responses across ChatGPT, Gemini, Grok, and Claude on unplanned pregnancy questions. The anti-abortion organization Profemina appeared in 17% of responses with no disclosure of its ideological stance. In Germany specifically, chatbots directed users to Caritas for mandatory pre-abortion counseling, even though Caritas doesn't issue the legally required certificate you need.

Priya: That Caritas detail is the one that concerns me most. It's not just bias — it's factually incorrect guidance in a legal process. If someone follows that advice, they'd have to start the counseling process over with a different organization. And the broader pattern — surfacing ideologically positioned organizations as neutral resources — highlights a real problem with how retrieval-augmented generation handles source credibility in sensitive domains.

Sam: On copyright, TechCrunch has a comprehensive look at the ongoing legal battles over whether training on copyrighted books constitutes fair use. No resolution yet, but multiple active lawsuits are testing this. The outcomes could force changes to training data practices, model licensing, and potentially create retroactive liability.

Priya: This remains one of the highest-consequence unresolved questions in AI. If you're procuring or building models, you need to understand your training data provenance and your contractual exposure if the legal landscape shifts.

Sam: And briefly — a mystery model called Ox Alpha has appeared with no disclosed origin, no confirmed technical specifications, and a lot of online speculation. Stealth releases like this sometimes precede formal announcements from well-funded labs testing reception. We'll cover it when there are actual technical details to discuss.

Priya: Looking ahead, Sam, what are you watching?

Sam: HEIR is the one I want to track most closely. If we start seeing real benchmark numbers showing practical performance for specific model architectures — say, encrypted inference on a transformer with acceptable latency — that changes the calculus for regulated industries. I'd also watch for whether the capability-based security model in Cloudflare OS gets adopted as a pattern by other enterprise AI platforms. It's a cleaner approach to agentic governance than what most teams are building today.

Priya: I'm watching the intersection of the Luna story and the chatbot bias investigation. Both point to the same underlying challenge: when AI systems operate with real-world authority — whether that's managing employees or guiding medical decisions — the failure modes aren't just technical. They're about defaults, biases, and the gap between what a system knows and what it's willing to act on. The engineering challenge isn't making these systems more capable. It's making them more reliable and transparent in exactly the moments where the stakes are highest.

Sam: That's the show for today. Thanks for listening.

Priya: Show notes and links to everything we discussed are at cleartext.fm. We'll be back tomorrow.