At Microsoft Build, everyone gets a Copilot

Welcome to Runtime! Today: how Microsoft plans to turn its investments in OpenAI's generative AI technology into revenue, a newly discovered security flaw impacts just about everybody running a widely used piece of open-source software, and the latest funding rounds in enterprise tech.

(Was this email forwarded to you? Sign up here to get Runtime each week.)

Look out for the helpers

SEATTLE — On Monday, the day before its Build developer conference, Satya Nadella hosted a press conference at Microsoft's newly remodeled East Campus to show off the consumer-oriented Copilot + PC concept. But the signs directing attendees to a makeshift tent were not marked with Microsoft's traditional four-color square logo; almost everything was branded with its much newer Copilot logo.

Build itself opened along more traditional lines on Tuesday, but delivered a similar message to enterprise tech: Microsoft is bent on installing Copilots into all of its services across Azure, Microsoft 365, and GitHub, which continues to enjoy the most visible success of Microsoft's AI kick. Feel free to dive into Microsoft's lengthy Book of News for the dozens of updates released Tuesday, but here are a few that stood out.

Github Copilot Extensions will allow third-party companies to create plug-ins for accessing their services directly through GitHub using natural-language queries.

• Launch partners included Docker, LaunchDarkly, MongoDB, Sentry, and Stripe.
• Companies that have built internal development platforms will also be able to publish private extensions for their developers to access those services directly from GitHub.
• But Microsoft also built an extension called GitHub Copilot for Azure that will allow Azure customers to deploy applications from GitHub using the chat interface.
• "What Copilot did for coding, we're now doing for infra and ops," Nadella said Tuesday, although the Copilot for Azure service is only available as a private preview at the moment.

New Copilots for the enterprise software side of the house were also introduced at Build, bringing more and more automation to the office.

• Microsoft also announced Team Copilot, which is a department-level version of the personal Copilot that can be used with Microsoft 365 and, of course, Microsoft Teams.
• Managers could use Team Copilot to track chats across their organization to figure out which issues are causing the most frustration or to snuff out a budding mutiny before it's too late, depending on where you work.
• The service can also assume the role of a project manager "by creating and assigning tasks, tracking deadlines, and notifying team members when their input is needed," Microsoft said in a blog post.
• Companies will be able to use new capabilities in Copilot Studio to build agents, which Microsoft likes to call custom copilots: "For example, an “order taker” copilot can handle the end-to-end order fulfillment process—from taking the order, to processing the order and making intelligent recommendations and substitutions for out-of-stock items, to shipping it to the customer," Microsoft said.

Assuming they work as advertised, Microsoft's Copilot push should make it easier to handle the complexity of the modern enterprise across both infrastructure and business processes. But it wasn't hard to notice that Copilot adopters will be hitching themselves to a decidedly Microsoft-centric approach to infrastructure and operations.

• Cloud customers have long weighed the tradeoffs between building things themselves around basic services with flexibility in mind, or adopting managed services that limit flexibility but were designed with convenience in mind.
• It's much, much easier to move away from a given cloud provider if your applications were built around basic services, which differ slightly from cloud to cloud but not nearly as much as their managed services differ.
• Will AWS or Google Cloud be able to build a Copilot for EC2 or Compute Engine, given how many of their customers use GitHub? Microsoft didn't say either way Tuesday, although GitHub clearly has the freedom to engage with other cloud providers.
• But even if customers aren't worried about vendor lock-in, adopting Copilots across an organization will require giving Microsoft a lot of control over your infrastructure and business operations.

Fluent bitten

The world got another reminder Monday how much enterprise technology depends on the health of multiple open-source projects with the disclosure of a nasty bug in Fluent Bit, which is used for logging and metrics in all the Kubernetes distributions managed by the major cloud providers. It also served as another reminder why CISA has urged companies and projects to use memory-safe programming languages like Rust and Go.

Tenable discovered "a critical memory corruption vulnerability" in older versions of Fluent Bit last month and responsibly reported the finding to the open-source community that governs the project. It would have been a tricky process, but the flaw could have allowed remote code execution on servers running Fluent Bit, and there are a lot of nation-state hacking groups with time and money on their hands.

The flaw was fixed in the most recent version of Fluent Bit, which was released alongside the disclosure on Monday and can be immediately applied. In this case, the open-source security collaboration process between security researchers, project members, and end users worked very well, and the challenge is to figure out how to make this process work for projects that don't have as much visibility and funding as Fluent Bit.

Enterprise funding

Scale AI raised a $1 billion Series F round, valuing the data-cataloging startup at $14 billion.

H (yes, H) scored a $220 million seed round (!) just months after launching with a bunch of former DeepMind employees to build AI models, which seems to be popular these days.

Sigma landed a $200 million Series D round to expand its business-intelligence software that analyzes data stored in data warehouses.

Coactive raised a $30 million Series B round as it tries to help companies add context to unstructured data like images.

Ubercloud changed its name to Simr and raised a $20 million seed round to help designers match simulation software with compute services.

The Runtime roundup

Kevin Mandia, who remained CEO of Mandiant after it was acquired by Google in 2022, told employees he plans to step down at the end of the month.

Google will provide waste heat from an expanded data center complex in Finland to local residents and businesses.

Thanks for reading — see you Thursday!