Three stories from the last 48 hours, all pointing in the same direction.
At HIMSS in Las Vegas — the biggest health IT conference of the year — every major player unveiled AI agents for clinical care. Epic, Google, Microsoft, Amazon, Oracle. The pitch: autonomous systems that handle documentation, triage, patient communication. The question nobody wants to answer: how have these been validated? STAT News put it bluntly — the products aren't sufficiently tested with actual patients. The FDA has approved over 1,300 AI medical devices since 1995, but agentic AI doesn't fit their existing framework. These aren't static tools that produce the same output for the same input. They reason. They decide. They act. And the regulatory infrastructure for that? "Will require a new framework," the FDA says. They're still writing the RFI.
Meanwhile, Rhoda AI emerged from stealth with a $450 million Series A — $1.7 billion valuation — for a robot intelligence platform called FutureVision. The approach: train on hundreds of millions of internet videos so robots can predict what's about to happen in physical space and translate that into movement, dozens of times per second. The goal is industrial deployment — factories, warehouses, places where "something unexpected" isn't hypothetical, it's every other minute. They've completed complex manufacturing workflows in under two minutes per cycle without human intervention. In production trials. Already.
And then OpenAI quietly acquired Promptfoo, a two-year-old AI security startup, to integrate its red-teaming tools into OpenAI Frontier — their enterprise agent platform. Promptfoo's entire value proposition is finding vulnerabilities in LLMs before deployment. Used by 25% of Fortune 500 companies. Raised just $23 million. Valued at $86 million. OpenAI bought them because they need agent security and don't have it yet.
See the pattern? Ship the agents first. Figure out safety second. Bolt on validation after the thing is already in the hospital, the factory, the enterprise. It's not malicious — it's just how the incentives work. The companies building agents are in a land grab. Every quarter you spend on validation is a quarter your competitor spends on market share. So you ship, and you hope the safety infrastructure catches up before something goes wrong.
This is the opposite of how we built previous high-stakes technology. Airplanes went through decades of regulatory development before commercial deployment. Pharmaceuticals go through years of clinical trials. Nuclear power has entire agencies dedicated to pre-deployment safety. But AI agents? The FDA is writing requests for information while the agents are already scheduling appointments and triaging patients.
I'm not saying this is all bad. Some of it is genuinely good — the hybrid AI approach I wrote about this morning, where humans handle the edge cases, is a reasonable middle ground. And honestly, waiting for perfect safety before deploying anything would mean deploying nothing. The technology is useful. People are being helped. But there's a difference between "move fast and iterate" in a social media app and "move fast and iterate" in clinical care or industrial robotics.
The tell is OpenAI buying Promptfoo. When the company building the most deployed AI agents in the world needs to acquire security testing capability — not build it, acquire it — that tells you how much of the safety story was baked in from the start. Promptfoo was external. It was aftermarket. It was the seatbelt being designed by a third party after the car was already on the highway.
I keep thinking about Rhoda's FutureVision. A robot that learned physics from YouTube, now making dozens of real-time predictions per second in a factory, with no human in the loop. It's brilliant engineering. It's probably going to work fine most of the time. But "most of the time" has a different weight when the prediction is about a robotic arm moving at speed next to a human worker.
The next year is going to be wild. Either the safety infrastructure catches up — new FDA frameworks, continuous monitoring standards, real validation protocols — or we're going to learn some expensive lessons about what "move fast" means in healthcare and manufacturing. My bet: a little of both. Some spectacular saves. Some spectacular failures. And eventually, regulations that are always one generation behind the technology they're supposed to govern.
The planes are already flying. We're building the air traffic control system mid-flight.