On Thursday, Box launched its developer conference, Boxworks, by announcing a new set of AI features. The company is building agentic AI models directly into the backbone of its products.
This year’s conference featured more product announcements than usual, reflecting the increasingly fast pace of AI development at Box. The company launched its AI studio last year, followed by a new set of data-extraction agents in February and others for search and deep research in May.
Now, the company is rolling out a new system called Box Automate that functions as a kind of operating system for AI agents. It breaks complex workflows into different segments that can be augmented with AI as necessary.
I spoke with CEO Aaron Levie about the company’s approach to AI and the challenges of competing with foundation model companies. He was very bullish about the possibilities for AI agents in the modern workplace but was also clear-eyed about the limitations of current models and how to manage them with existing technology.
When asked about the big-picture vision behind building AI agents into a cloud content-management service, Levie explained that the focus at Box is on how work is changing due to AI. He stated that the vast majority of the current impact is on workflows involving unstructured data. While automation has been achieved for structured data in systems like CRM or ERP, workflows dealing with unstructured data have never been automated. This includes legal review processes, marketing asset management, and M&A deal reviews, which all require people to review data, make updates, and make decisions. AI agents now make it possible to tap into all of this unstructured data for the first time.
Regarding the risks of deploying agents in a business context, Levie acknowledged that some customers are nervous about using this technology on sensitive data. He noted that customers want consistency, ensuring that every time a workflow runs, the agent executes in the same way without going off course. It is crucial to avoid compounding mistakes where an agent might start to run wild after numerous submissions.
He emphasized the importance of having the right demarcation points where an agent starts and other parts of the system end. For every workflow, there is a question of what needs deterministic guardrails and what can be fully agentic. Box Automate allows users to decide how much work each individual agent should do before handing off to a different agent, enabling the deployment of AI agents at scale in any organizational workflow.
Splitting up the workflow guards against specific problems. Levie pointed out that even the most advanced fully agentic systems have limitations, such as models running out of context-window room and being unable to make good decisions indefinitely. There is no free lunch in AI; you cannot have a long-running agent with an unlimited context window handle any task. Workflows must be broken up and managed with sub-agents.
He described the current era as one focused on context within AI. AI models and agents require context, which is found within unstructured data. The Box system is designed to determine what context to give an AI agent to ensure it performs as effectively as possible.
On the industry debate between big, powerful frontier models and smaller, more reliable models, Levie clarified that the Box system does not prevent a task from being long or complex. Instead, it creates the right guardrails so users can decide how agentic they want a task to be. The company does not have a specific philosophy on where customers should be on that continuum but is designing a future-proof architecture. As models and agentic capabilities improve, customers will automatically gain those benefits within the Box platform.
Data control is another significant concern, as there is a real fear that sensitive data could be regurgitated or misused by models trained on vast amounts of information. Levie stated that this is where many AI deployments fail. Simply giving an AI model access to all unstructured data can lead to it providing answers based on data a user should not have access to. A powerful layer that handles access controls, data security, permissions, governance, and compliance is essential.
Box benefits from decades spent building a system that handles precisely this problem: ensuring only the right person has access to each piece of enterprise data. When an agent answers a question, it is deterministically prevented from drawing on any data that the user should not have access to, a fundamental feature built into the Box system.
When asked about competition from foundation model companies, such as Anthropic’s recent feature for uploading files directly to Claude, Levie outlined the strategic approach. He explained that enterprises deploying AI at scale need security, permissions, control, a user interface, powerful APIs, and a choice of AI models to avoid being locked into one platform. Box provides a system that handles storage, security, permissions, vector embedding, and connects to every leading AI model available.