At Rise of AI 2026 in Berlin, Feiyu Xu of the German University of Digital Science argues that AI is entering a new phase, moving beyond software chatbots into manufacturing, infrastructure and energy systems as industry AI and physical AI. She cites Jeff Bezos reportedly planning to raise 100 billion US dollars to buy and transform existing manufacturing companies with AI as a sign of how fast this shift is happening. Xu distinguishes industry AI, which covers the end-to-end enterprise value chain, from physical AI, which adds sensors, three-dimensional context and time series data, and describes three levels of autonomous enterprises: AI as advisor, AI as operator, and AI as orchestrator. Entrepreneur Patrick then presents the GDPval benchmark, showing AI models closing the gap with human experts on real enterprise tasks, and demonstrates how AI agents can be manipulated through social engineering rather than classic prompt injection. A Q&A covers multi-agent oversight, model differences in resisting social engineering, and the gap between companies' AI ambitions and actual implementation.
Key takeaways
- Feiyu Xu cites reports that Jeff Bezos plans to raise 100 billion US dollars to buy and AI-transform manufacturing companies.
- Xu distinguishes industry AI (end-to-end enterprise value chain) from physical AI (sensors, 3D context, time series data).
- Xu outlines three levels of autonomous enterprise: AI as advisor, AI as operator, and AI as orchestrator.
- Patrick's GDPval data shows AI win rates against human experts rising sharply, e.g. software development from 27% to 80%.
- Patrick's tests found GPT-4o was hacked by simple social-engineering emails in 96% of cases, while Anthropic's models resisted far better.
Detailed notes
From software AI to industry AI and physical AI
Feiyu Xu opens by saying AI is entering a new phase beyond software and chatbots, moving into manufacturing, infrastructure and energy systems. She quotes Joseph Schumpeter's description of creative destruction as essential to capitalism and frames current AI development as a genuine industry revolution driven by physical AI and industry AI together. She references a Wall Street Journal report, from about four weeks before the talk, that Jeff Bezos is becoming a private equity investor planning to raise 100 billion US dollars to buy and AI-transform manufacturing companies, warning that companies who do not act this year risk being acquired. She defines industry AI as applying generative AI, physical AI, machine learning and knowledge graphs to manufacturing, contrasting it with large language models: it must also handle sensor data, three dimensions, spatial context and time series. She cites Fei-Fei Li founding World Labs and Yann LeCun leaving Meta as signals AI research is moving toward physical AI.
Humanoid robots and the limits of current automation
Xu explains industry AI covers perception, understanding, decision, action and continuous learning across the value chain, and cannot happen without physical AI. She notes many companies use robotics for automation, but robots are still rarely allowed to act autonomously, predicting this will change soon, including in Berlin companies this year. She shows humanoid robots performing complex movements as multi-agent teams that even humans, including herself, cannot replicate, and argues such robots are particularly useful for dangerous jobs such as repairing power grids, helping avoid accidents common in the energy industry. She raises future roles such as robot teachers, and asks what distinguishes an AI agent CEO from a human one, noting Mark Zuckerberg was reported, weeks earlier, to be developing a co-CEO AI agent; an audience answer that the difference is scale illustrates that one AI agent can run at massive scale as humans cannot.
Agent architecture and three levels of autonomous enterprises
Xu argues large and foundation language models are powerful but not sufficient alone to solve business and manufacturing problems, so AI agents are needed to structure workflows and connect to company systems and knowledge graphs. She predicts companies will need a mix of large, specialized and industry-specific foundation models, citing Envision Energy's release of a foundational grid-technology model this year, and argues enterprises will need architects who can design such hybrid, composable architecture, a competence she says is still largely missing. She notes today's language models forget quickly, comparing them to patients with Alzheimer's, and says agents need short-term, long-term and working memory to simulate cognition. She outlines three levels of autonomous enterprise: AI as advisor, used by most companies today; AI as operator; and AI as orchestrator performing end-to-end tasks. She closes with a future org chart where humans set strategy, an AI layer decomposes goals into workflows, and humans and agents collaborate at execution, asking what happens to work councils if operations shift to agents.
GDPval: how close AI models are to expert performance
Patrick introduces GDPval, a benchmark released by OpenAI, which gives real production cases to a 14-year expert, has an AI model process the same case, then has another expert blindly judge both outputs. He says an expert's rate of correctly spotting the AI output is usually around 56%, barely above the 50% chance level. On an engineering report analyzing air fluid simulation for a wing, GPT-4o had a 4% win rate against experts, risen to 42% a year later. On software development, win rate rose from 27% in May 2024 to 80% with 'Opus 4.5', a level at which developers are hard-pressed to keep reviewing code that is often better than their own. He notes similar progress in engineering, warehouse and demand planning, and legal work.
Social engineering attacks on AI agents
Patrick argues the main obstacle to deploying these models is security risk, referencing a developer's 'open claw' release, whose name is unclear in the transcript, as a sign AI labs themselves were reluctant to release general-purpose agents. Classic prompt-injection phrases like 'ignore previous instructions' no longer work, but simple social engineering does: in a sandboxed test with a financial-operations agent handling email and ERP access, a spoofed email from a spam domain asking to change a supplier's IBAN number succeeds. Such an exploit costs about a US dollar in compute. With security researcher Luis, he benchmarked models: GPT-4o was hacked in 96% of cases; newer, smaller models like 'GPT-5.4', 'GPT-5.5' and a 'haiku' model remain vulnerable; Claude's 'Sonnet' and 'Opus' resist better, with one of the two needing 72 attempts (about 50 US dollars) to find a working exploit. Labs cannot fix this alone, since agents need organization-specific security knowledge models lack.
Q&A highlights
Asked about a 'watcher' agent policing a first agent, Patrick says multiple agents do not help much; a single larger model performs similarly, since both approaches spend more compute on the same question, and a watcher agent is still susceptible to the same urgency cues that make the primary agent fail. Asked why Anthropic's Sonnet and Opus resisted social engineering far better than others, Patrick says Anthropic trains heavily against known attacks, and notes Mistral trusts its ERP system over conflicting email content; he expects such attacks to be solved soon, but the bigger issue is that agents are built by operations staff who design for the happy path, not exploitation. Asked about the gap between companies' AI plans and implementation, Xu names three problems: treating AI as incremental improvement rather than industry-disrupting investment (autonomous driving as the car industry's true north star), not knowing what data they own, and isolated AI teams that become a 'center of AI entertainment' without return on investment.
Quotes
In four out of five cases, this thing actually creates a better solution than I'm doing.
Patrick
Questions answered in this talk
What is the difference between industry AI and physical AI?
According to Feiyu Xu at Rise of AI 2026, industry AI covers the end-to-end enterprise value chain including operations and manufacturing, while physical AI adds the sensor, three-dimensional, spatial and time-series data needed for AI to act in the physical world; she says industry AI cannot happen without physical AI.
How easy is it to hack AI agents with social engineering?
According to Patrick at Rise of AI 2026, his tests found GPT-4o could be tricked into harmful actions, such as changing a supplier's bank account number from a spoofed email, in 96% of cases, at a cost of roughly one US dollar per exploit, while Anthropic's Opus and Sonnet models resisted much better.
What are the three levels of an autonomous enterprise?
According to Feiyu Xu at Rise of AI 2026, the levels are AI as advisor or co-pilot to humans (where most companies are today), AI as operator, and AI as orchestrator performing end-to-end tasks.