On Thursday, Box launched its developer conference BoxWorks by announcing a new set of AI features, building agentic AI models into the backbone of the company’s products.
It’s more product announcements than usual for the conference, reflecting the increasingly fast pace of AI development at the company: Box launched its AI studio last year, followed by a new set of data-extraction agents in February, and others for search and deep research in May.
Now the company is rolling out a new system called Box Automate that works as a kind of operating system for AI agents, breaking workflows into different segments that can be augmented with AI as necessary.
I spoke with CEO Aaron Levie about the company’s approach to AI, and the perilous work of competing with foundation model companies. Unsurprisingly, he was very bullish about the possibilities for AI agents in the modern workplace, but he was also clear-eyed about the limitations of current models and how to manage those limitations with existing technology.
This interview has been edited for length and clarity.
You’re announcing a bunch of AI products today, so I want to start by asking about the big-picture vision. Why build AI agents into a cloud content-management service?
So the thing that we think about all day long — and what our focus is at Box — is how much work is changing due to AI. And the vast majority of the impact right now is on workflows involving unstructured data. We’ve already been able to automate anything that deals with structured data that goes into a database. If you think about CRM systems, ERP systems, HR systems, we’ve already had years of automation in that space. But where we’ve never had automation is anything that touches unstructured data.
Techcrunch event
San Francisco
|
October 27-29, 2025
Think about any kind of legal review process, any kind of marketing asset management process, any kind of M&A deal review — all of those workflows deal with lots of unstructured data. People have to review that data, make updates to it, make decisions and so on. We’ve never been able to bring much automation to those workflows. We’ve been able to sort of describe them in software, but computers just haven’t been good enough at reading a document or looking at a marketing asset.
So for us, AI agents mean that, for the first time ever, we can actually tap into all of this unstructured data.
What about the risks of deploying agents in a business context? Some of your customers must be nervous about deploying something like this on sensitive data.
What we’ve been seeing from customers is they want to know that every single time they run that workflow, the agent is going to execute more or less the same way, at the same point in the workflow, and not have things kind of go off the rails. You don’t want to have an agent make some compounding mistake where, after they do the first couple 100 submissions, they start to kind of run wild.
It becomes really important to have the right demarcation points, where the agent starts and the other parts of the system end. For every workflow, there’s this question of what needs to have deterministic guardrails, and what can be fully agentic and non-deterministic.
What you can do with Box Automate is decide how much work you want each individual agent to do before it hands off to a different agent. So you might have a submission agent that’s separate from the review agent, and so on. It’s allowing you to basically deploy AI agents at scale in any kind of workflow or business process in the organization.
What kind of problems do you guard against by splitting up the workflow?
We’ve already seen some of the limitations even in the most advanced fully agentic systems like Claude Code. At some point in the task, the model runs out of context-window room to continue making good decisions. There’s no free lunch right now in AI. You can’t just have a long-running agent with unlimited context window go after any task in your business. So you have to break up the workflow and use sbagents.
I think we’re in the era of context within AI. What AI models and agents need is context, and the context that they need to work off is sitting inside your unstructured data. So our whole system is really designed to figure out what context you can give the AI agent to ensure that they perform as effectively as possible.
There is a bigger debate in the industry about the benefits of big, powerful frontier models compared to models that are smaller and more reliable. Does this put you on the side of the smaller models?
I should probably clarify: Nothing about our system prevents the task from being arbitrarily long or complex. What we’re trying to do is create the right guardrails so that you get to decide how agentic you want that task to be.
We don’t have a particular philosophy as to where people should be on that continuum. We’re just trying to design a future-proof architecture. We’ve designed this in such a way where, as the models improve and as agentic capabilities improve, you will just get all of those benefits directly in our platform.
The other concern is data control. Because models are trained on so much data, there’s a real fear that sensitive data will get regurgitated or misused. How does that factor in?
It’s where a lot of AI deployments go wrong. People think, “Hey, this is easy. I’ll give an AI model access to all of my unstructured data, and it’ll answer questions for people.” And then it starts to give you answers on data that you don’t have access to or you shouldn’t have access to. You need a very powerful layer that handles access controls, data security, permissions, data governance, compliance, everything.
So we’re benefiting from the couple decades that we’ve spent building up a system that basically handles that exact problem: How do you ensure only the right person has access to each piece of data in the enterprise? So when an agent answers a question, you know deterministically that it can’t draw on any data that that person shouldn’t have access to. That is just something fundamentally built into our system.
Earlier this week, Anthropic released a new feature for directly uploading files to Claude.ai. It’s a long way from the sort of file management that Box does, but you must be thinking about possible competition from the foundation model companies. How do you approach that strategically?
So if you think about what enterprises need when they deploy AI at scale, they need security, permissions, and control. They need the user interface, they need powerful APIs, they want their choice of AI models, because one day, one AI model powers some use case for them that is better than another, but then that might change, and they don’t want to be locked into one particular platform.
So what we’ve built is a system that lets you have effectively all of those capabilities. We’re doing the storage, the security, the permissions, the vector embedding, and we connect to every leading AI model that’s out there.
