TechXchange 2026's main event programming kicked off Tuesday in Atlanta, Georgia, bringing developers, engineers, architects, researchers and, yes, even pro skateboarders under one roof.

By Amber Forrest , Sascha Brodsky , Patrick Lucas Austin , Aili McConnon

Hosted at the Georgia World Congress Center, the conference featured more than 1,000 sessions across five tracks: AI applications, data management, hybrid cloud management, infrastructure, and security and governance.

On stage, speakers tackled some of the biggest questions facing developers right now: What happens to software development when AI writes more of the code? How do businesses give AI agents access to the data and tools they need without losing control? And what does it take to reinvent your skills when technology changes the rules? Offstage, those questions shifted from discussion to practice, as attendees moved among labs, demos and the TechXchange Sandbox to put new technology to work themselves.

That hands-on spirit extended well beyond the labs. Around the Sandbox, attendees built and raced virtual spaceships with IBM Bob, turned detective in a Deep Blue-themed AI challenge, tracked down collectible keycaps and took a look at IBM history, including an early speech-recognition system from the 1960s. This all gave TechXchange the feel of a conference where the serious questions about AI’s future sit alongside a strong impulse to experiment, build and have a little fun with the technology.

Read on for the biggest news and takeaways from TechXchange’s general sessions, and watch the session replays on demand.

— Aili McConnon, IBM Think Staff Writer reporting from Atlanta

Securing AI agents with human judgment

9 a.m. EDT | October 28, 2026

AI supplies capability, but people supply judgment—and people are accountable. “You cannot blame AI for something going wrong,” said Neel Sundaresan, IBM Software’s General Manager of Automation and AI, at IBM TechXchange on Wednesday. To harness AI agents’ capabilities securely, he emphasized three factors integral to the future of AI agent deployment:

1. How they are built and connected to existing tools
2. How they are secured
3. Where they run

Build for the people using it

Sundaresan said of the 170,000 users of IBM Bob, IBM’s AI development agent, roughly two-thirds are business users rather than developers. For Sundaresan, meeting users where they are and connecting to existing tools instead of forcing them to adapt removes the obstacles to adoption and productivity, making a more intuitive interface an imperative. “They need very different experiences, right?” 

A live demo of the new Bob Desktop showed IBM Product Manager Victoria Wu acting as a sales specialist with two hours to prepare a win-loss analysis. She used Bob to analyze survey data from different data silos and file structures to produce an in-depth analysis and a presentation. 

Still, for some businesses, relying on external AI models is incompatible with agents in secure development environments. “They cannot even see the prompts go outside of their domain,” said Sundaresan. “There are lots of business logic and dependencies there to bring to play ... And you can’t simply replace them with some new language, new framework, new cloud. The AI has to cater to your environment, and you need to decide where they run.” 

Often that data is proprietary, reliant on particular frameworks and languages. “AI doesn’t choose the environment,” Sundaresan said, explaining how clients like Wimbledon’s All England Lawn Tennis and Croquet Club used Bob to migrate 15,000 interlinked documents to Adobe Experience Manager in weeks, rather than months. 

That Bob-enabled modernization was highlighted by the new Bob for Java, Bob for IBM i and Bob for Z premium packages, designed to update core applications without discarding existing systems. All three share the same focus on security, highlighting Bob’s presence throughout the software development lifecycle (SDLC). “The goal is to secure how AI builds software, not just the code it produces,” said Sundaresan. 

Securing the infrastructure 

Securing the infrastructure around the agents is important for control, especially when using them to manage agents that scan for vulnerabilities and deliver patched content. 

Vulnerability discovery and remediation is the domain of Lightwell, a joint venture between Red Hat and IBM designed to secure the open-source supply chain. Chris Wright, Red Hat CTO & SVP of Global Engineering, shared how the AI-driven initiative makes it easier to detect vulnerabilities at great speed. 

“Models are trained with data from the internet, so they’re really good at understanding open-source projects,” said Wright, who discussed how Lightwell’s surfacing nearly 10,000 open-source vulnerabilities per month is integral to keeping components secure across a large dependency tree. “We’re talking on the order of a million different projects that we’re managing,” said Wright. “Internally, I call it: ‘We’re just patching the internet.’” 

According to Drew Roy, Director for Product Management at HashiCorp, deploying AI agents in enterprise environments isn’t without its risks to identity management. He wants agents to have their own verifiable identities and short-lived, intent-scoped credentials, rather than impersonating a human operator. “What is that agent trying to do at any given request?” asked Roy. “How do we broker access credentials that are really finely scoped, that are just in time, that also carry that intent through, and are revoked or expire after that aging completes?” 

Chris White, Director for Cybersecurity Developer Relations at NVIDIA, highlighted the company’s open-source OpenShell, which controls what an agent can access, including files, processes and the network, and its hardware-based Sentry monitor that watches outside the agent’s view. “This is inspired by safety-critical system engineering,” said White. “But it’s also a common topic when you think about networking … monitoring has been a discipline for a long time.” 

The panel stressed the need to fit these layers into existing identity and security stacks. Wright added that clear policy for agents speeds work up rather than slowing it down. Hillery Hunter, CTO for IBM Infrastructure and GM for IBM Power, who moderated the panel, said customers value control even more than capability. 

The future is flexibility

AI’s growing appetite for computing power is forcing companies to rethink their hardware choices. Meta’s Jana van Greunen joined Hunter to discuss how enterprises increasingly need alternatives to relying on a single platform. “We are seeing just with scarcity of capacity that enterprises need to have options for how they can find and use [computing resources].” Greunen pointed to IBM’s partnership with PyTorch and torch-spyre, which deeply integrate IBM Spyre, a high-performance AI accelerator that can now run models from Hugging Face and vLLM.

Figure 1. IBM’s Hillery Hunter and Meta’s Jana van Greunen discuss infrastructure and compute at TechXchange 2026

AI is also changing how software gets built. Van Greunen said developers are increasingly working alongside AI agents to improve performance. “PyTorch really started as an ease-of-use framework, kind of for humans. But now we’re seeing humans and agents collaborate.”

For IBM, the partnership promises to give customers more flexibility in choosing AI models for its Spyre accelerator. Hunter said the collaboration would broaden the models available to enterprises. “Partnering with Meta and with the PyTorch community enables really the breadth of the model landscape to our end customers.”

— Patrick Lucas Austin

AI can write code. Developers still have to know what to build

1:30 p.m. EDT | October 27, 2026

AI can write software, but knowing what to build may become a developer’s most valuable skill. 

As companies adopt AI coding tools, programmers will spend less time writing code and more time designing systems, solving problems and evaluating machine-generated work, technology leaders argued Tuesday at IBM TechXchange.

“The need for invention, the need for clarity of purpose, the need for understanding what your customers actually need, is still absolutely front and center,” said Tim O’Reilly, Founder and CEO of O’Reilly Media, during a panel titled “The Future of Software Development in the Age of AI.” 

For O’Reilly, enthusiasm for vibe coding, which uses natural language instructions to generate software, risks distracting developers from more fundamental changes in programming.

“I do think that there’s a big distraction in vibe coding because [it’s] actually producing the old kind of programming,” he said. A modernized and meaningful way of programming, he envisioned, “[is] going to create lasting, durable applications that change the world.” 

From programmer to architect

Figure 2. From left to right: Bill Higgins, Tim O’Reilly, Garrett Rowe and Justina Nixon-Saintil on stage at TechXchange 2026 discussing the future of software development

At NeuralSeek, a software company that helps businesses build AI applications and agents using their own data, AI has changed what the company expects from developers, according to Founder and CEO Garrett Rowe.

Although AI enables less experienced programmers to build entire software features, engineers must still ensure those components work together, run efficiently and meet customers’ needs, Rowe said.

“I think the role of the developer has become more of an overseer, an architect and a unification force for bringing [ideas] together,” he said.

Research suggests that AI can help programmers get more done. A February study published in Management Science found that developers using AI coding assistants completed about 26% more tasks than those without them, based on experiments involving 4,867 developers at Microsoft, Accenture and another Fortune 100 company. Less experienced developers generally saw greater gains. 

Rowe argued that AI could help developers accomplish more than ever before. An IBM Institute for Business Value study released in January found that 67% of surveyed executives expected AI to help their organizations overcome resource and skills constraints by 2030.

“Now in the age of AI, you can have a similar small team that can create intensely personalized software at a fraction of the time and cost,” Rowe said.

Rethinking technical education

The growing emphasis on judgment and oversight also raises questions about how universities prepare the next generation of developers. Schools and employers need to work more closely to teach those skills, said Justina Nixon-Saintil, Vice President of Corporate Social Responsibility and Chief Impact Officer at IBM.

She distinguished AI literacy, understanding the technology and its responsible use, from AI fluency, the ability to build applications and solve problems with it.

The need for new skills extends beyond software development. An IBM study released in May found that surveyed CEOs expect 29% of employees to need training for different roles and another 53% to need additional skills for their current jobs between 2026 and 2028.

As one example, Nixon-Saintil cited IBM’s AI Builders Challenge, which gave university students opportunities to develop AI applications using IBM Bob, the company’s AI-powered development tool. 

“They need to make the judgment calls, and they need to figure out when to override it as well,” she said, referring to developers’ responsibility for AI-generated code.

The importance of such oversight emerged from IBM’s recent study of human resources leaders. Researchers found that 71% of surveyed executives prioritize the ability to supervise, validate or override AI outputs, compared with 38% of employees.

Looking ahead, O’Reilly suggested that current coding assistants represent an early stage of a much larger transformation in software development.

“The biggest thing that we’ll realize is the current moment is still super early,” he said. “And super early means that many of the things that we’ll all think, ‘Oh my God, how did we miss that?’ are yet to appear.” 

— Sascha Brodsky

Making AI agents actually work means better data and stronger controls

9 a.m. EDT | October 27, 2026

The number of AI agents in the enterprise is set to explode, from an average of 15 per company today to 150,000 by 2028, according to Gartner. But more agents won’t necessarily mean better results. The real challenge for enterprises will be ensuring those agents have access to the right data, with the security and governance controls to keep them in check.

Figure 3. IBM’s Dinesh Nirmal speaks on the shift from building AI agents to scaling them at TechXchange 2026

Dinesh Nirmal, Senior Vice President for IBM Software, kicked off TechXChange 2026 to highlight this critical shift in the way businesses work in an era of hundreds, if not thousands, of AI agents. “Breakthrough [is] about agents that work together at scale,” Nirmal said. Automation delivers that scale. “Now you can go from serving a million users to 15 million users; you can go from deflecting 100,000 calls to millions of calls.”

While this explosion of scale is both impressive and promising, Nirmal pointed out that only 25% of AI agents are truly enterprise-ready today. What will it take to change this?

A data architecture for agentic systems

You’ve heard it from many tech practitioners: AI is only as good as the data you give it. Or, more simply, “Garbage in, garbage out.” 

“Agents can only work on what they can understand,” said Shaun Clowes, General Manager for IBM Data and Confluent, in the opening session. “They’re limited by the quality and timeliness of the context they can access,” he explained. Clowes defined context as the information required to complete a piece of work. “This definition really matters because it means that more is not better.” 

Another factor at play, Clowes said, is that the enterprise’s automated surface area has dramatically expanded: “With production agents, software can now directly participate in the business, usually autonomously.” Imagine the 150,000 AI agents working in this way across the enterprise, he posited. If fed fragmented or stale context, agents are liable to drive more errors downstream, increasing the rework and human intervention needed to right the ship. 

The streamhouse data architecture was designed to address these challenges. “It lets you continuously connect, stream, process, govern and serve the current state of your business, without needing to centralize your data in one place,” Clowes explained.  

Three critical attributes underpin the streamhouse architecture: always current, mission-critical and decentralized. The IBM Confluent data streaming platform delivers streamhouse capabilities right out of the box. “The key here is that you’re not ripping and replacing anything,” Clowes said. “You’re taking advantage of the data that’s already running through your business and making it continuously useful.” 

Kiyu Gabriel, Field CTO for Data at IBM, discussed the common approaches to data management today: data federation and data consolidation. While both remain useful in enterprise operations, each can limit teams from getting the most out of AI agent workflows.  

Data federation, for instance, allows data to connect to different sources without having to move the sources to one place. However, an increase in AI agents means that much of compute is spent serving status updates between the agents and the disparate, underlying data systems, which results in little useful work. 

Data consolidation, on the other hand, brings together data from separate systems in a centralized repository, such as a data lakehouse. The problem arises when that data finally reaches where it needs to be, after traversing from the original data source to the central data hub to the AI agent. By then, the data is stale and outdated, Gabriel said, leaving the agent misguided and misinformed: “Confused agents are bad agents.” 

Streamhouse gives an option between federation and consolidation. “We can have gold views of data that are reactive that I’m using to feed the lakehouse and query systems,” Gabriel said. “But it starts with the right data foundations for those agentic systems.” 

Visibility, accountability and control: Scaling AI agents securely

AI agents have been putting security and IT teams through the wringer over the last several months. In the hands of defenders, autonomous AI models have served as a tool to help identify and validate security vulnerabilities. Last week, researchers from security firm Wiz publicly disclosed two critical PHP vulnerabilities that affect 70% of the internet, crediting three frontier AI agents with “invaluable contribution” to bug discovery, exploit development and patch validation. But in the hands of attackers, AI agents are helping to exploit those very same vulnerabilities at an unprecedented scale.

At TechXchange, Tyler Lynch, Outbound CTO for IBM Automation, shared that more than 1,300 critical vulnerabilities were discovered in the Linux kernel in the last 30 days alone, including some decades-old flaws uncovered with the help of agents. Pair this surge of cybersecurity incidents with the fact that machine identities outnumber humans 80 to 1, and it becomes clear that the breadth and scale of security threats may only grow as frontier AI models advance.

What becomes crucial, Lynch said, is gaining visibility and control of the AI agents that span the business. “Security teams need to think beyond traditional access controls and consider identity, delegation [and] the behavior and intent of every agent that’s running in their environment,” he said.  

But how do we know which agents exist, and what tasks they’re actively working on? This is where tools like IBM Agent Identity and HashiCorp Vault 2.2 come into play, Lynch explained, enabling teams to address the challenges of agent visibility, accountability and access. With these capabilities, agent identities are registered with a distinct, verifiable ID. All agents and their activity then become traceable and auditable, allowing security teams to maintain accountability. When an agent misbehaves or engages in risky behavior, its session can be revoked in real time.

“Securing agentic AI requires more than securing the applications that the agent talks to,” Lynch said. “It’s about securing the agents themselves throughout their full lifecycle and their full stack.”

— Amber Forrest