Salesforce built its own reasoning model on open weights. A startup raised $40 million to inspect AI agents before they touch your systems. Both landed on the same day, and together they are a blueprint you can copy small.
Two announcements dropped on Tuesday, September 15, 2026. Read separately, they’re a product launch and a funding round. Read together, they’re a preview of what enterprise AI looks like once it grows up.
My verdict: Salesforce’s new Koa model proves that a company with deep expertise in one job can now build its own specialized reasoning model instead of renting every ounce of intelligence from OpenAI, Anthropic, or Google. AIUC’s $40 million raise proves the next question buyers will ask is not “is this agent smart enough” but “who checked that it won’t leak my data.” Own the routine thinking, rent the hard thinking, and get both inspected before they go live. That’s the play, and a small version of it fits in a weekend.
The landlord and the garage
For two years, most companies have been renting their AI the way you rent an apartment. Every request goes to the landlord, the landlord sets the price, and you never own anything. It’s a nice building, though.
Koa is Salesforce deciding to build a garage instead of a mansion, with one very specific car parked inside.
Salesforce took NVIDIA’s open-weight Nemotron 3 Super model and post-trained it on a synthetic dataset modeled on 27 years of CRM workflows: qualifying leads, routing service cases, scheduling follow-ups. No customer data went in. Salesforce says the scenarios simulate workflows across more than 14 industries, each one pairing a persona with a task and mapping the exact sequence of tool calls an agent needs to finish it.
Then Salesforce kept the weights. Post-training and inference run inside its own infrastructure, so customer data never leaves its trust boundary. Jayesh Govindarajan, Salesforce’s EVP of AI, told TechCrunch the company had always leaned on frontier labs for reasoning, “until now,” and that the missing piece before Nemotron was a US-made, open, state-of-the-art base model with clear data provenance.
I’ll be honest about my reaction. My first thought was “great, Salesforce has a model, I will never touch it.” My second thought was the one that matters: if the recipe is open weights plus your own expertise plus synthetic data, the recipe isn’t exclusive to Salesforce. It’s just expensive right now, and expensive things get cheap.
The part Salesforce isn’t saying loudly
Salesforce is not breaking up with the frontier labs. Three weeks before Koa, on August 26, it announced ClaudeForce with Anthropic, which lets companies use Claude as the interface while their data stays inside Salesforce. TechCrunch reports that Agentforce’s AI gateway routes each request to whichever model fits: Koa for CRM reasoning, a frontier model when the job is harder.
The picture is a stack. Open weights become specialized models. Specialized models sit behind a router. The router calls a frontier model on demand. Salesforce just published the wiring diagram, and I think it’s what most serious companies will end up running.
Meanwhile, someone showed up with a clipboard
The same day, AIUC (the Artificial Intelligence Underwriting Company) announced a $40 million Series A led by Ribbit Capital, with First Harmonic participating. Total raised: $55 million.
The funding is the boring part. What AIUC sells is a standard called AIUC-1, an independent audit against it, a certification mark, and insurance tied to the result. Think SOC 2, the compliance stamp cloud companies show to prove they handle your data responsibly, but for how an AI agent behaves when someone tries to break it.
AIUC says the standard runs agents through roughly 5,000 risk-and-attack combinations covering jailbreaks, hallucinations, and data leaks, then recertifies every quarter. Cursor, ElevenLabs, Harvey, KPMG, Lovable, UiPath, and Fin already carry the mark. Cursor’s own write-up says its audit, performed by Schellman, covered secrets protection, secure code generation, MCP security, and agent identity and permissions.
Co-founder Rune Kvist, who was Anthropic’s first product hire, described the buyer’s problem in one line: most enterprises have a list of agents that passed the pilot and stalled at the security review.
I have lived that sentence from the government side. I spent years watching capable tools die in the accreditation queue, not because they didn’t work but because nobody could prove what they would refuse to do. AI agents are walking into that exact moment. Capability stopped being the bottleneck. Evidence is the bottleneck now.
What you can actually do with this
This is the part I care about most, because none of it needs a Salesforce budget.
Build a tiny Koa of your own. NVIDIA publishes Nemotron 3 Super as an open-weight download, and the post-training toolkit Salesforce used (NeMo RL and NeMo Gym) is public. You don’t need 27 years of data. Write out the ten workflows your team repeats every week, generate synthetic examples of each with a frontier model, and fine-tune a small open model on a rented GPU. Realistic expectation: a weekend for a rough version, and a model that’s worse than Claude at everything except your ten workflows, and that’s exactly what you want it to be.
Put a router in front of your AI. Even if you never train anything, you can stop sending every question to the most expensive model. A routing service or a simple rules layer in your own code can send routine tasks to a cheap model and only escalate the hard ones. Salesforce’s entire strategy is this idea with a bigger budget.
Ask for the report before you buy an agent. If a vendor says their agent is “enterprise ready,” ask whether it holds an AIUC-1 certification and whether you can see the audit scope. If they don’t, ask what independent testing covered secret exposure and MCP security. The answer tells you more than the demo.
Run your own mini inspection. Take the AIUC-1 categories and spend an hour trying to break your own agent. Paste a fake API key and see if it repeats it. Feed it a document with hidden instructions. You will find something. Everybody does. Finding it yourself beats finding it in a breach notification.
What it costs, and what you’re licensing
Koa is Salesforce-hosted and sold through Agentforce, so there is nothing to download. Salesforce has not published Koa pricing as of September 16, 2026. The pitch is that it burns fewer tokens per task than sending the same job to a frontier model, which is where the savings would come from. Availability: select pilot customers now, general availability expected winter 2026 in US regions.
The base model, Nemotron 3 Super, is a free download under NVIDIA’s open model license. Re-verify the exact terms on NVIDIA’s model page before you build a product on it. The real cost of doing this yourself is GPU rental for post-training and hosting, plus the hours to build the synthetic data.
AIUC-1 pricing is not public. Cost is driven by the independent audit (Cursor used Schellman), the adversarial testing, and quarterly recertification. Insurance is priced on top of the audit result.
Claims vs. Receipts
Claim: Koa “matches or exceeds leading model performance on CRM actions with three times fewer errors.” (Salesforce press release, September 15, 2026.) Receipt: That number comes from Salesforce’s own CRM benchmark, published in a Salesforce research paper submitted to arXiv on September 14, 2026. As of September 16, no independent lab has replicated it. Treat it as a vendor figure until someone outside the building runs the test.
Claim: TechCrunch’s headline calls Koa “everything the AI labs should fear.” (September 15, 2026.) Receipt: Salesforce signed Claudeforce with Anthropic on August 26, 2026, and Koa won’t be generally available until winter 2026. The labs are not losing a customer. They’re becoming the expensive tier in a router.
Claim: An AIUC-1 mark means an agent is trustworthy. Receipt: AIUC recertifies quarterly because agent risk changes when tools change, and a Cloud Security Alliance research note (June 5, 2026) says organizations certified against the earlier version must close new gaps before the next audit. One more wrinkle: TechCrunch’s September 15 story lists four AIUC customers; AIUC’s own release the same day lists seven. Neither is wrong. The smaller number is the one most coverage repeated.
So What
Do this: Write down your ten most repeated workflows this week. That list is the raw material for a specialized model, a router rule, and a vendor question. All of them start there.
Skip this: Waiting for Koa. It’s Salesforce-only, pilot-only, and US-only until winter.
Wait on this: Making AIUC-1 a hard purchasing requirement. It’s the strongest signal available today, but it’s one company’s standard, and the audit ecosystem is months old.
Steal this line: “Rent the genius, own the grunt work. Then get both inspected.”
Salesforce spent 27 years earning its version. You can start with ten workflows and a weekend. It’s the same recipe in a smaller kitchen.
Receipts/Sources:
The landlord and the garage
Salesforce Newsroom: Announcing Koa, Salesforce’s First CRM Reasoning Model, Built on NVIDIA Nemotron (September 15, 2026). Backs the Nemotron 3 Super base, 27 years of CRM knowledge, synthetic data with no customer data, 14+ industries, weights kept in-house, and the pilot customer list.
TechCrunch: Salesforce and Nvidia’s new reasoning model is everything the AI labs should fear (September 15, 2026). Backs the Govindarajan quotes, the data-provenance reasoning, the token-efficiency claim, and the AI gateway routing.
The part Salesforce isn’t saying loudly
Salesforce Newsroom: Salesforce and Anthropic Announce Claudeforce (August 26, 2026). Backs the Claudeforce date and the “Claude as interface, data stays in Salesforce” description.
Meanwhile, someone showed up with a clipboard
PR Newswire: AIUC raises $40M Series A from Ribbit & First Harmonic to build confidence infrastructure for frontier AI (September 15, 2026). Backs the $40M round, $55M total, 5,000 risk-and-attack combinations, quarterly recertification, the seven certified companies, the founders’ backgrounds, and the Kvist quote.
Cursor Blog: Cursor earns AIUC-1 certification for agent security and reliability (2026). Backs the Schellman audit and the coverage of secrets protection, secure code generation, MCP security, and agent identity and permissions.
What it costs, and what you’re licensing
Salesforce Newsroom: Announcing Koa (September 15, 2026). Backs pilot-now, general availability winter 2026 in US regions.
Claims vs. Receipts
arXiv: Koa research paper (2609.15066) (submitted September 14, 2026). Backs the benchmark methodology being Salesforce’s own and the 120B Nemotron base per the paper.
Cloud Security Alliance: AIUC-1 Q2 Refresh, MCP Security and Agent Identity Controls (June 5, 2026). Backs the quarterly changes and the requirement that earlier-certified organizations close new gaps.
TechCrunch: Early Anthropic hire, former METR COO have found a way to rein in rogue AI agents (September 15, 2026). Backs the four-customer list, the ~100-page report, and AI-run tests with human verification.