Aaron Levie says agents will use software 100X more than people - and force new SaaS guardrails

Box CEO Aaron Levie argues that AI agents will drive 100 times more software usage than humans, transforming enterprise SaaS into high-volume infrastructure requiring new guardrails for data access, permissions, and auditing. Levie's thesis, shared on X, positions Box as a governed content layer for enterprise AI, while Salesforce and Anthropic are already building similar agent-facing controls.

Aaron Levie @levie https://x.com/levie is making the case that AI agents will not kill enterprise software, but will turn it into high-volume infrastructure that needs a new control layer. The Box https://www.box.com/ co-founder and CEO wrote https://x.com/levie/status/2068851573175021864 on X on Sunday, June 21, that "Agents will use software 100X more than people." His point was not that systems of record disappear when agents arrive. It was the opposite: CRM records, corporate documents, analytics systems and internal knowledge bases get hit more often once a machine can query them without the friction that keeps employees from doing the same work manually. https://x.com/levie/status/2068851573175021864 https://x.com/levie/status/2068851573175021864 That is a self-interested argument from a CEO whose company is trying to own the governed content layer for enterprise AI. It is also a clean articulation of the next fight in SaaS: whether the value accrues to the application where the data already lives, the agent that calls it, or the governance layer that decides what the agent is allowed to see and change. Levie's post followed a Podcast Alpha https://podcastalpha.substack.com/p/aaron-levie-on-ai-agents-for-cios write-up of his June 12 appearance on CXOTalk https://www.cxotalk.com/episode/box-ceo-aaron-levie-cio-advice-on-agentic-ai-and-the-enterprise , where he discussed why enterprise agents are moving faster in software development than in broader knowledge work. CXOTalk described the episode as a discussion of why agents stall in production, break existing permission models and create costs CIOs did not budget for. The transcript identifies Levie as Box's CEO and co-founder, and says he launched Box in 2005 with Dylan Smith. Levie's original post sharpened that argument into an investor and operator thesis. If a single agentic task can pull more data than an employee touches in a month, the software underneath gets more usage, not less. The catch is that traditional enterprise permissions were built around people clicking through products, not agents traversing several systems at machine speed. Greg Kamradt @GregKamradt https://x.com/GregKamradt pushed the practical question underneath the thesis: should guardrails live inside each application, across custom agents, or both? Levie answered by listing the missing enterprise substrate: controls to prevent data leakage or wrong writes, authoritative sources of truth, logging and auditing, and ways for agents and humans to collaborate inside the same systems. That is where the post moves from AI optimism into budget and architecture. Agents do not merely need API access. They need an operating model for least privilege, source ranking, action approval, identity, audit trails and rollback. The old SaaS security pattern assumes a user has a role, a session and an interface. The agentic pattern adds a machine acting on behalf of that user, often across tools, sometimes with the ability to read many more records than the user would have opened by hand. Salesforce is already pushing in this direction. In May, Salesforce said its Data 360 MCP Server https://www.salesforce.com/blog/introducing-the-data-360-mcp-server-your-unified-data-ready-for-any-agent/ was available in Developer Preview, letting MCP clients including Cursor and Claude Code interact with Data 360. Salesforce's developer documentation says hosted MCP servers https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/hosted-mcp-servers-overview.html let compatible AI clients connect to a Salesforce org and act on behalf of authorized users using OAuth-based authentication. The same direction is visible in Anthropic's Claude Code MCP documentation https://code.claude.com/docs/en/mcp , which describes MCP servers as a way for Claude Code to connect to external tools, databases and APIs. For Box, this is close to the center of the product strategy. Box reported $305.9 million of revenue for the fiscal first quarter ended April 30, 2026, up 11% year over year, and said customers were adopting Enterprise Advanced to connect their content to AI agents. Box also guided to roughly $1.280 billion of revenue for fiscal 2027. Those numbers make the agent argument more than a thought experiment: Box is already telling public-market investors that AI-linked content management is part of its growth story. Box's own product language shows the bet. The company says Box AI https://www.box.com/ai/ supports OpenAI, Anthropic and Google models, and describes Box Agent as a secure, permissions-aware system that works with enterprise content, Box AI Studio and a Box MCP Server. Those are company claims, not independent proof that Box wins the category. But they show why Levie is arguing that incumbent systems of record can benefit from agents if they become the governed context layer for headless work. The uncomfortable implication is that usage growth and risk growth arrive together. If agents make Salesforce, Box, analytics tools and internal databases easier to query, vendors can point to higher engagement and potentially stronger pricing power. CIOs inherit the harder problem: each new connection expands the blast radius of a bad prompt, stale permission, poisoned document or mistaken write. Levie has been warning against both extremes. On CXOTalk, he argued that coding agents have taken off because code is text-based, engineers are technical, and software output is easier to test. Knowledge work is messier because outputs such as contracts, market research and financial analysis are harder to verify, users are less technical, and company data is scattered across systems. That gap is why he can argue agents will massively increase SaaS usage while also insisting that the enterprise rollout will take years. The strategic question is no longer whether agents will touch enterprise software. They already are. The question is whether the governance follows the application, the agent, or a new layer sitting between them. Levie's answer is effectively all three, but with a bias toward platforms that already hold trusted corporate context. That is the case Box needs the market to believe: in the agentic era, the system of record is not a relic. It is the surface area agents keep coming back to.