Networking vendors have marketed AI-driven operations for roughly a decade. That makes this an unusually good area to practise separating a mechanism from a claim — and the evidence is better than you would expect, because two of the sources are academic and one is a competition regulator.

• Anomaly detection on high-rate telemetry. Given seconds-granularity data, per-interface baselining finds things thresholds miss, because the useful signal is ‘this interface's error rate is six standard deviations above its own Tuesday-morning baseline’. Note the dependency: this requires streaming telemetry to work at all. Applied to five-minute polling, ‘AI anomaly detection’ is a threshold alert with extra steps — and that is the most common rebrand in the industry.
• Alert correlation using topology. Collapsing four hundred downstream alarms into one upstream cause. Real, valuable, and mostly graph traversal rather than learning.
• Predictive failure on optics and hardware — the strongest genuine case. Optical transceivers degrade monotonically and observably: received power drift, pre-correction error-rate trend, temperature. That is classical prognostics on a component with a real physical degradation mechanism. The tell for whether any ‘predictive AI’ claim is real: ask what the physical degradation mechanism is. If there isn't one, it is a classifier over past outages and it will not generalise.
• Radio-frequency optimisation. Genuinely well-suited — high-dimensional, continuously measured, a real feedback loop, and low blast radius. It is not an accident that the strongest vendor claims in this space are about wireless.
• Retrieval and summarisation over documentation, configs and past tickets, and read-only natural-language query of a source of truth. Bounded failure modes, real time saved.

This is the one place where the sceptical case became quantitative, and the study is worth knowing in detail. A 2026 academic benchmark generated 231 misconfiguration scenarios across topologies from twenty to seven hundred and fifty-four nodes, and evaluated nine frontier models' repairs by formal verification against ground-truth specifications — not by string similarity to a reference answer.

• The best model achieved 25.5% complete resolution with zero regressions.
• Regressions frequently accompany fixes — the model repairs the reported fault and introduces a new violation it was never told to preserve.
• Performance degrades sharply with scale. Large configuration files defeat the models.
• Diagnostic accuracy does not imply repair success — models correctly identify the problem and then propose partial or unsafe solutions. That dissociation is the most interesting finding, because a demo only ever shows you the diagnosis.
• And the amplification figure: the injected faults changed on average 0.44% of configuration lines but disrupted 6.82% of network predicates. Roughly fifteen times amplification from text to behaviour.

That ratio is the whole answer. Network configuration has extreme leverage from text to behaviour — one line is the difference between a policy that filters and one that leaks your full table. Code-review intuition calibrated on application code is calibrated wrong here, and so is a language model, because the training signal for ‘this looks like plausible router config’ is almost entirely orthogonal to ‘this preserves reachability’.

The failure modes specific to network config are worth listing, because they are not the ones people expect: syntactically perfect and semantically catastrophic (it parses, commits, and partitions the network); plausible-but-wrong identifiers; ordering violations, such as a correct access-list entry placed after the deny; vendor-dialect bleed; silent scope expansion, where a slightly wrong prefix length is 256 times wrong and looks right; and the self-severing change — the model has no concept of your management path and will happily remove its own operator's reachability.