“Despite AI writing 80-90% of a new feature's code at Box, the release was ultimately rate-limited by the need to conduct a full, traditional security review.”