Hey friends,
A three-person team broke into OpenAI this week using a cheap AI subscription, and the way they got in is the part worth your attention: an uploaded photo on a public forum. In the same week, Microsoft's own internal numbers showed AI answers cut clicks to one publisher by up to 93 percent. One story is about what your software depends on. The other is about what your customers depend on.
A three-person security team at startup Hacktron AI broke into OpenAI's internal systems in July using Anthropic's Claude, chaining two vulnerabilities to take over ChatGPT and Codex accounts belonging to OpenAI employees (TechCrunch). They entered on July 25 through OpenAI's community forum, which runs on third-party forum software called Discourse. When someone uploaded an iPhone photo in Apple's HEIC format, the forum passed the file to an image utility called ImageMagick, which handed it to a decoding library called libheif, where a memory bug let the researchers hijack the server. The researchers say the bug had already been fixed upstream months earlier but never received a public vulnerability number, which they say explains why the site was still running the broken version. OpenAI paid a $6,500 bounty and says the issues are fixed.
So what: the door was not a model, it was a photo upload on a public forum of the kind thousands of small businesses and associations run. You cannot audit a dependency you have never named. Your real security boundary is the patch cadence of the components you did not write, so ask your web host or forum vendor, in writing, how fast they ship upstream fixes, and put that answer in your vendor file.
The cost side is what changed this year. The chief executive of AI security firm Gray Swan told TechCrunch that for $200 a month anyone can use these tools and break into a company like OpenAI, and Hacktron's founder said exploit work that once took months now takes days. So what: the expertise needed to attack you dropped from a specialist to a subscription. If your risk plan assumed attackers could not be bothered with a small business, that assumption expired.
So what, concretely: stop treating account separation as optional. Give admin access its own login you never use for daily work, revoke connected-app permissions you cannot name, and switch on the strongest login check your tools offer. The breach that mattered at OpenAI was not a stolen model. It was a stolen employee account with a work connection attached.
📉 Microsoft's own data showed a 93 percent collapse in clicks
Newly unredacted filings in the New York Times copyright case against OpenAI and Microsoft describe an internal Microsoft presentation that called its Copilot answer engine a "doom loop," because click-through rates to the Times fell by as much as 93 percent versus traditional search (TechCrunch). So what: if search is a real slice of your customer pipeline, that slice is being eaten by an answer box rather than by a competitor, and no amount of ranking work wins it back. Own the email list, because an answer engine cannot intercept mail you already have permission to send.
🔎 Claude text now carries a hidden watermark
Anthropic explained how its text watermark works: future Claude models settle low-stakes word choices using a secret key, leaving a pattern a reader cannot see but a key holder can detect, done to comply with the EU AI Act (Anthropic). So what: AI-written text is becoming identifiable, and "we wrote this ourselves" is turning into a claim you may have to defend. If you publish AI-assisted content, say so in your own words now, while the disclosure is your choice.
🏦 Anthropic moved enterprise data control back to the customer
Anthropic's Enterprise Frontier Safeguards store data in cloud infrastructure the customer controls instead of Anthropic's, after 30-day retention on Fable 5 drew objections from regulated customers; it rolls out in phases from later this fall across Claude Enterprise, Bedrock, Google's Agent Platform and Microsoft Foundry (Anthropic). So what: if you work in healthcare, finance or law, ask for zero data retention on Fable 5 and 5.1 as the interim, and refuse any long retention term you did not actually need.
🛋️ Pinterest can now redecorate a customer's real room
Pinterest launched Restyle in beta in the US and Canada, letting a user photograph a room and swap in furniture, wall art and lighting or restyle the whole space, with a broad rollout next month (TechCrunch). So what: for anyone selling furniture, decor or paint, a flat catalog photo now competes against the customer's own room with your product in it. Get your images somewhere Restyle can reach them, and check the render against your color accuracy first.
🪪 Pubs and shops in England and Wales can accept a phone as ID
Digital ID apps from providers including the Post Office, Yoti and Luciditi are approved for age checks alongside physical documents, and a venue verifies with a free checker app that reads a short-lived QR code (BBC). So what: if you sell age-restricted goods, that is one app install and one page of staff training, and physical ID stays valid because the change is optional.
🚫 A UK watchdog banned five AI ads in a single action
The Advertising Standards Authority banned five ads for AI companion and video apps, including one that sexualised a character presented as under 18 and others inviting users to upload a photo of their crush, and it found them with an AI system that scans for rule-breaking ads without waiting for a complaint (BBC). So what: if your marketing uses AI-generated images of people, assume a regulator can surface them unprompted. Audit that library this month.
⛓️ NVIDIA and Palantir are packaging sovereign AI for supply chains
NVIDIA and Palantir announced sovereign intelligence for critical supply chains, built to keep data and processing inside a country's own infrastructure (NVIDIA). So what: if you supply a regulated industry, expect procurement forms to start asking where your AI-processed data physically sits. Knowing that answer now is cheaper than discovering it during a bid.
A dependency is any piece of software your business needs but never chose. Follow one photo. A customer uploads an iPhone picture, your forum software cannot read that format, so it calls an image utility, which calls a decoding library, and that last link is the one that failed at OpenAI. Every step in that chain is maintained by someone else on a schedule you do not control.
OpenAI's forum ran the vulnerable version even though the library had been fixed months before, because the fix never received a public vulnerability number, and a site with no number to watch will never know to upgrade. That is the entire mechanism. Nobody made a mistake that would show up in a review meeting.
So what: list the five components your website cannot run without, name who patches each one, and review that list once a quarter. If a vendor cannot state their patch policy, that silence is your answer about the risk you are carrying.
🧠 Trivia
The attackers got into OpenAI through a photo upload. What went wrong twice?
First, an iPhone image format was handed to a decades-old decoding library that carried a memory bug. Second, the upstream fix was never officially flagged as a vulnerability, so there was no public number to watch and the site kept running the broken version.
AI for Everyday Business: practical AI, no jargon.
Forwarded this? Subscribe here
Sent by AI for Everyday Business.
8735 Dunwoody Place STE R, Atlanta, GA 30350