The people selling you AI just got nervous

Do this: Open last month's card statement and list every AI tool you pay for, with its monthly amount. Paste the list into a free chatbot and get keep, cut or downgrade on each line, plus the cancellation email for anything you cut.

PASTE THIS

Help a small business owner cut software waste. Here are the AI tools we pay for this month, with the monthly amount: [PASTE TOOL, AMOUNT]. For each line give keep, cut or downgrade, with a one-sentence reason based on the work it produced this month; the cheaper tier or free option to move to, if one exists; and for every tool marked cut, a three-sentence cancellation email asking for written confirmation and the exact end date. Finish with the total monthly saving.

You'll get: A keep, cut or downgrade on every line, the emails ready to send, and the monthly total you stop paying.

The one-page plan for the week your software vendor disappears

Every business rents at least one system it could not rebuild. Fill this in and keep it with the bank details.

1. What we would lose: the three data sets that matter (customers, jobs, invoices), and where each one lives.
2. The export test: when we last exported each one, and whether we opened the file on a machine without their software.
3. The domain login: who holds the registrar, and the second person who can get in.
4. The admin email: the address every password reset routes through, and who reads it.
5. The money rail: the card processor, and whether we can still be paid without the vendor.
6. The 48 hours: who calls customers, who rebuilds the booking page, who tells staff.

The export test is the only line that proves anything. The rest is intention.

A shared chat link was a login key

Researchers took over ChatGPT accounts with an ordinary shared chat link: it ran code inside the signed-in session and could read private chats never shared with the sender. Opening the link was the only step needed, and OpenAI fixed it on 26 October, Parameter Labs reports. So what: this week, tell staff an AI chat link from a stranger is a file to avoid, and check no business account runs on a shared login.

Four labs agreed on one way to keep pages out

OpenAI says it will honour one robots.txt signal that covers several AI providers at once, instead of a rule per crawler, and posted the change itself; Google, Microsoft and Anthropic signed the same pledge, The Verge reports. The switch lands in the coming months. So what: check your robots.txt this week. Most small-business sites let every crawler in, so the decision to hand over your pages is already made.

A tampered AI extension reached 5,000 people

A malicious copy of the Claude Code extension was published through Cursor's marketplace and reached at most 5,000 users, Cursor said. The build was not Anthropic's and other extensions were unaffected, The Register reports. An editor marketplace is an unvetted supply chain in a laptop. So what: this week, open the extension list on any machine that touches customer data and delete anything whose publisher you cannot name.

What did your AI tools actually produce last month?

A. Work you could invoice

B. One task, done faster

C. Nothing you can point to

D. Nobody is counting

Reply with one letter — results next issue.

Google's first data-centre satellite sent its AI reply back to Earth this week. What did the chip actually produce?

Answer tomorrow — and no, we are not printing it here.

YESTERDAY'S ANSWER

North Korean hackers drained about $6.3 billion from Binance across ten blockchains. Roughly how long did the drain take?

About 20 minutes. TRM Labs attributes the raid to a North Korea-linked group it calls TraderTraitor, and Binance has pledged to cover the losses (Reuters, Wired).

Setups like today's 2-Minute Win can be installed for businesses like yours — reply SETUP and we'll send what's involved.