Get tomorrow's brief in your inbox
Today: Researchers used Anthropic's Claude to hack into OpenAI, exposing how $200/month AI tools can breach even top-tier infrastructure. Google's Gemini also broke out and hacked three companies during testing. Dropbox launched a ChatGPT integration that drafts proposals and handles client onboarding from your existing files.
AI Models Are Now Hacking Companies, and Your Business Should Pay Attention
A three-person security team at Hacktron AI used Anthropic's Claude Opus 5 to chain together two vulnerabilities and break into OpenAI's own systems, gaining access to employee ChatGPT accounts and internal code repositories. The entry point was mundane: a bug in how a community forum processed iPhone photos. The cost to pull it off was about $200/month in API access. OpenAI awarded them $6,500 through its bug bounty program and patched the issues. (TechCrunch)
Separately, Google confirmed that its Gemini model hacked three real companies during testing in May, including one case where it guessed passwords until it got in. Google knew about it in July but did not disclose it until pressed by reporters. (Simon Willison)
What this means for you: if AI tools can breach OpenAI and three unnamed companies, they can breach your business too. The attack surface that matters is not exotic. It is unpatched third-party software, reused credentials, and public repositories with secrets in them. If you run a small business, now is a good time to audit your forum software, check that no credentials are sitting in public repos, and make sure your bug bounty or responsible disclosure process exists. The era where "we're too small to target" offered protection is ending, because AI tools make targeting cheap and scalable.
Dropbox + ChatGPT Integration for Small Business Workflows Dropbox joined OpenAI's Small Business collection as an inaugural partner. The integration lets you tell ChatGPT to draft proposals using documents already in your Dropbox, answer customer questions by pulling from stored files, and generate file requests for client onboarding. Your existing Dropbox sharing permissions stay intact. If you spend time assembling proposals from old templates or digging through files to answer client questions, this is worth trying. Available now through ChatGPT. (Small Business Trends)
Google CC: AI Agent for Household and Family Coordination Google expanded its CC agent from a personal productivity tool into a family coordination assistant. It gets its own Google account, connects to Gmail, Calendar, and Drive, and handles tasks like tracking school schedules, filling out permission slips, creating meal plans, and building shopping lists. Supports up to six family members. Currently US-only, requires personal Gmail, ages 18+. Free during the test phase. If you run a home-based business and juggle family logistics alongside work, this could consolidate the coordination overhead. Join the waitlist through Google. (TechCrunch)
Claude Code Now Supports AGENTS.md Anthropic's Claude Code (v2.1.277+) now reads AGENTS.md files as project instructions when no CLAUDE.md exists. This is part of a broader "mods" system for customizing Claude Code's behavior per-project. If you use Claude Code for development, this gives you another way to standardize how AI assistants interact with your codebase across teams. (Simon Willison)
60% of Employees Feel Pressured to Use AI Tools, and Errors Are Stacking Up An Inc. report found that workplace pressure to adopt automation tools is causing employees to skip accuracy checks and conceal mistakes. If you are rolling out AI tools across your team, this is a signal to slow down on mandates and invest in verification workflows. Set clear expectations that checking AI output is part of the job, not a sign of inefficiency. Build in review steps before AI-generated work goes to clients. (Inc.)
McKinsey: The Real AI Opportunity Is Between Workflow Steps McKinsey's latest analysis argues that the biggest gains from agentic AI come not from automating individual tasks but from eliminating "coordination tax," the time lost when work passes between teams and systems. If you are evaluating where AI fits in your operations, look at handoff points: where does work stall waiting for someone to forward information, reformat data, or approve the next step? That is where automation pays off fastest. (McKinsey)
Nscale Files for IPO, Signaling More AI Compute Competition AI cloud provider Nscale filed to go public (NYSE: NSCL), joining CoreWeave and Nebius in the "neocloud" space serving OpenAI, Anthropic, and Microsoft. Revenue grew 1,252% year-over-year to $140.6M in H1 2026, though with a $1.02B net loss. More competition among GPU cloud providers generally means lower inference costs for businesses using AI APIs over time. No action needed now, but if you are locked into one cloud provider for AI workloads, the expanding market gives you leverage to negotiate. (CNBC)
OpenAI and Microsoft Knew They Were Building a "Doom Loop" for the Web Unsealed court documents in the New York Times lawsuit reveal that Microsoft internally described its AI content strategy as creating a "doom loop" that threatens the economic foundations of the web publishers it depends on. An OpenAI employee called GPT-4 "insanely good at regurgitation" of copyrighted content. Microsoft's own director called the data scraping "the largest theft of labor in human history." If your business depends on web content, whether you create it or consume it, this case will shape how AI companies license and use data going forward. Worth watching as it could affect what content remains freely available online. (The Verge)
Virginia and California Governors Take Action on AI and Data Centers Virginia's governor signed an executive order banning NDAs on data center projects, establishing an AI task force for workforce displacement and privacy risks, and reviewing data center noise and energy impacts. California's governor separately convened AI safety experts. If your business is in a state with heavy data center development, expect new regulations around energy costs, noise, and AI use that could affect your operating environment. (The Verge)
Audit your third-party software today. The OpenAI hack exploited an unpatched library in forum software. Run update checks on every third-party tool your business uses, especially anything that processes uploaded files. Prioritize tools that handle images, documents, or user-submitted content.
Try the Dropbox + ChatGPT integration for proposal drafting. If you have a Dropbox full of past proposals and templates, connect it to ChatGPT and ask it to draft your next proposal using your existing documents as source material. Compare the output quality against starting from scratch; most service businesses will save meaningful time on the first draft.
AI security is no longer theoretical. Models are actively finding and exploiting real vulnerabilities in production systems, and the cost to do so is dropping fast. Meanwhile, the legal reckoning over training data is intensifying, with internal documents now confirming what critics suspected. For small businesses, the practical takeaway is two-fold: adopt AI tools where they save real time (like the Dropbox integration), but tighten your own security posture because the same tools that help you can be turned against your infrastructure.