Well what a month it’s been. Some of the worst threats to cybersecurity and nobody knows how to prevent it. Is this the future we live in? Nothing is really secure, just an illusion that it is.
The only thing scarier is the fact that I bought like 20 pounds of clearance candy at the store yesterday. My fiancée asked me “Do we really need all of that?” I looked at her square in the eye and said “Well how else am I gonna watch football today?”
Along the Wire
- New models: Google and OpenAI are back at it again with Gemini 4 Argon, Gemini 4 Carbon and GPT-6.1 Terra
- Black October hits banks, websites and AI platforms
- DLMs explained
- 9 things to help your business out so that you don’t accidentally give away your clients’ info
DLMs
Last week we said diffusion language models could make AI a lot cheaper. Training models could change massively and make changes to how much a data center might consume.
The typical chatbot writes one word at a time, like an assembly line. It puts those words together and spits out an answer. A diffusion model works more like painting. The model pushes out an idea and refines it over and over again. Because it’s not going sequentially, the model can use less compute, thus leading to less energy and resources being used.
Now, you probably won’t hear these terms for a while. This was first discussed last week and the frontier AI companies most likely won’t release this for a few months or years. Now, you can quote me when they decide to release this next week instead.
Back to October
Black October is a pretty spooky name. I’d give it a spooky name too if I knew it was reading my statements. AI helped researchers find old flaws in PHP, the code behind about 70% of websites,¹ and big banks found AI agents poking around inside customer accounts using the customers’ own logins.²
Hackers also broke into at least nine AI platforms to steal API keys,³ and one group used an AI tool to guess Microsoft 365 logins nearly 3,000 times a minute.¹ Not all of it was AI, though. One company’s security key was literally the number 4. Maybe running a business isn’t for everyone…
Who’s Actively Regulating This?
Well, I guess midterms are coming up so we might be getting some new rules to follow. A Washington Post analysis found AI and data centers came up in nearly 40% of House, Senate and governor races this cycle. Democrats are mostly running on regulation and kid safety, Republicans mostly on national security and beating China.⁴ Voters want safeguards, which you bet means your clients will want it too.
In Congress, there’s a new bill called the AI Agent Accountability Act,⁵ which assigns the blame to whoever releases an AI agent. Part of the reason this company was named Wrangl is because it’s eerily similar to wrangling cattle. If an agent goes rogue and hacks something, the company that built it and the company that turned it on could both be on the hook. If your cow runs away, you wouldn’t blame the cow. So if your shiny new agent starts picking locks, “the agent did it” isn’t going to cut it.
None of this is law yet though. Congress still can’t agree on what the rules are or who enforces them,⁶ and states have stepped in with more than 35 AI laws this year.⁷ It really doesn’t matter who wins on Tuesday, because protecting your business is still your job for now.
Wrangl Steps to Success
Here is a non-technical version of how to actually protect you and your clients’ info.
- Never give an agent your password. This is like the internet 101, but sometimes it just needs to be said again.
- Let agents look, not touch. Read Only permissions exist for a reason. It is usually as easy as going through your connectors list and tweaking a few settings.
- Make it ask before it acts. Turn on confirmation for anything that sends a message, spends money, deletes something or changes a setting. Last week we talked a lot about always on agents, which make it difficult to do this. However, spamming “allow” 100 times can get annoying quick. Just do step 2 to clear this one up.
- Turn on MFA everywhere. It used to not feel so important to do this step, but now it’ll be the reason your bank account isn’t getting broken into.
- Patch your website. If your site runs on WordPress or anything else built on PHP, ask your web host today whether you’re covered for PHP2Shell. If you’re like most of our clients, just ask whoever made it to figure this out for you.
- Keep a list of every AI tool with access. Who connected it, what it can see, what it can do. If you can’t list it, you can’t shut it off when something goes wrong. Anthropic and OpenAI have made this very easy to check in organization settings.
- Don’t feed it what it doesn’t need. Customer SSNs, bank details and medical info don’t belong in a chatbot. Clean and limit the data before it goes in. Those might go without saying, but you never know.
- Check the logs once a week. Most tools show what the agent did. Just look for things you didn’t ask for.
- Have an off switch. Knowing how to turn it off can save you a huge headache when auditors come around.
More About Us
This is the stuff we do at Wrangl. We clean up your data, figure out which model actually fits for you, and set it up with the guardrails above already in place.
Join us next week for more on what’s happening in AI, and reply if there’s something you want us to dig into. We also got a new website (check it out here).
Feel free to check us out and follow along for our weekly newsletter. Have a great one!
— The Wrangl Team (Still Real People)
Sources
- Fortune: Black October AI cyberattacks
- Raw Story (citing Axios): Banks rein in AI agents
- Wiz: Black October for AI developer platforms
- Washington Post analysis, via Neura Market: AI and data centers in 2026 campaigns
- Axios: Hawley, Murphy push AI liability
- Holland & Knight: AI regulation push gains steam ahead of midterms
- Forkast: The regulatory gap