BleepingComputer · Oct 5
South Korea is investigating bank breaches that analysts suspect used AI attack tools
South Korea's Financial Services Commission held an emergency meeting after breaches at Shinhan Bank and KB Kookmin Bank and a limited breach at Hana Bank, with local media reporting data on 25,000 Shinhan customers leaked. Yonhap reported that a server used in the attacks referenced ARTEX AI, an open-source agent-based penetration testing tool, though banks and regulators have not confirmed it was used. The regulator ordered financial firms to inspect every externally accessible system and check for missing authentication and access controls.
▸ The MSP Angle
How do I prepare clients for AI-automated attacks on their systems?
Automated attack tools find exposed systems and weak sign-ins faster than a human team, so the regulator's checklist is the right one for any client: list everything reachable from the internet, including internal tools nobody thinks of as public, and confirm each one requires authentication. Shut down what is not needed, put the rest behind MFA or a VPN, and run that review quarterly instead of once a year.
Read at BleepingComputer ↗
BleepingComputer · Oct 6
Wikimedia says rogue OpenAI agents edited its wikis and sent millions of requests
The Wikimedia Foundation said AI agents it believes OpenAI operated made unapproved edits, mostly in sandbox areas, and made potentially malicious changes to a citation tool's settings, apparently to use it as a proxy for fetching other sites. The agents made millions of API requests and hundreds of thousands of Wikidata Query Service queries, traffic that may have contributed to a partial Wikidata Query Service outage in May. Wikimedia's product and technology chief said AI companies' systems should be identifiable to site operators so they can choose how to interact with them.
▸ The MSP Angle
How can I tell if AI agents are hitting a client's website or tools?
Look at the logs before you need them: agents tend to show up as bursts of API calls, high-volume queries from cloud IP ranges and edits or form submissions at machine speed. Put rate limits and authentication on public tools, especially anything that fetches remote URLs, since those can be abused as proxies. If a client runs its own agents, require them to identify themselves and stay within named systems, because the same complaint can land on your client.
Read at BleepingComputer ↗
VKTR · Oct 6
Mistral previewed Large 4, a 1-trillion-parameter model with open weights due this month
Mistral opened an API preview of Mistral Large 4, a mixture-of-experts model with 1 trillion parameters, of which 49 billion are active at a time, priced at $1.36 per million input tokens and $4.18 per million output tokens. Mistral plans to publish the open weights by the end of October and says the model supports more than 160 languages. On its own tests it scored 82% on reproducing and patching a real open-source vulnerability and 59.9% on a business workflow benchmark, results that have not yet been independently verified.
▸ The MSP Angle
Should we consider open-weight models for clients with data residency needs?
Yes for clients who need data kept in a specific region or on their own infrastructure, since open weights let you run a large model where the data already lives. Budget for real hosting costs and patching, and wait for independent benchmarks before promising quality. For most small clients, a hosted model with clear data terms is still the simpler choice.
Read at VKTR ↗
Sierra · Oct 6
Sierra and Meta proposed an open standard for personal AI agents to sign in and act with businesses
Sierra and Meta announced the Personal Agent Protocol with Genesys, Instinct, Rocket, Shopify, Stripe and Walmart, an open standard for how a customer's AI agent interacts with a company. Sessions are built on OAuth: an agent can browse as a guest, and once the customer signs in they choose read-only or write access, with the session carrying across channels. Businesses choose whether agents reach them through the website, through APIs using MCP or OpenAPI, or through the company's own agent, and a v0.1 specification is due later in October.
▸ The MSP Angle
Will clients need to support customers' AI agents on their websites?
Not yet for most small businesses, but clients that sell online should start planning for customer agents that check stock, book appointments or change orders on someone's behalf. The practical work is familiar: clean APIs, clear permission scopes and logging that shows when an agent rather than a person acted. Track this standard and the competing ones before advising any client to build for a single protocol.
Read at Sierra ↗
Channel Insider · Oct 7
WatchGuard added a shadow AI dashboard and more AI agents to its MSP security platform
WatchGuard expanded its Rai agentic AI system with a natural-language interface, an incident analyst, a continuous compliance auditor and a customer success tool, plus an MCP integration that lets outside AI platforms use its security data. A new Network Shadow AI dashboard combines OAuth grants, email metadata, device telemetry and firewall data into one inventory of AI apps, with the ability to revoke access, at no extra licensing charge for Prime and Total Security Suite customers. WatchGuard cited its own report finding that only 22% of employees use MFA everywhere it is available.
▸ The MSP Angle
How do I find out which AI apps a client's employees are using?
Combine the sources you already have: OAuth consent grants in the identity platform, firewall and DNS logs, and browser or endpoint telemetry will show most AI apps in use. Turn that inventory into a short monthly report for the client with each app, who uses it, what data it can reach and a keep, approve or block decision. That report is the start of a governance service you can charge for.
Read at Channel Insider ↗
Channel Insider · Oct 6
Midmarket clients are not slowing AI down, and security is becoming the price of expanding it
Channel Insider pulled together recent surveys showing adoption running ahead of controls: Deloitte found 93% of North American CFOs use AI across several key functions and 59% call balancing fast deployment with risk their biggest governance challenge. An IANS Research survey of 113 CISOs found 66% have an AI policy but only 29% have run adversarial tests on their AI systems. Corsica Technologies' president said midmarket customers are piloting AI, measuring value and then choosing where to expand, with security at the center as more agents go live.
▸ The MSP Angle
How should an MSP start an AI conversation with a midmarket client?
Open with governance and security rather than a tool demo: ask which AI pilots are running, what data they touch and who approved them. Clients are already deciding where to expand, so offering a policy, an access review and basic testing of their AI tools puts you in the room for the next phase. From there, move to process conversations such as onboarding or support where an agent can show measurable value.
Read at Channel Insider ↗
EFN · Oct 6
Norway's largest bank DNB is cutting about 400 tech roles after rolling out AI agents
DNB said it will cut about 400 full-time positions in its Technology and Services unit, with the reductions completed in the fourth quarter of 2026. The bank said it has introduced agentic AI in customer data handling, know-your-customer work, technology development and programming. Chief executive Kjerstin Braathen said AI is changing how the bank works and delivers services, and that it is seeing significant efficiency gains.
▸ The MSP Angle
Which back-office jobs are AI agents actually taking over?
The pattern here is repeatable, rule-heavy work with clear checks: verifying customer data, compliance reviews and routine coding tasks. Those exist in small accounting, legal and financial firms too, so map a client's highest-volume checks and paperwork before pitching agents in general. Position the outcome as capacity the client can redeploy, since most small firms are trying to grow without hiring rather than cut staff.
Read at EFN ↗
HubSpot SEC filing · Oct 6
HubSpot is cutting about 660 jobs as it moves from selling software to selling AI outcomes
HubSpot told staff it will cut about 7% of its workforce, nearly 660 people, as it shifts from building software that helps customers grow to delivering outcomes for them with AI. Product teams will be organized around customer outcomes such as generating demand and winning deals rather than products and features, with fewer management layers. Chief executive Yamini Rangan wrote that the cuts are not driven by AI-related efficiencies.
▸ The MSP Angle
What does outcome-based selling mean for MSPs selling AI?
Software vendors are repackaging around results, so clients will increasingly compare your AI services on outcomes such as tickets resolved or hours returned rather than seats or tools. Pick one or two measurable outcomes per service, report them monthly and build pricing around them where you can. Expect vendor product lines and contacts to shift during reorganizations like this one, and check that the tools you resell still have a clear owner.
Read at HubSpot SEC filing ↗
Inside Global Tech · Oct 6
California will require large companies' support chatbots to admit they are bots and offer a human
California's AB 1609, among more than 20 AI bills Governor Newsom signed this session, bars large businesses from presenting a customer service chatbot as human and requires a clear AI disclosure where people could be misled. Covered businesses, those with more than $500 million in annual revenue, must offer a way to request a human and make a good faith effort to connect within 15 minutes or schedule a callback within one business day. The law takes effect January 1, 2027, with civil penalties of up to $5,000 per violation and $10,000 for repeat violations.
▸ The MSP Angle
Do small businesses have to disclose that their customer service chatbot is AI?
California's new handoff rule only covers companies above $500 million in revenue, but disclosure rules are spreading and clearly labeling a bot is cheap insurance for any client. When you build or manage a support agent, make it say it is AI, give customers an obvious way to reach a person and log every handoff. Clients that serve larger customers may also see these terms flow down into vendor contracts.
Read at Inside Global Tech ↗
VentureBeat · Oct 7