01Goldman Sachs is putting $500 million into teaching small businesses to use AI
What happenedOn October 23, Goldman Sachs launched a Small Business AI Institute and committed $500 million to the next chapter of its 10,000 Small Businesses program. Anthropic will build an applied-AI learning series and run hands-on workshops, Google will offer its AI Professional certificate to almost 20,000 owners and employees, Meta will provide tools and training, and OpenAI will run workshops through the program's community college partners. A Babson College survey of program graduates, conducted in August, found that 86 percent now use AI, up from 56 percent in 2024, but only 15 percent said it's fully integrated into their core operations. Seventy-seven percent said they'd benefit from more training. Goldman CEO David Solomon put it this way: "There's very little that we do where we need frontier models."
Our takeLook at where this money goes: workshops, certificates, and hands-on training. The survey shows why. Nearly everyone in the program is already using AI, and only about one in seven has built it into how the business actually runs. Keep in mind it's a survey of program graduates, who are more engaged than most owners. We think the lesson holds anyway. Access to AI stopped being the hard part a while ago, and the businesses pulling ahead are the ones investing in their people's skills.
02An employee uploaded data on 334,000 people to an AI tool their company had banned
What happenedPanasonic Operational Excellence, part of the Panasonic group in Japan, disclosed on October 23 that a member of an HR systems project team uploaded personal data on about 334,000 people to an outside generative AI service the company had prohibited. The data covered roughly 75,000 current employees, 178,000 former employees, and 81,000 family members, and included employee numbers, addresses, phone numbers, and email addresses. The company reported it to Japan's privacy regulator on September 29. According to the provider, the data wasn't used to train its AI and was deleted after a 30-day retention period that ended October 25. No misuse had been confirmed as of the announcement.
Our takeThis is the risk people mean when they talk about "shadow AI," and it happened at a company that had a rule against it. A ban on its own tends to push AI use out of sight. What actually protects a business is giving people an approved tool on a company account, being specific about what kind of information can go into it, and training them on the difference. If your team has no approved option, assume they're already using a personal one.
03Big banks say outside AI agents are showing up in customer accounts
What happenedAxios reported on October 22, citing unnamed sources, that Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo have found unauthorized third-party AI agents operating inside customer accounts, some of them taking actions without a user's instruction. The banks are reportedly rewriting their terms of service to limit agents to read-only access or block them from logging in. The same day, 1Password launched 1Password for Agents, which lets an AI agent request a login that a person approves, so the agent never sees the password.
Our takeIf you've connected an AI tool to your business bank account, bookkeeping, or payment systems, now is a good time to check two things: what that tool is allowed to do, and what your bank's terms say about it. We'd start every agent with read-only access to anything involving money and widen it only after someone has watched how it behaves. The 1Password approach points in a sensible direction, where a person approves each login and the agent never holds the keys.
04A fake Claude Code add-on sat in an AI coding marketplace for about 11 hours
What happenedOn October 29, Cursor, a popular AI coding tool, disclosed that malicious versions of Anthropic's Claude Code extension were available in its extension marketplace from about 2:27 a.m. to 1:35 p.m. Pacific time. The fake versions, which Anthropic didn't build, collected information about the computer they were installed on and tried to open a hidden remote connection for the attacker. Cursor removed them, temporarily shut down and rebuilt the marketplace, rotated its keys, and published cleanup steps. It says the attacker's server is now offline.
Our takeMost small businesses don't run coding tools, but almost every business now installs add-ons, plug-ins, and connectors for its AI tools. Those add-ons are becoming a target because they get access to the computers and accounts they're installed on. We'd make one person responsible for approving new add-ons, the same way someone approves new software. And if anyone at your company uses Cursor, have them follow Cursor's cleanup steps today.
05Employees are building their own AI apps faster than companies can keep up
What happenedA new survey from Pave by Quickbase, released October 28, asked 527 business leaders and 5,177 U.S. employees about apps employees build themselves with AI. Thirty-eight percent of employees said they'd built an AI app or working prototype in the past year, and 84 percent of those apps target work that used to run on spreadsheets, email, chat, or paper. Fifty-three percent of organizations found at least one employee-built app that IT and leadership didn't know existed. Fifty-seven percent of leaders require a security review, but only 32 percent of builders have someone who can help with one, and just 14 percent have someone assigned to maintain their app.
Our takeIt's a vendor's survey, so we'd hold the exact numbers loosely, but the pattern matches what we see. Your people want to fix the clunky parts of their own jobs, and AI finally lets them. That's good news to build on. The work for the business is knowing what's been built, deciding which tools are worth keeping, and naming who maintains them when the person who built them goes on vacation or moves on.
06Pennsylvania now requires labels on AI-generated ads that could mislead
What happenedPennsylvania Governor Josh Shapiro has signed the Artificial Intelligence Deceptive Advertising Act, which takes effect December 21. It requires a clear label stating that an ad contains content "modified or generated using artificial intelligence" when AI-generated or significantly altered images, video, or audio create a false impression about a product or service. The label has to appear the first time the content is shown. Obvious fiction, parody, satire, commentary, and text-only content are exempt. Only the state attorney general and district attorneys can enforce it, with fines of up to $3,000.
Our takeThis one matters for any business that uses AI to make ad images or video, especially before-and-after photos, product shots, or anything that shows what a customer will actually get. If your ads reach Pennsylvania, review your AI-generated visuals before December 21. We aren't lawyers, and the details are worth a quick conversation with yours. The simplest habit is to label AI-made visuals in your ads by default, which also tends to earn trust with customers.
