Daily AI brief · May 4, 2026
Power Apps Agent Feed Goes GA as GPT-5.5 & DeepSeek V4 Reshape the Stack
Microsoft ships its agent-oversight feed for Power Apps today, OpenAI's GPT-5.5 raises the cyber capability bar with new safeguards, DeepSeek V4 drops frontier-level open-weight performance at a fraction of closed-model prices, and AI-supercharged phishing hits SMBs harder than ever.
1. Microsoft Power Apps Agent Feed + MCP Server Goes GA Today *(Microsoft Power Platform Blog)*
Agent feed with Power Apps MCP Server reached general availability today, May 4, 2026, giving users a dedicated experience to supervise agent activity directly inside their business apps.
The feed lets you set approval thresholds:
it gives business users a dedicated space to see, review, and guide agent activity as it happens — makers control the approval threshold so low-risk actions complete quietly in the background while higher-impact actions like sending emails surface as explicit approvals.
What it means for SMBs / MSPs: If you're running Power Apps for any client workflow — intake forms, CRM updates, service tickets — you now have a production-ready way to put AI agents to work inside those apps with human checkpoints baked in, no custom dev required.
2. GPT-5.5 Hits the API with Tightened Cybersecurity Guardrails *(OpenAI)*
GPT-5.5 is OpenAI's smartest and most intuitive model yet — it understands what you're trying to do faster, excels at writing and debugging code, researching online, analyzing data, creating documents and spreadsheets, and operating software, moving across tools until a task is finished.
But the security story matters more for the SMB ecosystem:
UK AISI red-teamers identified a universal jailbreak that elicited violative content across all malicious cyber queries — and that attack took only six hours of expert red-teaming to develop.
OpenAI patched it, but the episode signals how fast offensive capability is accelerating at the frontier.
What it means for SMBs / MSPs: GPT-5.5's agentic coding and knowledge-work gains are real and worth exploring on your ChatGPT Business or Enterprise subscription today — but remind clients that stronger models mean more capable threats on the other side of the fence too.
3. DeepSeek V4 Ships Open-Weight at 1/6th the Cost of GPT-5.5 *(CNBC / Analytics Vidhya / Codersera)*
DeepSeek V4 shipped on April 24, 2026, with two variants — V4 Pro (1.6T total parameters, 49B active) and V4 Flash (284B total, 13B active) — both with a 1M token context window, MIT licensing, and pricing that lands V4 Pro at roughly 1/7th the cost of Claude Opus 4.7 and 1/6th the cost of GPT-5.5 on coding workloads.
On benchmarks,
V4 Pro posts scores on agentic benchmarks that sit alongside GPT-5.5 and Claude Opus 4.7 — and unlike those closed, proprietary models costing several dollars per million output tokens via API, DeepSeek V4 Pro is open-weight, self-hostable, and available via API at a fraction of that cost.
What it means for SMBs / MSPs: If you're building internal RAG tools, document-processing pipelines, or AI-assisted workflows and want to escape proprietary API lock-in, DeepSeek V4 is the most serious open-weight candidate yet — especially for data-sensitive environments where self-hosting matters.
4. AI-Supercharged Phishing Is Now an SMB-Tier Problem *(Microsoft Security Blog / ISACA / MSSP Alert)*
AI is reducing friction across the entire attack lifecycle — helping threat actors write better lures, research faster, and vibe-code malware — while also helping them localize content and adapt messaging to specific roles, producing phishing operations that are more resilient, more targeted, and significantly harder to defend at scale when combined with MFA-bypass infrastructure.
Cyber threats against SMBs rose sharply in 2025 — incidents nearly doubled compared to the previous year, with over one quarter of all American SMBs experiencing a cyberattack within the past 12 months.
What it means for SMBs / MSPs: Mailbox-level email security that detects nuanced impersonation is no longer optional for SMB clients. Legacy secure email gateways weren't built for AI-crafted lures — the upgrade conversation is overdue.
5. Microsoft's May Purview Drop Is the Biggest Compliance Update of the Year *(Level Up M365)*
May brings one of the most security-heavy roadmap drops of the year, with Microsoft Purview delivering major advances across DSPM, Insider Risk, DLP, and Data Security Investigations.
Key additions include
a new Data Security Posture Management experience with unified visibility, AI observability, posture reporting, and Security Copilot agents — including third-party signals from BigID, Cyera, OneTrust, and Varonis.
What it means for SMBs / MSPs: If you manage M365 compliance for clients in healthcare, legal, or finance, this month's Purview updates are worth a proactive review call — especially the new AI observability layer, which surfaces what Copilot is actually touching.
Power Apps Agent Feed (GA today)
The agent feed in model-driven apps is generally available in May 2026 — it gives business users a dedicated space to see, review, and guide agent activity as it happens and within the app, not in a separate monitoring tool.
- Who it's for: MSP techs and AI champions who already have Power Apps model-driven apps deployed for clients (Dynamics 365, custom CRM/service apps built on Dataverse).
- How long a first test takes: 60–90 minutes to wire a Copilot Studio agent to the Power Apps MCP Server on a sandbox environment and watch it pop tasks into the feed.
- First step: In your Power Apps environment, open an existing Copilot Studio agent → select Add tool → search for Power Apps MCP Server → configure and publish. Then add the agent to your model-driven app and trigger a test task. Review the approval queue in the agent feed.
Spend five minutes with your team on how AI is making phishing emails harder to spot. AI helps attackers write better lures and tailor them to specific roles, and incidents against SMBs nearly doubled in 2025. Remind people to verify any unusual request for money or logins by phone. Then ask your IT provider whether your email security was built for AI-crafted lures.
*For MSPs:* The Power Apps Agent Feed, where agents wait for human approval before high-impact actions, suits risk-averse operations clients.
Don't treat DeepSeek V4's MIT license as a compliance free pass.
For enterprises with data privacy requirements, self-hosting V4 Pro is a strong option that closed models can't match — but for anything needing guaranteed content filtering, detailed compliance documentation, and SOC 2 certification on the model provider side, the closed frontier models still have structural advantages.
Dropping DeepSeek into a client environment without a data-residency and compliance review is a liability, not a cost saving.
Agent identity is becoming the new endpoint security problem.
The most significant technological shift in 2026 is the emergence of agentic AI — systems that take autonomous actions across enterprise environments via API chains and identity propagation — with approximately 60% of organizations now transitioned to AI-augmented automation, creating significant new risks from "Shadow Agents" that operate outside of security visibility and create potential exfiltration paths.
Every AI agent you deploy — in Power Automate, Copilot Studio, or a third-party platform — is a non-human identity with permissions. The MSPs and IT champions who get ahead of agent identity governance (who authorized it, what can it touch, what does it log?) will be in a far better position when the first agentic breach at an SMB makes headlines. Start asking your RMM and SIEM vendors whether they can baseline *agent* behavior, not just user behavior.