Daily AI brief · May 10, 2026
ChatGPT Lands Inside Excel & Sheets, Agent 365 Goes GA
OpenAI ships ChatGPT natively into Excel and Google Sheets, Microsoft officially launches Agent 365 and M365 E7, a critical SharePoint zero-day is being actively exploited, and AI is compressing the vulnerability-to-exploit window to hours — here's what it means for your stack this week.
1. ChatGPT Is Now a Native Sidebar in Excel and Google Sheets — OpenAI
As of May 5, 2026, ChatGPT for Excel and Google Sheets reached general availability across all plans, powered by GPT-5.5.
It lives as a spreadsheet-native sidebar and can help you build, update, and explain spreadsheets directly — including large, multi-tab files with formulas, references, and assumptions.
Business, Enterprise, Edu, and K-12 customers have a free preview through June 2, 2026.
What it means for SMBs / MSPs: This is the fastest zero-friction AI win you can hand a client this week — install it from the add-ins menu and let a non-technical user describe a budget tracker or clean messy data, no prompt engineering required.
2. Microsoft Agent 365 Goes GA — and E7 Is Now Orderable — Microsoft
On May 1, 2026, Microsoft made Agent 365 generally available as a control plane for observing, governing, and securing AI agents across enterprise environments.
Despite the name, Agent 365 does not build or run AI agents — it is a governance and security layer, described as "the control plane, not the engine," extending Entra, Purview, and Defender to cover AI agents alongside human users.
Organizations can add Agent 365 governance to existing E3/E5 licenses for $15 per user, or move to the new M365 E7 bundle ($99/user/month) that packages Copilot, Entra Suite, and full Defender and Purview protection.
What it means for SMBs / MSPs:
The 50% promotional offer on Microsoft Purview Suite for Business Premium runs through July 1, 2026, and complements existing Copilot Business bundle offers for customers with under 300 licenses
— this is a limited window to package governance and compliance into client conversations before prices normalize.
3. Critical SharePoint Zero-Day Under Active Exploitation — eSecurity Planet / CISA
Microsoft SharePoint administrators are urged to patch immediately following the discovery of a zero-day flaw (CVE-2026-32201) affecting over 1,300 servers. The vulnerability allows remote code execution and is actively being exploited. Organizations should prioritize patching and restrict internet exposure.
What it means for SMBs / MSPs: If any of your clients run on-prem or hybrid SharePoint, this is a "drop everything" patch job — check exposure before Monday.
4. Anthropic's Mythos Raises the Cyber Threat Floor for Everyone — CNBC / IMF
Global banks, tech giants, and governments scrambled to contain risks posed by Anthropic's Mythos model, said to have found thousands of previously unknown software vulnerabilities. Cybersecurity experts told CNBC that the vulnerability-finding capability is already present in existing, widely available models.
Mandiant's M-Trends 2026 report found that time-to-exploit has gone effectively negative — exploits now routinely arrive before patches, with 28.3% of CVEs exploited within 24 hours of disclosure.
What it means for SMBs / MSPs: The patch-in-a-few-weeks mindset is over.
The organizations most exposed are those with the longest patch cycles, the most legacy infrastructure, and the fewest security staff — and that description covers most of the SMB market.
5. GPT-5.5 Instant Becomes ChatGPT's Default Model with Deep Personalization — OpenAI / TechCrunch
GPT-5.5 Instant is rolling out to all ChatGPT users, replacing GPT-5.3 Instant as the default model and in the API as `chat-latest`.
GPT-5.5 Instant can use its search tool to refer back to past conversations, files, and Gmail to give more personalized answers — available to Plus and Pro users on the web with mobile coming soon.
Enhanced personalization is rolling out to Plus and Pro users on the web, with plans to expand to Free, Go, Business, and Enterprise in the coming weeks.
What it means for SMBs / MSPs: Clients using ChatGPT Business are about to get a noticeably smarter default — but so are their employees on personal free accounts. Now is the right time to set usage policies before organizational data bleeds into personal contexts.
ChatGPT for Excel / Google Sheets (OpenAI)
ChatGPT for Excel and Google Sheets is a spreadsheet-native AI experience that lives in a sidebar inside your spreadsheet.
It's for any SMB owner, ops manager, or MSP technician who lives in spreadsheets and has wished their formulas could explain themselves.
- Who it's for: Non-technical business users, ops staff, and MSPs who build client-facing reporting templates
- How long a first test takes: 15 minutes
- One concrete first step:
In Excel: go to Home → Add-ins, search "ChatGPT," add it, then open from the ribbon and sign in. In Google Sheets: go to Extensions → Add-ons → Get Add-ons, search "ChatGPT," install and sign in.
Start by opening an existing messy spreadsheet and typing: *"Explain what this sheet does and flag any formula errors."*
If you run SharePoint on your own servers, ask your IT provider today whether the zero-day patch is installed. A critical SharePoint flaw, CVE-2026-32201, affects over 1,300 servers, allows remote code execution and is being actively exploited. Patching and limiting internet exposure are the fixes. If you only use SharePoint Online, confirm that too so you know.
*For MSPs:* Leading with Agent 365 plus Purview, so clients can see and control AI before turning it on, addresses the governance concern behind stalled Copilot rollouts.
Don't assume the ChatGPT Excel add-in is safe to use on any workbook from day one.
Because ChatGPT can edit workbooks, unclear prompts may accidentally change or delete data. Users should be specific about what they want changed and double-check the updates.
Roll it out on non-critical files first, scope every prompt to the exact tab being edited, and require a change summary before accepting edits. A sloppy first deployment on a financial model will erode trust faster than any feature demo can rebuild it.
AI is collapsing the gap between "vulnerability found" and "vulnerability weaponized" — and SMBs are the most exposed end of that curve.
In late April 2026, CERT-In issued a high-severity advisory addressing the exponential rise of AI-driven cyber threats, noting that advanced AI systems can now independently analyze source code, identify zero-day vulnerabilities, and generate functional exploit code — reducing the traditional exploitation window from weeks to mere hours.
The implication isn't just "patch faster." It's that the entire security operating model for lean IT teams needs to shift from reactive patching to continuous posture management.
Agentic AI systems are becoming the new SOC analysts — automating Tier 1 alert triage, executing predefined prevention operations, and detecting behavioral anomalies at scale.
MSPs who can offer AI-assisted MDR — not just alert forwarding — will be the ones clients call when something breaks at 2 a.m.