Daily AI brief · November 4, 2026
Stolen AI Keys Ran Up $100,000 a Day in Bills
Google found criminals using stolen cloud logins to run AI on the victim's bill, past $100,000 in a day. Also: ChatGPT ads earn shops far less than Google ads, Shopify's agent shoppers, and Wix Studio Two.
Stolen cloud logins are running up AI bills of $100,000 a day (Google Threat Intelligence Group and Mandiant, via Help Net Security) Google's threat researchers say criminals who break into company cloud accounts are using that access to run AI models on the victim's bill, in some cases more than $100,000 in charges in a single day, and up to $1 million before the break-in was caught. The way in was usually a stolen cloud login or key, sometimes one left in a public code repository, and in several cases the AI service had been switched off until the attackers turned it on. The stolen access gets resold, with one service offering "unlimited" AI for about $60 a month. If a developer, a website plugin or a chatbot vendor ever set up an AI key for your business, the bill lands on your card, so know where every key is, who holds it, and what the spending cap is.
A visit from a ChatGPT ad earned shops $0.89, against $2.45 from a Google ad (Frankfurt School of Finance & Management and WU Vienna, via Tech Xplore) A new working paper from two marketing professors compared paid ChatGPT ads with Google search ads for online shops. A visit from a ChatGPT ad brought in 89 cents on average, about 64% less than a Google ad visit, and 82% of the 102 advertisers with full revenue data recorded no purchase at all from their ChatGPT ads. ChatGPT's unpaid recommendations did better than its paid ones. The practical part: if a vendor pitches ChatGPT ads to you this month, treat it as a small test with a stop date and a number to beat, and keep the Google budget where it is until your own results say otherwise.
Shopify calls shoppers who let AI buy for them the "newest front door" (Shopify, The Canadian Press) On Monday's earnings call, Shopify's president said this was the first quarter it saw shoppers start letting AI agents complete purchases for them, and called it the newest front door into commerce, with small volume that is growing. Revenue was up 32% for the quarter. This builds on the fall update we covered Monday, which put Shopify stores inside ChatGPT and Gemini. If you sell on Shopify, the agent decides from what you've written down, so spend an hour this week on the basics it reads: clear product titles, sizes, stock levels, shipping times and the return policy.
Wix's new Studio Two editor lets a site leave Wix as code (Wix) Wix launched Studio Two on Monday, an AI-powered editor for agencies and designers. Sites can stay on Wix's hosting or be moved outside Wix entirely, and a project can be exported as code, worked on in tools like Claude or Cursor, and brought back for visual editing. Outside AI agents can also manage Wix tools like Stores and Bookings. It goes to Wix's agency partners first, then everyone else over time, and existing Wix Studio sites stay supported. Whoever handles your website should know this: if an agency built your site on Wix, ask them one question this week, which is who holds the account and whether you could take the site with you.
Have it explain things like you're new (Starter · 3 minutes)
Today's stories are full of words like "API key," "agentic checkout" and "React export," and the pitches that follow will be too. When a vendor proposal, an insurance clause or an IT quote lands on your desk, paste it in and ask for the day-one version. You'll understand it in a minute, and you'll walk into the call with a real question.
> Explain this in plain English, like I'm a smart new hire on my first day: [paste]. Then tell me the one question I should ask the person who sent it.
Works the same in ChatGPT and Copilot.
What good looks like: a short explanation with no jargon, and a question that makes you sound like you know the topic. Avoid: stopping at the explanation. The question back to the vendor is where you save money.
Find every AI key the business pays for. Fifteen minutes with whoever handles your website and software. Make one list: each AI account or key (OpenAI, Claude, Google Cloud, a chatbot on the website, an automation tool), who set it up, which card pays for it, and when it was last used. Delete the ones nobody can explain. On the ones you keep, turn on two-step sign-in and set a monthly spending cap or a billing alert; the Claude Console, for one, lets you cap spending for each workspace. A cap you'll never hit costs nothing, and it turns a $100,000 surprise into a phone call.
The page that asks for a token: Google's researchers describe one group that ran a fake sign-up page for an AI users' group and got visitors to paste in text that held a live login token, which let the attackers skip the password and the two-step code. Tell whoever touches your website or software: no real page ever needs you to paste a key, a token or a code into it to join something. Close it and ask first.
Got a question about AI in your own business? Hit reply, and John may answer it in a future brief.
Where it's going: AI is turning into something businesses pay for by the minute, through keys and agents that act on their own, so the owners who know where every key is and what it's allowed to spend will get the help without the bill shock.
- Stolen cloud logins and AI bills: [Help Net Security, Nov 3](https://www.helpnetsecurity.com/2026/11/03/llmjacking-stolen-ai-access-cloud-bills/) · [GBHackers, Nov 3](https://gbhackers.com/google-warns-of-llmjacking-attacks/) · [Claude Help Center: workspace spend limits](https://support.claude.com/en/articles/9796807-claude-enterprise-plan-usage-and-credit-limits)
- ChatGPT ads vs Google ads: [Tech Xplore, Nov 3](https://techxplore.com/news/2026-11-chatgpt-advertising-money-google-ads.html)- Shopify and AI shoppers: [Shopify Q3 2026 results (SEC filing), Nov 3](https://www.sec.gov/Archives/edgar/data/0001594805/000159480526000067/exhibit991pressreleaseq320.htm) · [The Canadian Press via Castanet, Nov 3](https://www.castanet.net/news/Canada/636569/Shopify-says-shoppers-delegating-purchases-to-AI-is-newest-front-door-into-commerce-) · [The Motley Fool transcript, Nov 3](https://www.fool.com/earnings/call-transcripts/2026/11/03/shopify-shop-q3-2026-earnings-call-transcript/)
- Wix Studio Two: [Wix via GlobeNewswire, Nov 2](https://www.globenewswire.com/news-release/2026/11/02/3393216/0/en/wix-introduces-studio-two-a-truly-open-ai-native-visual-editor-for-professional-web-creation.html) · [Shopifreaks, Nov 2](https://www.shopifreaks.com/wix-launches-studio-two-an-ai-editor-for-agencies-that-exports-sites-as-react-code-to-continue-in-claude-cursor-or-any-ide/)