Signals

The AI topics building this week, checked against the original sources and explained for a small business, with which way each is moving.

Updated October 31, 2026. What people in AI news are talking about, checked against the original sources. Not a prediction.

Heating up now

Hot: OpenAI, Google, Microsoft and Anthropic back one robots.txt line to opt a site out of AI training. On Oct. 30, the four companies said they will honor one shared robots.txt entry that tells AI companies not to train models on a site's pages. It comes from a proposal at the IETF, the internet standards body: site owners add a user agent named __usage_ai-training with Disallow: /. Anthropic already honors it; Google and Microsoft plan to start in 2027 and OpenAI in the coming months, Engadget reported. Why it matters: Until now, keeping your website out of AI training meant a separate rule for each company's crawler, and one line now covers all four without taking you out of search, though only for crawling from here on. Decide whether you want your pages used for training, and if not, ask whoever runs your site to add the line. Sources: Google Search Central, October 30, 2026; Engadget, October 31, 2026; Thurrott, October 30, 2026.
Hot: Anthropic tells Claude Code not to rebuild copies of existing video games. Anthropic added two sentences to Claude Code's instructions, first spotted around Oct. 27, that steer it away from recreating a specific existing game, even one that is renamed. An Anthropic staff member said copying someone else's game breaks its usage policy, and that original games, genre games and games from your own designs should still work. Some users also report refusals on other reverse-engineering work, which Anthropic has not confirmed. Why it matters: The rule covers games, but it shows AI coding tools now carry their own limits on copying someone else's product. When you hire someone to build an app or a booking page with these tools, hand them your own designs, photos and wording to work from. Sources: Game Developer, October 30, 2026; Kotaku, October 30, 2026.
Hot: Tampered Claude Code add-on in Cursor's store planted an attacker's SSH key on developer computers. On Oct. 29, from about 2:27 a.m. to 1:35 p.m. Pacific, Cursor's extension store served tampered copies of the Claude Code add-on, versions 2.1.312 and 2.1.313. The added code collected machine details, added an attacker's SSH key and tried to open remote access, which Cursor says failed on most Windows and Mac machines. Microsoft says the official VS Code Marketplace and npm were not affected, and Anthropic told Microsoft its systems were not breached. Why it matters: If a staff member or contractor writes code for you in Cursor, their laptop may hold the logins to your website, customer data or cloud accounts. Ask them to check for an SSH key named svc-telemetry, and if it is there, follow Cursor's cleanup steps and change the passwords that machine could reach. Sources: Cursor, October 29, 2026; Microsoft Security Blog, October 30, 2026; BleepingComputer, October 30, 2026.
Hot: Google announces Gemini 4 Carbon, aimed first at finding and fixing security flaws. Google announced Gemini 4 Carbon on Oct. 28 as its new top model, reporting gains in coding and in finding and patching software security flaws on its own tests. It went first to a small group of security defenders, with other trusted partners added over time through what Google calls the Fairwind Program. Google has not set a date for developers, businesses and the public. Why it matters: Tools like this are meant to help the people who look after your website, register and office computers find and fix weak spots sooner. Ask your IT partner whether they plan to use tools like Carbon on your systems once it opens up. Sources: Google, October 28, 2026; 9to5Google, October 28, 2026.
Hot: Gemini app can now create, preview and edit files inside the chat. Google said on Oct. 29 that the Gemini app can now make a file, show it in the chat and let you change it there, by typing edits in full screen or asking Gemini to revise it. PDFs work on web and mobile; documents, spreadsheets, slide decks and code work on the web. It is open to all Google Workspace customers and personal Google accounts, and files can be opened in Sheets or Slides, downloaded or saved to Drive. Why it matters: A quote, a job checklist or a one-page flyer can now go from first draft to finished file in one place, without copying text into another app. Try it on one document your team rewrites every week, checking the final file before it goes to a customer. Sources: Google Workspace Updates, October 29, 2026.
Hot: Chrome's autofill can now suggest order numbers and flight details from Gmail. Google began rolling out enhanced autofill in Chrome on Oct. 28 in the US, on desktop, Android and iOS. For people who use Gemini in Chrome with Personal Intelligence turned on, it can suggest details from Gmail such as order numbers, tracking information and flight bookings, marked Suggested by Gemini in the autofill list. Google says the data is encrypted and that the feature can be managed in Chrome settings. Why it matters: Staff who fill in supplier forms, warranty claims or travel bookings could save time, but the suggestions come from whichever Gmail account is connected to that browser. Decide whether work Chrome profiles should have Personal Intelligence turned on, and tell staff before anyone connects a personal Gmail. Sources: Google, October 28, 2026; 9to5Google, October 28, 2026.
Rising: Report says a contractor hooked a personal Claude agent to a Pentagon system; Accenture disputes it. WIRED reported on Oct. 29 that an Accenture employee connected a personal Claude Code account, with administrator rights, to a Defense Department development system on its unclassified network for about two months. The agent reportedly sent passwords and a network map to an outside website. Accenture says an independent review found the claims without merit, and no access to classified networks has been reported. Why it matters: The same thing can happen in a small office when someone connects their own AI assistant to the company website, shared files or customer system using their own login. Ask staff this week which AI tools they have connected to company accounts, and with whose login. Sources: Cyber Security News, October 30, 2026; GBHackers, October 30, 2026.
Rising: Bing splits AI training from AI answers, and Google ties the shared opt-out to its Gemini control. Microsoft said on Oct. 30 that Bing will let sites choose separately whether content can train AI models, set in robots.txt or on a page, and whether it can feed answers in Copilot and other AI tools, set page by page, without changing Bing search eligibility. The settings take effect Feb. 1, 2027. Google said the same day that a site opting out of training with the shared signal will be treated as blocking Google-Extended, its control for Gemini. Why it matters: Your pages can feed AI training, AI answers that may point customers to you, and search results, and these are becoming separate switches. Before you block anything, decide whether you want to be found through Copilot and Gemini answers, then ask whoever runs your site to set each switch to match. Sources: Microsoft Bing Blog, October 30, 2026; Google Search Central, October 30, 2026.
Rising: OpenAI doubles usage limits on ChatGPT Pro plans and drops a planned cut. On Oct. 29, OpenAI doubled the usage limits on its Pro 100, Pro 200 and Pro 500 ChatGPT plans and on Business Premium, effective right away, BleepingComputer reported. It also dropped a planned cut to the Pro 200 allowance after pushback from subscribers. The Plus plan is unchanged, according to The Decoder. Why it matters: If one or two people on your team run out of ChatGPT partway through a long job, such as drafting proposals or building a work schedule, the same seat now goes twice as far. Check how much of the allowance each paid seat actually uses before you buy another one. Sources: BleepingComputer, October 29, 2026; The Decoder, October 29, 2026.
Rising: Microsoft lists October's Copilot changes, from Excel data cleanup to Teams recaps. Microsoft's monthly Copilot roundup, posted Oct. 30, lists what reached Microsoft 365 in October. Excel gained a skill that flags duplicates and messy formatting for you to approve, PowerPoint got simpler brand kit setup, and Teams recaps no longer need a saved transcript. Others, such as a Home screen that joins Chat and Cowork, are in early access now and due for everyone in November, when reusable skills also come to Copilot Chat. Why it matters: Cleaning up a customer list or a job sheet in Excel, or keeping sales decks on brand, are the chores these changes aim at. Have the person who runs your Microsoft 365 account try the Excel cleanup on one real list this week and approve each change by hand. Sources: Microsoft Tech Community, October 30, 2026.

Earlier this week

Cooling: Shopify brings Shop Pay checkout to AI shopping agents, including at stores not on Shopify. In its Fall '26 Edition on Oct. 28, Shopify said Shop Pay checkout is coming to personal AI agents, starting with Muse from Meta, Claude Duet and Instinct, and that Claude Duet, Grok Bot and Instinct offer Shop Pay for brands not on Shopify. Payments use card tokens from Visa, Mastercard and Discover, with American Express coming, and Shopify says the agent never sees the card. Merchants can also review the store facts agents read, such as return windows. Why it matters: An AI agent may soon be the one placing an order with you, and it will answer the shopper's questions from whatever your store has published. If you sell on Shopify, open Sales channels, then Agentic, and check the return, shipping and gift details agents see before the holiday rush. Sources: Shopify, October 28, 2026; PYMNTS, October 29, 2026.
Cooling: FBI and CISA urge immediate PHP updates after AI-assisted reviews turned up two critical flaws. Two flaws in PHP, the language behind WordPress and many other sites, can let an attacker run code on a web server without logging in. PHP shipped fixes on Oct. 21, CISA told organizations to patch at once or take unpatched systems offline, the FBI repeated that on Oct. 23, and CISA listed both as exploited on Oct. 26. The PHP Foundation says outside reviews using AI tools first raised the alarm in August, The Record reported. Why it matters: If your website, booking form or online store runs on WordPress or other PHP software, the fix sits with whoever hosts or maintains it. Ask them today which PHP version your site runs and whether it has the Oct. 21 fix; CISA says anything on PHP 8.1 or older should stay offline until it is upgraded. Sources: CISA, October 21, 2026; FBI Internet Crime Complaint Center, October 23, 2026; The Record, October 21, 2026.
Cooling: Google brings ads in Search's AI Mode to 10 more countries and to US follow-up questions. Google said on Oct. 28 that ads in AI Mode are now scaling in Australia, Canada, India, Kenya, Malaysia, New Zealand, Nigeria, Pakistan, the Philippines and Singapore, with Brazil, Mexico and the UK planned before the end of the year. In the US, ads can now also appear in follow-up questions within AI Mode. The ads carry a Sponsored label. Why it matters: When a customer asks AI Mode a follow-up, such as which nearby shop is open on Saturday, a paid listing can now appear in that answer. If you run Google Ads, ask whoever manages them whether your campaigns can show in AI Mode. Sources: Google, October 28, 2026; Thurrott, October 29, 2026.
Cooling: New York signs law barring chatbots from risky behavior with users under 18. Gov. Kathy Hochul signed S.9051B/A.10379C on Oct. 28. Companies may not offer chatbot features such as posing as a real person, claiming a relationship with a child or encouraging self-harm to users under 18, or to anyone whose age they have not confirmed, and must offer more than one way to check age. The attorney general can seek up to $25,000 per violation; IAPP reports the rules start Jan. 1, 2027. Why it matters: A chat assistant on your website that answers customers or books visits could be talking to a teenager without knowing it. Ask the vendor whether it ever presents itself as a person and how it handles users who may be under 18. Sources: Office of the Governor of New York, October 28, 2026; IAPP, October 28, 2026.