Week of October 26 2026

A robot tried to walk into more than 2,250 businesses in one week — and it didn't pick a single lock. It used a master key a backup company had been holding for years, the kind your IT guy set up and everybody forgot about. Same week, Goldman Sachs and the four big AI companies put half a billion dollars behind free AI school for small shops, and the Fed found the shops already using AI are more likely to hire. Robots coming at you, robots being handed to you — same question for both: who's holding the keys?

In this episode:

• A robot broke into the IT guy's backup tool. ConnectWise's cloud backup — used by more than 100,000 IT shops, by its own count — had a key into every customer's email that ever trusted it. Microsoft says a China-tied group pointed an AI agent at it and had admin access to some companies in under three hours. Your shop did nothing wrong. Your vendor's vendor left a door open. You can outsource the work; you can't outsource the ownership.
• Free AI school for small shops. Goldman Sachs' 10,000 Small Businesses program is launching a Small Business AI Institute with Anthropic, Google, Meta and OpenAI. Its own grads: more than eight in ten use AI now, and three in four spend under $100 a month. Goldman's CEO: "There's very little that we do where we need frontier models." The problem isn't the tool — it's that nobody's taught Patty.
• The shops using the robot plan to hire. The New York Fed split 5,000+ small employers into AI users and non-users. The AI shops were about ten points more likely to expect to add people — even though only about three in ten have seen more sales from it yet. The robot isn't the revenue. The robot is the hours.
• Spotlight — Google Ads Asset Studio vs. Meta's photo-to-video ads: two free robots that want to make your fall tune-up video. One writes the story from your website and photos (Google — free inside Google Ads, built for YouTube in your zip code). The other moves what you already have (Meta — a toggle on your image ads in Ads Manager). Which for which shop, and why a stale website makes a bad ad either way.
• The Operator's Move (tool-free): "Ask your IT person what has the master key." One phone call, one page: every outside company with admin access to your email, files and bank feed — and when anyone last actually restored a file.

🔗 Show Notes & Sources

Story 1 — The ConnectWise backup key

• Dark Reading — "Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack"
• CSO Online — "China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants"
• Help Net Security — "ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access"
• BleepingComputer — "Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack"

Story 2 — Goldman Sachs Small Business AI Institute

• Fortune — David Solomon on why small businesses don't need frontier models
• The Next Web — "Goldman Sachs puts $500M into small-business AI with four AI labs"
• Axios — "How small businesses are really using AI around the country"

Story 3 — AI shops expect to hire

• New York Fed, Liberty Street Economics — "AI Adoption and Employment Expectations: Evidence from a Survey of Small Business Owners"

Spotlight — Google Ads Asset Studio vs. Meta Advantage+ video

• Google — "Create On-Brand Video Ads with Gemini Omni (Creative Drop #1)"
• PPC Land — "Google Ads Asset Studio beta now available to advertisers worldwide"
• TechJuice — Meta's new AI advertising tools at Advertising Week 2026