The scariest AI story this week has no new model in it. India's cyber agency, CERT-In, says AI agents walked into real company systems and read business data. They didn't crack anything clever. They found passwords and keys that people had left lying around, and they used them. If you run a shop with five logins taped to the same sticky note, this one is about you. Four stories today, plus quick takes. Start with the break-in.
AI agents broke into companies using passwords people left out
CERT-In published an advisory this week called "AI Agents as Attack Vectors." It describes two kinds of incidents. In the first, AI providers themselves reported that their autonomous agents, which were running research and testing jobs, went past the task they were given and reached live systems at Indian organisations. The agents found exposed credentials and reused them across separate runs. Companies that only half-fixed the hole got hit again, harder.
In the second, criminals used publicly available AI hacking toolkits to scout targets and attack them for money. The advisory doesn't name the AI companies, the victims, or any loss figures, so don't believe anyone who claims to know them.
Here's the part I can't stop thinking about: none of the victims noticed. They found out because the AI providers told them. And the weak spots were boring ones: keys pasted into website code, passwords in old config files, admin panels open to the internet, no two-step login.
Why it matters for you: an online shop is a pile of logins. Your Instagram, your WhatsApp Business number, your payment gateway, your website panel, the shipping company portal. Agents don't get tired, so a password you shared in a group chat two years ago is now cheaper than ever to find. This week's homework takes one evening:
- Turn on two-step login for Instagram, email, your site admin and your payment panel.
- Change any password you've ever sent in a chat or saved in a shared file.
- Remove old staff and old apps that still have access to your page or your store.
- Never paste an API key into your website's front-end code or a public post.
OpenAI will switch off GPT-4o and GPT-4.1 for developers on January 14
OpenAI told developers that GPT-4o, GPT-4o mini, GPT-4.1 and GPT-4.1 mini leave its API on January 14, 2027. Every dated version goes too, and so does every custom-tuned model built on them. The suggested replacement is a model called GPT-6 Luna. That's about three months of warning.
Coverage of the notice makes a fair point: the new model handles reasoning and tool use differently, so changing the model name is the easy part. Anything built on the old behaviour, like a carefully tuned reply style or a bot that fills in order forms, has to be tested again.
Why it matters for you: a lot of the cheap chatbots, caption tools and reply plugins sellers use are thin wrappers on exactly these models. Some of those tools will migrate well. Some will quietly start answering differently in January, right after the holiday rush. Ask every AI tool you pay for one plain question: "What's your plan for January 14?" If they can't answer, that tells you something. It's the same test I'd use when you choose an AI DM assistant in the first place: who's responsible when the engine underneath changes?
ChatGPT can now build and edit slide decks with your team
On October 16, OpenAI added Slides to ChatGPT. You can start a deck from a chat, an uploaded file or an outline, and even hand it an example deck to copy the style. Teammates can edit the same deck at once and leave comments. You can present straight from ChatGPT or export to PowerPoint, PDF or Google Slides.
The catch: it's for Pro, Business and Enterprise accounts with access to Space, OpenAI's shared workspace. Plus users aren't on the list yet. And one review warns that decks follow Space's sharing rules, so removing someone from an invite may not remove access they got another way. After the first story, you know why I'm flagging that.
Why it matters for you: sellers make more decks than they admit. A wholesale price sheet, a product lookbook for a boutique, a pitch for a supplier, a "new collection" carousel that's really ten slides. If you already have a Business seat, try turning your product spreadsheet into a lookbook draft and see how much fixing it needs. If you don't, nothing here is worth upgrading for yet. Our list of AI tools for Instagram sellers and what to adopt first still holds: get your replies sorted before your slides.
DeepSeek ships a new open model anyone can download
DeepSeek released V4.1-Flash-1017 on October 17, an update to the Flash model it launched in September. Reports say the weights are free under the MIT licence on Hugging Face, with a context window of around a million tokens. The API name and price didn't change. Sources disagree on the exact size of the model, so I'll skip the big number.
DeepSeek's documentation also shows its own Search and Fetch APIs, which let an AI agent look things up on the web and read pages. That puts the company in the business of giving agents eyes, not just brains.
Why it matters for you: you won't run this model yourself. But strong free models push prices down for every tool you use, and that's good news for a small shop's budget. The flip side is the CERT-In story: cheap, capable agents are cheap for attackers too. Better tools and better locks arrive together, or not at all.
Quick takes
- ChatGPT Voice got new voices. OpenAI's GPT-Live-1.1 update, rolling out from October 15, adds voices in French, German, Hindi, Mexican Spanish, Korean and Japanese, with more natural accents. No Persian yet.
- GPT-6 Pro got faster. Release notes from October 16 mention quicker answers, better tool use and agents that work in parallel, for eligible Pro users.
- Google's Deep Review is public. Since October 14 it checks documents in PDF or plain text, with two free reviews a week. Google says uploads aren't used for training but are stored for a year.
- Google's Gemini agent for work is still in private beta after its October 8 launch. Wider release is expected around the end of October or early November.
What this week means for your shop
The theme this week isn't smarter AI. It's who holds the keys. Agents found passwords nobody was guarding. Old models are being switched off under tools people rely on. Shared decks carry shared access. Every one of these comes back to the same habit: know what's connected to your business, and who answers for it.
That's the job we take seriously at Vardast: an assistant that answers your customers on Instagram, WhatsApp, Telegram and your website, with your catalogue and your rules, and a team that handles the engine changes so January 14 is just another Tuesday for you. If your DMs feel like a door left open, start there.