Canva just built its own image generator, and it didn't learn from photos. It learned from templates. That one detail tells you who it's for: not artists, but people who need a sale banner, a story post and a price card by lunch. In other words, you.
It's a busy week for anyone who makes content to sell things. A new video model wants to replace your phone tripod, one hacker showed what cheap AI agents can do to an online shop, and the big AI labs are now building assistants that work while you sleep. Here's what matters and what to do about it.
Canva's first image model was trained on designs, not photos
On October 22, Canva released Canva Craft, its first in-house image generation model. It's available to all Canva users through the Dream Lab tab, and developers can reach it through Canva's API.
The interesting part is how it works. Most image generators go straight from your prompt to pixels. Craft first plans the layout: where each element goes, how big it is, what's the headline and what's the small print. Only then does it draw. Canva says it trained the model on its own library of human-made templates rather than on photographs, and that it handles readable text better than general image tools. Output goes up to 2K across about 30 aspect ratios, and two faster, cheaper versions are on the way.
Why it matters to you: the weak spot of AI images for sellers has always been text. You ask for "Winter sale, 30% off" and get "Wintr slae 3O% of". A model built around layout and lettering is aimed straight at that problem. If it delivers, a seller with no designer can turn out a week of posts, stories and price cards in one sitting.
A word of caution, though. Canva's claims about text quality and its ranking come from Canva itself. Test it on your own product and your own language before you cancel anything. And keep your real product photos real: a generated banner is fine, a generated product is a returns problem waiting to happen. If you're still sorting out which tools deserve a place in your workflow, our list of AI tools for Instagram sellers and what to adopt first is a good filter.
HeyGen's new video model makes whole scenes, not just talking heads
HeyGen, best known for AI avatars that read a script to camera, launched HeyGen Video 1, its first general-purpose video model. You give it text, an image or your own reference material and it builds a full scene: clips of 5 to 15 seconds, up to 2K. Through developer platforms it's listed from about one cent per second of video.
HeyGen says Video 1 ranked first for text-to-video in a blind test run by Artificial Analysis. The public leaderboard snapshot we checked shows it near the top rather than alone in first, so treat "number one" as a marketing line. Near the top is still very good.
Why it matters to you: a 15-second clip is exactly the length of a Reel hook or a product teaser. At these prices, the cost of trying ten versions of an opening shot is close to zero. The cost that hasn't dropped is your attention: someone still has to pick the version that sounds like your brand and doesn't promise what the product can't do.
- Use it for mood and B-roll: a cozy room for a candle shop, rain on a window for a coat sale.
- Don't use it to fake the product itself. Customers compare the video to what arrives.
- Keep the hook human. The first two seconds still decide the scroll.
One hacker, cheap AI agents, and more than 100 broken shops
This is the story to read twice. Reuters reported that a single attacker used AI agents to try more than 1,200 websites, mostly online shops in the US, Canada, Australia and Japan, and broke into more than 100 of them. A researcher at the security firm NorForge found the operation through exposed control panels of Cairn, an open-source tool for running teams of AI agents. Named victims include Deere, SharkNinja and Cummins, which have played down the impact.
The money is what should worry you. The attacker spent roughly $5,000 on AI usage, about $50 per successful break-in. The agents worked for about 23 hours on average per site, probing patiently, and tried to plant hidden "uploader" files that keep a back door open into shop and payment systems. Estimates differ on the exact cost per attempt, but every version of the number is small.
Why it matters to you: for years small shops were safe-ish because they weren't worth a skilled person's time. That math just broke. An agent doesn't get bored, and at $50 a site, your little store is a fine target. Coming right after the PHP flaw we covered yesterday, the to-do list is short and boring, which is the point:
- Update your platform, theme and plugins this week, and delete the plugins you no longer use.
- Turn on two-step login for every admin account, including the one your old designer still has.
- Ask your host whether they scan for unknown files on the server, and how often.
We wrote about the earlier version of this pattern in our digest on AI agents breaking in with leaked passwords. The tools are getting cheaper every week. Your passwords shouldn't be.
Anthropic's Duet joins the race for assistants that act before you ask
Anthropic launched Claude Duet as a research preview on October 21, for Pro and Max subscribers in the US via a waitlist. Duet connects to your apps, sends you a short brief every morning, checks in every few hours and pings you when something needs attention. You can hand it bigger jobs, like a sales forecast or a dashboard, and it works on its own cloud computer with a browser, so your laptop can stay closed.
It will ask before anything with consequences: sending a message, making a payment, signing a document or deleting a file. Background checks count against your plan's usage limits.
Why it matters to you: Duet is the third big "always on" assistant this autumn, after Meta's Muse and OpenAI's Dots, which we covered in our digest on OpenAI's agents that never clock out. The direction is clear: AI is moving from "answer when asked" to "watch and nudge". For a seller, the useful version of that is simple. Something notices the unanswered customer at 11 p.m. and handles it, then tells you in the morning. Notice the line every one of these products draws, too: they act on their own, but they ask before money moves or a message goes out. That's a good rule for any assistant you put in front of your customers.
Quick takes
- OpenAI's money gets a little cheaper. CNBC reports OpenAI is close to raising up to $30 billion led by UAE investors and Coatue at a $1.25 trillion valuation, below the $1.4 trillion it pitched earlier this month. Investors are starting to haggle.
- Banks worry about your customers' agents. Axios reports Morgan Stanley and Bank of America are racing to contain risks from outside AI agents that can access customer accounts. The hard question: did the customer order that, or did the agent improvise?
- Google ads can now draw on connected Gmail and Photos. Under a privacy policy change effective October 16, if users connect those apps to Google's AI features, that data can shape the ads they see. It's opt-in, advertisers don't get the content, and sensitive categories stay blocked.
- Sweden's government offices block ChatGPT and Claude. Starting Monday, staff must use Microsoft Copilot on work computers instead. Expect more "approved tools only" rules at big clients.
- 1Password builds a key ring for agents. Its new 1Password for Agents lets AI agents sign in to services without keeping the passwords. Given the hacking story above, that's the right instinct.
What this week means for your shop
Making content got cheaper again this week: a design-first image model, a one-cent-a-second video model. Breaking into a shop got cheaper too. Both trends reward the same habit, which is paying attention. Use the new tools for the boring parts, keep a human eye on what goes out, and lock the back door.
The part no tool on this list covers is the conversation after the post. When that Reel lands and the questions start at midnight, Vardast answers your customers on Instagram, WhatsApp, Telegram and your website with your real prices and stock, so the content you worked on actually turns into orders. If you want to see what's at stake, here's what you lose while you sleep.