Vendor terms
Google Meet starts taking AI notes by default on September 29, and the small-business tiers are the ones opted in
What happened. Google Workspace posted on September 22, 2026 that new settings for Take notes for me take effect September 29, 2026. On Business Standard and Business Plus, automatic AI note-taking is on by default for any meeting with three or more participants. Enterprise Standard, Enterprise Plus, Frontline Plus and Google AI Pro for Education have it off by default. Administrators set the organization-wide default in the Admin console, and individual users can change their own setting in Meet once the change lands. Google also made Quick notes the default tab in the generated documents and the default summary in the notification emails, with no separate admin control.
What it means for you. Read the tier list again, because the plans most small businesses buy are the ones being switched on. From September 29, your client calls, candidate interviews, vendor negotiations and internal personnel conversations start producing an AI transcript and summary unless someone decides otherwise. That is a written record you did not choose to create, sitting in Drive, discoverable later, and it runs straight into two-party consent rules, the GDPR, client confidentiality and any NDA you have signed. Set the organization-wide default in the Admin console before the date rather than after, decide whether users may override it, and tell your people in writing what is now being captured. If a client contract or a professional obligation bars recording, this is an admin action this week rather than a policy memo for later.
Source: Google Workspace Updates
Agentic AI
A web form on your own site turned a Salesforce agent into a data leak
What happened. Zenity Labs disclosed three chained flaws in Salesforce Agentforce, together called SalesBleed, reported by The Register on September 24, 2026. An attacker submitted hidden instructions through a public Web-to-Lead form on the company site. When an employee later asked the Agentforce agent about that lead, the agent followed the planted instructions and pushed CRM records back out through crafted image URLs, DNS lookups and Slack link previews, with nobody clicking anything. A third flaw let an outsider send phishing messages carrying the agent's own identity. The root cause was Salesforce's Trusted URLs check failing on unusual top-level domains and special characters, which defeated its own URL redaction. Zenity reported the chain on June 1, 2026 and Salesforce confirmed all three fixed on September 21, 2026. No CVE was assigned, and the fix was server side.
What it means for you. Nothing to patch does not mean nothing to do. The lesson generalizes past Salesforce: any field an outsider can type into becomes an instruction channel the moment an agent reads it. Pull the list of tools and objects each agent can reach and cut it to what the job needs. Treat web form fields, inbound email and support tickets as untrusted text the agent may summarize and must never obey. Check your Trusted URLs and your outbound allowlist. Then look at agent activity between June and September for outbound calls you cannot explain, because the window was open for those four months. If you are scoping an agent on customer-facing data, this is the failure mode to design against before it ships.
Source: The Register
Security
Your developers installed a software supply chain, and 2 percent of it has expired
What happened. Ox Security examined 15,465 Model Context Protocol servers listed across three public registries, covering 5,095 distinct hostnames, and Infosecurity Magazine reported the findings on September 28, 2026. Close to 16 percent of those hostnames resolved outside the United States, including servers in Russia and China. More than 2 percent no longer resolve at all, which leaves the domain free for anyone to buy and inherit the trust an agent already places in it. MCP has no concept of geography at the protocol level, so an agent can route company data offshore without appearing in any control you have. The researchers also showed that once Claude Code held an always-allow approval on a harmless file read, it went on to read .env credentials without asking again.
What it means for you. MCP servers are how a coding assistant reaches your files, your repositories and your APIs, and your people install them the way they install a browser extension. That is shadow AI with credential reach, and it sits on machines that also hold client work. List every MCP server running on company machines and name the publisher of each one. Drop any whose domain no longer resolves or whose publisher you cannot identify. Stop granting always-allow on anything that touches the filesystem or a shell, because that approval is broader than it looks. And if you have told a client where their data is processed, note that this is a path out of that commitment which no firewall rule will show you.
Source: Infosecurity Magazine
Employment
A regulator warned an employer about AI resume screening before the tool went live
What happened. Spain's data protection authority published a formal warning on September 23, 2026, reference AI-00009-2026, against a company that had told its staff it was about to deploy an AI tool to screen resumes and score candidates for outside hiring and internal moves. The AEPD acted under Article 58(2)(a) of the GDPR and imposed no fine. It set out what the employer has to have in place: data protection built in from the initial configuration, an impact assessment where the processing is high risk, clear information to candidates about what the tool does in the decision, an assessment of whether Article 22 applies, and effective human intervention, meaning a reviewer who critically evaluates the output rather than adopting it.
What it means for you. The timing is the whole point. The duties attach when you buy and configure the tool, not when the first candidate gets rejected. If you are evaluating an applicant tracking system with AI ranking or scoring, have the impact assessment written, the candidate notice drafted and a named reviewer with real authority to overrule the score before go-live. The vendor's compliance page does not cover you, because the employer is the controller. This is one Spanish warning, and the same shape runs through Colorado's notice duties from January 1, 2027 and the California employment regulations already in force since October 1, 2025. Treat it as the question you will be asked rather than one country's problem.
Source: Agencia Espanola de Proteccion de Datos
Build versus buy
Frontier model prices fell by roughly half in a single day
What happened. Anthropic and OpenAI both cut prices on September 22, 2026, as SiliconANGLE reported the same day. Anthropic released Claude Opus 5.5 at $4 per million input tokens and $20 per million output, down from $5 and $25, with cached reads dropping from $0.50 to $0.20 per million. OpenAI answered with two GPT-6 models: Sol at $2 and $10, and Luna at $0.10 and $0.50. OpenAI describes both as roughly half the price of its previous generation and as permanent rather than introductory.
What it means for you. Two decisions move. The first is any per-seat AI subscription you pay for that is a thin layer over a model call. Take the seat price, estimate the tokens your team puts through it in a month, and price the same work at the new rates. If the vendor is adding workflow, integration and support, the subscription still wins. If it is adding a prompt, it does not. The second is the pile of automations you priced last year and shelved as too expensive: document triage, email classification, first drafts, data extraction. The arithmetic that killed those has moved, and the cached-read price matters most for anything that re-reads the same policy manual or contract set on every call. Re-run the numbers before your next renewal conversation rather than after it.
Source: SiliconANGLE
Nothing in the Weekly Signal is legal advice. HEED SAI is not your law firm or your accountant. Where a development touches your obligations, we will tell you what to ask your counsel.
