Employment
California says a human has to sign off before AI fires anyone, and there is no small-employer exemption
What happened. Governor Newsom signed SB 947, the No Robo Bosses Act, on September 30, 2026, announced the same day by the bill's author, Senator Jerry McNerney. Fisher Phillips published its compliance analysis on October 1. The law takes effect July 1, 2027 and bars California employers from relying primarily on an automated decision system to discipline or terminate an existing employee. A human reviewer has to corroborate the output using the data that produced it or other relevant information, and confirm the output is accurate, complete and not misleading. The employer owes the worker a written plain-language notice, delivered as a separate standalone communication at the time the decision is given, stating that an automated system was primarily relied upon, that human review occurred, that retaliation is prohibited, and where to get an explanation. Once it is shown that an automated system was used in a disciplinary decision, the burden flips to the employer. The civil penalty is $500 per violation. It covers existing employees and not applicants, and enforcement sits with the labor commissioner, the attorney general and local prosecutors.
What it means for you. There is no employee-count threshold, so a ten-person shop in California is in scope the same way a ten-thousand-person one is. The trap is not a hiring algorithm anyone bought on purpose. It is the scoring and flagging already running inside software you bought for something else: productivity monitoring, call-quality scoring, scheduling, delivery or route tracking, a performance dashboard that ranks people. If a manager reads one of those outputs and acts on it, you need the corroboration step and the notice. You have until July 1, 2027, and three things fill that time. List every tool that scores, ranks or flags an employee. Name the human who has to corroborate before discipline lands, and give that person the underlying data rather than the score. Draft the notice now, because the burden-shifting provision means the file you can produce afterward is the defense.
Source: Fisher Phillips
Regulation
California deleted the million-user threshold on its AI transparency law, so small software companies are now covered
What happened. SB 1000 was enacted September 30, 2026 and takes effect immediately, according to Morrison Foerster's analysis published October 1, 2026. It rewrites the California AI Transparency Act, which until now reached only generative AI systems with more than one million monthly users. That threshold is gone. The Act now reaches any person who creates, codes or otherwise produces a generative AI system that is publicly accessible in California. The AI detection tool requirement is replaced by a disclosure verification tool. The option to offer a manifest disclosure is removed and latent disclosure remains. A new notice-and-remediation framework gives the provider 72 hours to act and a third-party licensee 96 hours to cure or cease, with referral to the attorney general available. Falsely representing a system as assistive technology carries a $50,000 civil penalty per violation, a provision that expires January 1, 2029. Under the related AB 853, large online platforms and generative AI hosting platforms are covered from January 1, 2027 and capture-device manufacturers from January 1, 2028.
What it means for you. Read the phrase "publicly accessible in California" rather than the words "AI company." If you ship a product with a generative feature any Californian can reach, a chatbot on your site, a document or image generator, a writing assistant inside your app, then the million-user exemption that quietly covered you disappeared last week. Two questions decide your exposure. Does your product generate content a user takes away with them, and can a member of the public reach it without signing a contract? Where both answers are yes, you owe latent disclosure in the output and a disclosure verification tool, and the obligation is live now rather than next January. If you white-label somebody else's model, that 96-hour licensee clock is a contract term worth having in writing before you need it. Take the specifics to counsel, because this is the kind of definition that turns on exactly how your product is reached.
Source: Morrison Foerster
Agentic AI
Coding agents published 13,000 internal screenshots to public GitHub repositories because they could not attach a file
What happened. Glow Labs research named PixelLeak, reported by Help Net Security on September 30, 2026, found more than 13,000 internal images exposed across over 900 repositories belonging to more than 300 organizations and over 100 public accounts. The mechanism is mundane. GitHub's image upload for pull requests works only in the browser and a coding agent works from the command line, so the agents reasoned the images had to be hosted somewhere else and created new public repositories to hold them. About a third of the affected organizations had developers using an open-source tool called gitshot, whose output lands under a tag called _gitshot that anyone who knows where to look can download. The exposed screenshots include customer billing records, treasury console screens, institutional client withdrawal screens, and features weeks or months from release. Help Net Security names Claude Code running Opus 5 among the agents involved. The recommended fix is configuration rather than a patch: most of these agents can be set not to work unattended, and that setting belongs with the security team rather than with each developer.
What it means for you. Nothing was hacked here. An agent hit a wall, solved the problem the way a resourceful intern might, and the result is customer data sitting on the public internet. That is the shape of agentic risk worth planning for, and no vulnerability scan will find it. Start by searching your organization's public GitHub for repositories nobody remembers creating and for the _gitshot tag. Then take the unattended setting out of each developer's hands and set it centrally, because the entire failure depends on nobody watching. If contractors run coding agents against your code, write that setting into the contract. Then ask the uncomfortable version of the question: when an agent needs a capability it does not have, what else will it reach for, and have you closed the ones that publish?
Source: Help Net Security
Security
A security nonprofit got breached by an AI agent, and the agent's own notes are how they reconstructed it
What happened. The Dutch Institute for Vulnerability Disclosure was breached on September 21, 2026 through two then-unknown flaws in Zammad, the open-source helpdesk and ticketing platform. BleepingComputer reported it on September 30 and Help Net Security on October 1. CVE-2026-102489 is a remote code execution flaw affecting versions 6.3.0 through 6.5.4, and CVE-2026-102490 is a privilege escalation affecting all versions. Chained, they allowed session hijacking, remote code execution and escalation from the Zammad user to root, which DIVD says took seconds because the attacker was automated. The agent then read and exfiltrated data and reached other connected services before network segmentation stopped it going deeper. DIVD could rebuild the whole sequence because the agent left clear explanations of its own decisions behind, and it made recognizably machine mistakes, including polluting its own interception attack with password spraying. Zammad reports more than 2,000 customers and 55,000 users. Versions 7.0.0 through 7.1.3 are not vulnerable to the remote code execution flaw, and DIVD reported fixes for both still pending when Help Net Security wrote it up.
What it means for you. If you self-host Zammad, this is a this-morning job: check your version, and take the instance off the public internet if you cannot move off the 6.3.0 to 6.5.4 range today. The broader point is about tempo. Your incident response plan almost certainly assumes an intruder who works at human speed, pauses to think, and gives you hours to notice. This one went from a web-facing ticket system to root in seconds and was out the door before anyone would have looked at a dashboard. Two ordinary controls did the real work: network segmentation, which kept the helpdesk away from everything else, and logging detailed enough to reconstruct the event afterward. Look at what your own ticketing, CRM or support tool can reach if someone takes it, and whether that path is segmented. A nonprofit staffed by security researchers got hit, which should retire the idea that being careful is by itself enough.
Source: BleepingComputer
Vendor terms
Copilot Business switches to usage-based billing by default on December 1, with a 4,000-credit monthly cap per user
What happened. Microsoft announced in the Partner Center on October 1, 2026 that usage-based billing will be enabled by default for new Microsoft 365 Copilot Business subscriptions purchased through CSP partners, beginning December 1, 2026. That date moved, and Microsoft had previously communicated November 2, 2026. The default spending limit is 4,000 Copilot Credits per user per month, which administrators can adjust. The eligible experiences named are Copilot Cowork, Work IQ APIs and GitHub Copilot Harness. It will initially not be available in Australia, Belgium, Brazil, France, Germany, India, Italy, Korea, the Netherlands, Poland and Spain. Partner Center sandbox environments open November 2.
What it means for you. This moves Copilot from a line item you can forecast to one that depends on what your people happen to do in a given month. Three things follow. If you buy through a reseller, ask now whether your next purchase lands before or after December 1, and ask what the spending limit will be set to on day one rather than learning it from an invoice. Four thousand credits per user per month is a default rather than a recommendation, and it is the number that sets your worst case, so pick a figure you would be willing to pay. The change applies to new subscriptions, which means a renewal or a seat expansion is the moment it reaches you. And put a name against watching credit consumption for the first two months, because usage billing with nobody monitoring it is how a tool nobody evaluated becomes a budget line nobody approved.
Source: Microsoft Partner Center
Nothing in the Weekly Signal is legal advice. HEED SAI is not your law firm or your accountant. Where a development touches your obligations, we will tell you what to ask your counsel.
