PHP2Shell is a warning for any company letting agents write its code
AI helped find two critical PHP flaws, and attackers moved within minutes of disclosure. If agents write and run more of your code, here is what has to change.
Read the postField Notes
What I’m seeing as companies put AI to work.
Stories, opinions and working methods for the people running companies. A new post every Tuesday.
Certify your people on their own work, not on an AI course
Firms are starting to tie pay to AI skills without a way to measure them. Here is how to certify people on the tasks from their actual jobs.
What it looks like when agents do a ten-person team's work
How FinalPeace runs development and marketing on AI agents that send finished work to one queue, and why reviewing output beats reviewing every step.
Executives need an AI plan, not another demo
Last week brought another round of impressive agent demos. The companies getting returns have something rarer, a written multiyear plan run by the C-suite.
AI budgets are growing, and finance teams reject AI requests more often
AI's share of software budgets jumped sixfold while finance teams reject AI requests more often. The returns go to companies that change the work.
A 14-day plan to put AI to work in one department
A day-by-day plan to take one department from talking about AI to running one working agent, with a baseline and a decision at the end.
Pay your AI vendors for results, not hours
AI makes work faster, but hourly contracts keep the savings with the vendor. Here is how to buy AI work by the result instead.
OpenAI's finance team cut a five-day task to five hours because the person doing it mapped it first
A finance director at OpenAI automated the slowest part of his monthly close. The lesson for operators is about who maps the work, and how.
Start with the AI tools you already pay for
Google and Microsoft keep folding more AI into the suites you already license. Here is how to get one real workflow out of them before you buy anything new.
The tiny companies doing big numbers have a habit your managers should copy
Solo founders and four-person teams are doing work that used to take dozens. The lesson for a 100-person company is about how they decide to hire.
Google halved the price of agent work this week, so test your own tasks before you switch
Gemini 3.7 Flash arrived three weeks after the last model at half the price. Here is what that changes for a company running agents, and what it doesn't.
An agent should reach only what its one job needs
Black Hat researchers got three major coding agents to leak keys with one public GitHub issue. Here is how to set permissions for the agents you run.
Tell your team the AI plan before a filing or a rumor tells it for you
Monday.com's layoffs came with three versions of the AI story in one day. Here is why your team should hear one version, from you, first.
Uber named AI in its support cuts, so your team is already asking about theirs
Uber tied a round of support layoffs to AI last week. Here is how to talk about AI and jobs with your own people before they fill in the blanks.
Let an agent build the client report so your account leads can write the part clients read
Reporting tools shipped AI summaries and live data links this month. How an agency should split the monthly client report between agent and person.
Waiting a year on AI costs you a year of corrections you can't buy back
The tools will be cheaper next year. The company that started this year will still be ahead, and Satya Nadella explained why on Sunday.
Shopping agents are real, and Salesforce is betting the sale still closes on your own site
Salesforce shipped agents that sell, take reorders and run the catalog. Walmart's results explain why the sale is moving back to the store's own site.
Prime Day orders are shipping now, so take "where's my order?" off your support team
Order status is the easiest support question to hand to an agent. A step-by-step setup, the rules it needs and what to keep with people.
Buy or configure your first agent, and build only when the software is your product
Three AI deals in one week show how fast the ground moves under vendors. How a small company should choose, and what to own whichever way it goes.
Tomb Raider's AI label is a lesson in saying how you use AI before someone else finds it
Two game studios learned this year that the AI you used in development becomes the story if customers find it first. What every operator should set up now.
Answer every new lead within minutes and let an agent send the first reply
Meta just put a lead-qualifying agent inside WhatsApp for free. Here is how to set up AI follow-up so no inquiry waits overnight again.
Training your people will do more for you than buying another AI tool
Companies are starting to grade employees on AI skills they never taught. Here's why training on real work pays off faster than another license.
An AI agent platform was breached, and the attacker went after the keys agents use
What happened in the Composio breach and the TrapDoor package attack, and the five things to lock down if your agents connect to company systems.
Who checks the agent's work, and how to design that review step
BNY gives every one of its AI agents a human manager. Here's how to set up review so it catches mistakes without becoming a second job.
The CEO has to use AI personally, or the company won't
Microsoft's new survey of 20,000 workers shows AI adoption follows what leaders do. Here's what using it yourself looks like in a normal week.
ADT now sends half its calls to AI first, and the order it did things in is the lesson
What ADT disclosed about its AI rollout on last week's earnings call, and the sequence a mid-size company can copy.
Your SOPs are your prompts, so write them for an agent
How to turn the procedures your team already follows into instructions an agent can carry out, and how to fix them when it gets things wrong.
Before you post the next job, ask whether an agent should do the work
A task-by-task test to run on every open role before it goes live, and why last week's AI Index makes it urgent.
Anthropic's Mythos model finds decades-old bugs, and small companies need to patch faster
Anthropic's new model found thousands of serious software flaws and won't be released. Here is what that means for a company of 20 to 200 people.
Time the task before you automate it, or you will never know what AI saved
Companies keep raising AI budgets while struggling to prove value. A week with a stopwatch before launch gives you a number you can defend.
Write your AI rules before you buy the tools, because your vendor already wrote theirs
The Pentagon and Anthropic ended up in court over how AI may be used. A one-page rulebook written before you buy keeps that fight out of your company.
Meta's AI agent posted without permission, and four ordinary controls would have stopped it
An internal Meta agent shared bad advice unasked and exposed data for two hours. Here is what went wrong and the controls to put on your own agents.
Pick a first AI workflow your team won't have to babysit
New BCG research shows heavy AI oversight wears people out. Use it to choose a first workflow that saves time instead of creating review work.
The new AI support desks still give 40 percent of the work to people
A six-person startup now runs whole support departments for other companies. Here is how it splits work between agents and people, and what to copy.
AI pilots stall when nobody owns the result, so start with one department
A new survey of 6,000 executives found almost no AI payoff yet. Here is why company-wide pilots stall and why one department is the better place to start.