The View

A workplace’s full-year holiday calendar, listing dozens of employees and the weeks they would be away, was among the material researchers found inside shared Meta Muse conversations. According to Ars Technica, the researchers enumerated 6,800 sharing links and opened a few hundred. Other discoveries included an internal revenue review intended for a chief executive and a small-business loan application. The confidential office had acquired a searchable front window. [1]

The mechanism deserves attention. Muse put conversation titles inside the subdomain of each sharing address. Those names could enter passive DNS databases when the links were used. A long, difficult-to-guess string did not prevent discovery through infrastructure that records domain lookups. Meta suspended sharing while reviewing the report. The researchers had found a consequential gap between what sharing appeared to mean and what the system actually exposed. [1]

That gap runs through several of this week’s developments. We are becoming very good at selling capabilities whose full operating obligations remain unsettled. An assistant can act across accounts. A backup supplier can protect a company’s records. A ferry can remain an affordable piece of public life. Each proposition attracts customers for good reasons. Each also requires someone to fund, enforce and maintain the conditions that make it dependable. [1]

The commercial temptation is to price the visible transaction and leave those conditions in the background. Buyers and governments should become much less accommodating of that habit. Dependability belongs in the purchase decision, with an owner and a price.

Consider how inexpensive the computational component is becoming. DeepSeek’s current pricing page lists DeepSeek-V4.1-Flash-1017 off-peak output at 60 US cents per million tokens, with uncached input at 15 cents per million tokens. On weekdays that are not Chinese public holidays, peak hours are 01:00 to 04:00 and 06:00 to 10:00 UTC. All other hours, including weekends and Chinese public holidays, are off-peak. Those are supplier prices for model usage, not the cost of running a complete business process. They do not establish how accurately the model performs any particular job. They nevertheless illustrate why companies will keep trying to delegate more work. At such rates, another attempt can look almost free. [4]

Responsibility does not become correspondingly cheap. More attempts mean more occasions to retrieve the wrong record, expose a document or use authority too broadly. Cheap computation can make previously uneconomic work worthwhile. It can also make badly specified work happen at a scale that defeats the people expected to supervise it. The useful financial question is what a correctly completed, recoverable task costs after permissions, verification and exception handling are included.

Microsoft’s account of the ConnectWise compromise shows why that distinction has become urgent. Microsoft attributes the campaign to Storm-0940, which it describes as China-state aligned, and says the actor used an agentic penetration-testing framework called ARTEX. Its account reports attempts to sign into more than 2,250 customer tenants after the attacker acquired control of ConnectWise application identities. In several attacks across the broader campaign, privileged cloud access followed initial targeting in less than three hours. [3]

The important mechanism was inherited authority. Applications that customers had already permitted to enter their environments became a route for the attacker. In some environments, Microsoft observed subsequent reconnaissance, credential modifications and privilege-related activity. An employee did not need to approve a fresh sign-in for each operation. Earlier consent was doing the work. [3]

There is a necessary complication. Microsoft also describes a password-spraying campaign with more than 151,000 failed logons and no observed successful authentication, token issuance or subsequent directory change. Most targeting in the broader campaign was unsuccessful. These details matter because the evidence does not support a story of omnipotent AI attackers. It supports a more practical conclusion: existing controls can hold, while compromised application authority can give automation an exceptionally productive opening. Speed magnifies the permissions available to it. [3]

ConnectWise’s disclosures reveal the customer’s bill in operational terms. The company suspended Cloud Backup and, as a precaution, integrated security and management services. In its October 20 update, scheduled backups, archive access and restores remained unavailable while restoration preparations continued. Existing archives were described as encrypted, isolated and preserved, with no indication of compromise. That is meaningful reassurance, bounded by the company’s stated visibility. It could not establish through its own investigation whether individual customers’ live Microsoft 365 environments had been affected. [5]

An intact archive and an available restore are different promises. A business buys backup partly because it needs to recover when something else fails. Losing access to restoration during a security response is therefore a material loss of protection, even without evidence that stored archives were stolen. Procurement should require an explicit answer about recovery during the supplier’s own incident. The answer may be expensive. Discovering the question during an outage is expensive too.

The strongest objection to this argument is that caution can consume the gains it is meant to protect. Put a human approval in front of every action and automation becomes a queue with better vocabulary. AWS makes that point in its published approach to agent governance. It advocates controls outside the agent, distinct identities, limited access and records that allow actions to be reconstructed. This is a vendor’s proposed architecture, not independent proof that every implementation will work. The underlying principle is sound: give routine work room to proceed inside enforceable limits. [7]

AWS’s own penetration-testing benchmark makes the distinction concrete. It reports 33 audited captures through intended vulnerabilities out of 37 containerised challenges. Two other captures were excluded after review found unintended routes. In two misses, the agent exploited the bug but brought the target down before retrieving the flag. This controlled exercise cannot be read as a production breach rate. It does demonstrate why an impressive capability score needs an operational qualification. The machine may reach the vulnerable component and still fail the customer’s purpose. [6]

Hong Kong’s Star Ferry belongs in this argument as a comparison, not as a casualty of AI. Its problem is the financing of a familiar service. The government announced on October 21 that the Executive Council had approved fare increases on October 13, effective January 25, 2027. Adult fares will be capped at HK$6 on weekdays and HK$8.30 at weekends. The monthly ticket stays at HK$190. [2]

The government says the operator accumulated losses exceeding HK$100 million between 2018 and 2023, relied on debt financing, and made marginal profits in 2024 and 2025. It expects losses again from 2026, citing slow patronage growth, rising costs and interest expenses. Those are the government’s grounds for the decision. They deserve scrutiny on their economics. Calling the ferry an icon does not pay its creditors. [2]

Keeping the monthly ticket unchanged is a defensible choice because it protects regular commuters while accepting that the service needs more revenue. The larger obligation remains: decide what fares should finance, what additional commercial income can reasonably provide, and what public support should preserve. If the city values the crossing beyond the revenue collected at the pier, it should account openly for that value. [2]

A ferry crossing, an AI task and a restored mailbox have different economics. Each puts an operating obligation behind the transaction the customer sees. Business leaders should insist on recovery arrangements before granting broad digital authority. Hong Kong should make its support for a valued transport service intelligible before the next financial squeeze. At the ferry pier, the city has chosen to hold a commuter’s monthly ticket at HK$190. In a company’s recovery plan, the equivalent decision is whether the customer can restore a mailbox while the supplier is fighting its own incident. Both promises deserve a named owner before the bill arrives. [2]