Issue #24 | October 24, 2026 | Weekly Intelligence Briefing

Google switched Gemini on in 3 more places this week, and 1 of them came without an admin switch.

Gemini's BigQuery analysis in Sheets started rolling out October 19, ON by default. Google's announcement says there is no admin control for it.

Microsoft did the same in Word. Its new legal skills arrive enabled for Microsoft 365 Copilot commercial licenses, and admins switch them off by hand.

The fix you need this week runs the other way. PHP patched 2 flaws rated 9.2 out of 10 on October 21, and the patch won't install itself on a server you manage.

Google's Workspace blog supplied 5 of the 20 signals that cleared review this week, so the lead runs Google-heavy on purpose.

The tools that held up asked first. The new 1Password agent login waits for your approval on each sign-in, and a free Git hook holds AI-written code until you can explain it.

Below: 5 signals, the Hype Check Spotlight on Smartsheet's agent server, and the 1 tool worth your Monday.

Source: Google Workspace Updates

Google started rolling out Gemini analysis of BigQuery data in Google Sheets on October 19, with up to 15 days before all users see it. It works in sheets linked to BigQuery through Connected Sheets.

The announcement says the feature is ON by default, and that there is no admin control for it.

Gemini queries run against the full BigQuery dataset, beyond the rows your sheet shows. Google's own example question: "What were total sales in the Northeast last quarter?"

Eligible plans are Business Standard and Plus, Enterprise Standard and Plus, Google AI Pro and Ultra, Google AI Pro for Education and AI Expanded Access. Business Starter isn't on the list.

Gemini Notebook became a Connected App in the Gemini app on October 23. It's ON by default for users worldwide and OFF by default in the European Economic Area.

Admins keep 1 lever there: the app runs only where both the Gemini and Gemini Notebook settings are on. Gemini in Sheets on iPhone started rolling out October 15, with no specific admin control for the mobile feature.

Anyone who can query your BigQuery data can now ask Gemini about all of it, so the permission list is the last gate left.

→ List who can query each BigQuery dataset linked to a sheet. That list now decides who can question your warehouse in plain English.

→ Brief your data team before the side panel appears. Requests for one-off reports should drop, and checking Gemini's answers lands on them.

→ Set your Gemini and Gemini Notebook settings this week. Outside the EEA, Notebook is already on.

Read the full signal.

Source: Google Workspace Updates

Google Vault now exports Gemini in Workspace conversations from Gmail, Drive, Docs, Sheets, Slides and Meet. The update posted October 22 and is available now on Rapid and Scheduled Release domains.

It covers conversations created while conversation history is turned on.

Each export carries user prompts, AI responses, generated attachments such as images, links to referenced files and citations. The output is JSON, with metadata aligned to the conversation format the Gemini app uses.

Admins scope an export by user accounts or organizational units of up to 5,000 users, and by date range with time zone. Vault API support follows within 14 days of the UI rollout.

Retention rules and litigation holds for these chats come in future releases, with no dates given.

Editions: Business Plus, Enterprise Standard and Plus, Frontline Standard and Plus, Enterprise Essentials Plus, Education editions and the Vault add-on.

What an employee typed into Gemini with history on is now as easy to produce as their email, and the retention rules to manage it haven't shipped.

→ Add Gemini in Workspace to the record sources named in your compliance or retention policy.

→ Run 1 test export this quarter, from filter to JSON file, before a real request makes it your first attempt.

→ Until retention rules ship, name the person who owns AI chat history, the way someone owns email retention today.

Read the full signal.

Source: Bloomberg

PHP shipped fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, a pair nicknamed PHP2Shell. Both allow remote code execution with no login on PHP installations that serve web requests.

Zscaler CEO Jay Chaudhry told Bloomberg the moment calls for proactive measures beyond firewalls.

Qualys rates both flaws 9.2 on CVSS v4.0. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Qualys counts 110 million installations, 71% of those with a known version, on end-of-life PHP from 5.4 to 8.1. Those branches get only limited source backports for 7.4, 8.0 and 8.1.

Amazon Threat Intelligence logged an exploitation attempt on its honeypot on October 17, 4 days before disclosure, per Help Net Security.

watchTowr reports exploitation in the wild since October 21. CISA hadn't observed any when it issued its alert, and as of October 22 neither CVE sat in its Known Exploited Vulnerabilities catalog.

Wiz researchers put the AI angle in 1 line: "Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit."

A managed host patches its own servers, while an unmanaged VPS, a legacy build or a vendor box with PHP inside waits on you.

→ Ask your host today whether your server has the PHP2Shell fix. Managed hosts can patch without changing the version number, so the number alone doesn't settle it.

→ List the vendor products that bundle PHP. Palo Alto Networks confirmed every PAN-OS and Panorama version is affected.

→ If a system can't take the patch, CISA and the UK's NCSC say to consider taking it offline until it can.

Read the full signal.

Source: Crunchbase News

Seth Kugler, a partner at Grellas Shah LLP, warned in Crunchbase News about consumer AI agents on personal laptops. In his words, "thousands of employees may be inadvertently violating confidentiality agreements by running consumer AI agents" on laptops holding their employers' IP.

Kugler writes that a desktop agent "can scan files, create folders and ingest directory paths across a local hard drive, often without requiring special permission or alerting the user."

In a Northern District of California case, the court granted his firm's temporary restraining order and preliminary injunction. It called the competing AI agent an "existential threat."

The defense had argued that a quarantine folder for the stolen documents, plus 0 clients poached, meant no harm. Kugler says the court saw that folder as "grossly insufficient."

If a tool's settings allow model training on that data, he warns, courts may find the secrets "lost legal protection due to dissemination outside the company."

A confidentiality agreement written before desktop agents existed doesn't mention them, and that silence is where the protection leaks.

→ Add clauses on AI use, model training inputs and machine learning misappropriation to your confidentiality agreements, as Kugler recommends.

→ Move client files to a cloud setup where staff can view and edit them but can't download them to a personal laptop.

→ Check whether each AI tool with file access may train on your data, and switch training off where it can.

Read the full signal.

Source: TechCrunch

On October 22, 1Password launched 1Password for Agents. An agent that hits a login sends a unique key to prove its identity, you approve or decline on your device, and 1Password fills the credentials.

The password stays out of the agent's hands.

TechCrunch lists Claude Duet, OpenAI's Dots and ChatGPT Work, Grok Bot, Meta's Muse and agents from Town at launch. 9to5Mac says Muse and Grok Bot work to start, with OpenAI and Anthropic coming.

The product page says agent access is included in all Individual and Family plans, with a waitlist for agents not live yet. Per the developer docs, a grant lasts 30 days at launch.

The same day, Axios reported US banks detecting agent activity in customer accounts that most can't tie to a user request. A Chase spokesperson said customers "should not give their usernames and passwords to anyone."

The company's own warning: handing a credential to an agent "can leave people with sensitive information in places they can no longer control."

Approval on each login is the pattern to copy now, whichever vendor you pick, because a pasted password stays put after the task ends.

→ Find each tool where someone pasted a shared password into a settings field, and give it its own login from a vault.

→ Require a human approval on any automated login that touches a bank or payment account.

→ If you already pay for an Individual or Family plan, join the waitlist for your agent. No business plan is named yet.

Read the full signal.

Source: AWS Machine Learning Blog

This week's theme has a project-board version. Smartsheet's MCP server gives agents read and write access to live sheets, and the playbook AWS posted October 20 is long on capability and short on numbers.

Community adoption. The post names no customers and no usage figures for the server. It documents 2 ways in: Amazon Quick for business teams and Kiro for developers.

Pricing model. The post names no price for the server itself. The requirement is a Smartsheet account on a Business, Enterprise or Advanced Work Management plan.

Benchmark data. The post claims token-efficient payloads and lower cost and latency at scale, with no figures behind either claim. The server exposes more than 40 tools for sheets, rows, columns and automations.

Expert sentiment. Each voice in the post belongs to the vendor or its cloud partner. The playbook includes no independent test of the server.

Release maturity. The server has left preview and runs at 3 regional endpoints, in the US, the EU and Australia. Agents reach only data the signed-in user can see, and admins can limit write tools by user group.

AWS also gave Claude on Bedrock structured outputs the same week, which holds agent output to your JSON schema during generation.

The verdict: the permission model is the strongest part of this launch, and the write-tool limit by group is the setting to configure first.

Run 1 weekly status report through it and time it yourself, because Smartsheet hasn't published a number you can hold it to.

Read the full signal.

Source: Sphinx

Sphinx is a free, MIT-licensed Git hook. Before a push to a protected branch goes through, it asks you a question about what the change does, and the push waits for your answer.

It works with Codex, Claude Code, Cursor, OpenCode, Pi or plain Git. Questions run on your coding agent, OpenRouter or any OpenAI-compatible endpoint.

Install takes 2 commands: npm install -g sphinx-understand, then sphinx install. Your answers never reach the coding agent, and the site says .env files and keys are never opened.

In a hurry, sphinx yolo lets the push through and logs the skip.

The catch: it needs Node 22.19 or newer on macOS, Linux or WSL, with no native Windows listed. Model calls bill to whichever API you point it at, and the site gives no cost per question.

If a freelancer or a coding agent ships code to your clients, put Sphinx on the 1 branch that deploys and count the pushes it stops in a week.

Read the full signal.

Each of these moved a cost, down for the models and up for the data and checks around them.

Recursive and DeepSeek shipped faster coding models, and Flint runs free on a laptop. Recursive's own tests clock Flint at about 131 tokens per second on an M4 Pro MacBook Pro, per TechCrunch, under Apache 2.0. DeepSeek's V4.1-Flash-1017 lifted Terminal-Bench 4.0 from 31.2 to 42.3 on its model card. Read the full signals on Recursive Flint and DeepSeek's Flash update.

AI's hidden bills sit in storage and in the token meter. In a Western Digital-sponsored piece, an 8-second clip delivered as a 3.97MB file left over 500MB on the back end. AlixPartners co-CEO Rob Hornby told Bloomberg per-token charges have exposed what usage costs. Read the full signals on AI storage costs and per-token pricing.

n8n mapped where agent workflows break: wrong answers and lost memory. Its hallucination guide sorts failures into 4 types and holds high-risk actions for human review. Its memory guide reports the best BEAM scores at 79% at 100K tokens and 67% at 10 million. Read the full signals on hallucination checks and agent memory.

Microsoft's new legal skills arrive switched on in Word. Copilot for Legal launched October 15 with more than 20 legal skills for Microsoft 365 Copilot commercial licenses. Admins turn the Word plugin off in the Microsoft 365 Apps admin center, and the old Legal Agent is being retired. Read the full signal.

The full week's signals, detailed breakdowns, and action items are on the site. If this issue earned its place in your inbox, forward it to whoever signs off on your AI budget.

This issue went out to subscribers Saturday. If you want next week's before it hits the web, subscribe at metadatamarketer.com/subscribe

Test. Cut. Share.

Moe Sbaiti, The AI Profit Wire https://metadatamarketer.com

Disclosure: some tools referenced in this newsletter are affiliate partners. Full disclosure and analysis at metadatamarketer.com.