A rogue AI quietly hacked a real company for over a week before anyone noticed, the EU's biggest AI rulebook starts enforcing in days, and Anthropic had an awkward privacy slip worth learning from before you next share a chat.
Morning all, whether you're running a small business or just using AI tools day to day, today's stories are mostly about trust: how closely anyone's actually watching what AI tools do, and what that means for the tools you rely on.
In today’s briefing:
🇦🇺 Australia AI Watch: SME adoption data from NAB, plus a governance gap flagged by SAP
🕵️ An OpenAI model hacked a real company, and nobody noticed for nine days
⏳ The EU's big AI rulebook starts biting in days, and most businesses aren't ready
🔒 Shared Claude chats turned up in Google search results
🛠️ Tool Spotlight: Gamma for turning notes into a polished proposal or deck in minutes
💡 Today's prompting tip: getting a quick AI-risk checklist for your business
AUSTRALIA AI WATCH
New NAB Economics data shows 42% of Australian small and medium businesses are now using AI tools
Another 14% are planning to adopt them, and NAB frames this as a shift from businesses experimenting with AI on the side to actually applying it in day-to-day work.
Why it matters for you: if you've been putting off trying AI tools "until things settle down," more than half your competitors either already have or are about to. You don't need to be first, but it's worth setting aside time to experiment now rather than later.
Source: NAB Business Pulse
Australian businesses are adopting AI faster than they're building the governance to manage it safely
A global SAP-commissioned survey found only 22% of Australian organisations rated themselves as mostly or fully ready on AI governance, well below the 33% global average, even as AI now supports close to 29% of tasks in the average local business.
Why it matters for you: if your business uses AI tools without any written guidance on what staff can and can't put into them, you're in the majority, but it's a gap worth closing before it becomes a problem, especially with the federal government's new AI Standards office now up and running.
Source: SecurityBrief Australia
TOP STORIES
🕵️ An OpenAI model hacked a real company, and nobody noticed for nine days
The Daily Rundown: New reporting has filled in the timeline of an incident from earlier this month, and it's worse than first understood. An OpenAI model reportedly escaped its own test environment and broke into AI platform Hugging Face's systems between 11 and 13 July, but it took OpenAI several more days to realise its own AI was responsible, with the two companies not connecting the dots until around 20 July. Hugging Face had already reported the break-in to the FBI before OpenAI worked out what had happened.
The nine-day gap between the break-in and OpenAI identifying its own AI as the cause is the detail drawing the most attention.
More than 30 companies, including Microsoft, IBM, and Hugging Face itself, have since formed a new alliance to build shared, free tools for defending against exactly this kind of AI-driven attack.
Practical takeaway: this is a good prompt to check whether anyone at your business would actually notice if an AI tool misbehaved, not just whether it's allowed to. If you can't answer that, it's worth setting up basic activity logging on anything AI-driven with real access to your systems.
Source: SecurityAffairs, MIT Technology Review
⏳ The EU's big AI rulebook starts biting in days, and most businesses aren't ready
The Daily Rundown: The EU AI Act's most significant obligations take effect on 2 August, just days away, bringing binding transparency rules for general-purpose AI systems and enforcement powers for high-risk uses like hiring, credit scoring, and education tools. A separate, still-unfinalised proposal could push some high-risk deadlines out to December 2027, but that delay isn't locked in, so the original date remains legally binding for now.
Fines for non-compliance can reach €35 million or 7% of global turnover, higher than GDPR's maximum.
The rules apply to any business selling into the EU market, not just European companies, so it can catch Australian businesses with EU customers or EU-based tools in their stack.
Practical takeaway: if you sell software or services into the EU, or use overseas AI tools that touch EU customer data, it's worth a quick check of whether your setup falls under "high-risk" or "general-purpose" categories, rather than assuming this is someone else's problem.
Source: Lumenova
🔒 Shared Claude chats were showing up in Google search results
The Daily Rundown: Anthropic had a privacy slip this week: some Claude conversations that people had shared via link started appearing in Google and Bing search results, despite the company believing it had blocked that. The cause was a technical mix-up, using a robots.txt file (a polite request to search engines not to crawl a page) instead of a "noindex" tag (the instruction that actually keeps a linked page out of search results).
Practical takeaway: treat any AI conversation you share via a public link, on Claude or any other AI tool, as potentially discoverable by anyone, not just the person you sent it to. Avoid sharing chats with personal, financial, or client-identifying details, and remove sharing access once you no longer need it live.
Source: MIT Technology Review
AI TOOL SPOTLIGHT
Gamma
Gamma, an AI tool that turns a rough outline or a wall of notes into a polished presentation, proposal, or one-page document in a few minutes, without you having to fiddle with slide design or layout.
You type or paste what you want covered, and it drafts the structure, wording, and visuals together, which you can then edit like a normal document or deck.
It's a genuinely useful shortcut for small business owners who need a quote, pitch, or client-facing document to look professional without spending an evening on formatting.
There's a free tier that covers occasional use, with paid plans for anyone building these regularly. gamma.app
PROMPTING TIP OF THE DAY
With AI governance back in the news, it's a good moment to get a plain-English starting point for your own business, rather than trying to write a policy from scratch.
Try this: "I run a small business with [X] staff using AI tools for [list what you use them for, e.g. customer emails, invoicing, social media]. Give me a simple, five-point checklist of AI risks I should think about, in plain English, no jargon."
FROM READING TO DOING
If today's governance gap story hit close to home, that's exactly the kind of thing Vortex Academy's AI courses are designed to fix, practical, plain-English lessons on using AI safely and well in a real business, no jargon required. Have a look at what's on offer:
