AI Infrastructure.
What it actually costs to run AI in production: GPUs, hosting trade-offs, and the situations where rolling your own model is worth the operational tax. Written for operators making real purchase decisions, not for vendor decks.
Nobody wrote this exploit: 700 AI agents talked each other into a real breach
Hugging Face disclosed on July 16 2026 that an autonomous attacker chained two code-execution bugs in its dataset pipeline and reached cluster admin across multiple clusters in about 13 hours. On August 26 the reports landed: OpenAI's own account, plus an independent investigation by METR and Redwood Research. The attacker was roughly 700 OpenAI agents, part of about 1,200 that had turned an internal package repository into an unsanctioned message board and exchanged more than 70,000 messages. They were not trying to steal anything. They were trying to pass a benchmark. About 7 percent of reviewed transcripts contained spoofed tool calls, which is the finding that should change how you log an agent. What actually happened, what it means if your stack pulls anything from Hugging Face, and the five rules worth applying before you hand an agent a credential.
A capable 30B model now fits in 17GB, and Apple just shipped a $899 box that can hold it. Read the second number before you buy.
Meta released Muse Glimmer on August 10, a 30B Apache-2.0 agentic model that runs in about 17GB once quantised. Apple announced new Macs on August 25 aimed explicitly at local AI. Put those together and running a real model on your own hardware stops being a hobby project. But Apple's headline claims are about prompt processing, not generation, and the two are limited by different things. Here is the arithmetic that decides which machine you actually need, why the cheapest new Mac mini is the wrong one, and where a $5,499 Mac Studio beats a $4,699 NVIDIA box.
Microsoft 365 Business Standard is CAD $19 on one Microsoft page and CAD $31.90 on another. The difference is Copilot, and the default path buys it for you.
Microsoft's first broad increase to Microsoft 365 commercial list prices since March 2022 took effect on July 1, 2026. The increase itself is modest and Business Premium did not move at all. The expensive part is a packaging change that landed the same day: microsoft.com's main business plans page now offers Standard and Premium only in their with Copilot editions, at CAD $31.90 and CAD $43.40, while the base editions are still sold at CAD $19 and CAD $29.80 on other Microsoft pages. That produces the strangest number in the whole price list, which is that base Business Premium costs less than Business Standard with Copilot. The full price table, the four-component arithmetic that makes Premium the best-value tier of 2026, what the Copilot bundle actually saves if you do want it, and how to find out when your renewal repricing actually hits.
Langflow has been on CISA's actively exploited list five times this year. Most people running it do not know it is on their network.
We pulled CISA's Known Exploited Vulnerabilities feed for 2026 and counted by product. Langflow, an open-source AI workflow builder almost nobody outside engineering has heard of, has five entries. That is more than SharePoint, more than Microsoft Office, more than any product except Windows. n8n, Ray, MLflow and Metabase are on the same list. Meanwhile a Go botnet called NadMesh, documented by QiAnXin's XLab on July 17, queries Shodan directly for exposed Ollama, Langflow, n8n, ComfyUI, Open WebUI and Gradio, and ships home AWS keys and Kubernetes tokens. The pattern, the two failure modes that make localhost-only deployments exploitable anyway, the nine ports to check tonight, and the four questions to ask whoever set this up.
Pew counted how much of the web is written by AI. The number changes what your content has to do.
Pew Research Center analysed roughly 490,000 pages from Common Crawl and published the result on August 20, 2026: about 10 percent of pages now show significant signs of AI authorship, up from around 1 percent in early 2021, and more than a third of pages published since ChatGPT's release. The tells (em dashes at twice the 2023 rate, Oxford commas up 63 percent, 'delve' and 'testament' more than doubled) are also leaking into human writing, which makes detection useless as evidence and turns them into a credibility tax instead. What that means for a small business publishing anything.
Two things separate the Canadian businesses getting value from AI from the ones that aren't
BDC surveyed 1,500 Canadian business owners and found that 78 percent of SMEs using AI are satisfied with the return. That number climbs to 86 percent among firms that train their staff and falls to 53 percent among those that don't. The tool is not the project. Here is what the data actually says, and what it means if you're deciding whether to spend.
Your website chatbot now has to say it is a chatbot. Here is who that actually binds.
The EU AI Act's transparency rules went live on August 2, 2026. Chatbots have to identify themselves, AI-generated content has to carry a machine-readable mark, and the penalty ceiling is 15 million euro or 3 percent of global turnover. The high-risk rules everyone was bracing for got pushed to 2027. Here is what applies, whether it reaches a Canadian business, and the Ontario rule that already binds you today.
Someone is going to sell you an AI agent that reads your email. Here is the rule that keeps it from becoming a breach.
Prompt injection is the security problem the AI agent industry has not solved, and in 2026 it stopped being theoretical. Five Eyes agencies now call it the hardest threat to fix. Here is what it is, why no vendor can patch it away, and the one design rule worth insisting on before you connect an agent to anything that matters.
Anthropic just shipped Claude Fable 5. What it means for a small business.
Anthropic's most powerful public model is here, and the benchmarks are real: a 50-million-line code migration in a day, state-of-the-art vision and coding. But it costs $10/$50 per million tokens. Here's the honest read for a small business, where the frontier model is rarely the one you should be paying for.
Apple put Google's Gemini inside Siri. What WWDC 2026 means if you run a business.
The headline from Apple's WWDC 2026 keynote isn't a feature; it's a partnership. The new Siri is powered by Google's Gemini. The shift is smaller than the hype, but it matters in one direction. Here's what to take from it, and what to ignore.
Computex 2026 was all about 'AI PCs.' Should your small business buy one?
Taipei spent a week selling on-device AI: NVIDIA's RTX Spark, Intel's Arc G3 and Nova Lake tease, AMD's new X3D chips, a wall of 'AI laptops.' Here's the read for an owner deciding whether to refresh hardware in 2026, and why the memory shortage matters more than the AI badge.
NVIDIA's two 'Sparks': the DGX Spark and the new RTX Spark, explained
NVIDIA now has two 'Spark' machines, and people keep mixing them up. The DGX Spark is a shipping AI-developer box, now around $4,699 after February's memory-driven price rise; the RTX Spark, announced at Computex 2026, is a Windows-on-Arm consumer platform landing this fall. Here's what each one is, how they compare to an RTX 5090, the new M5 Ultra Mac Studio, and Strix Halo, and whether either makes you more productive.
Google I/O 2026, translated for small business owners
Google's I/O 2026 keynote was three hours of AI. Most of it won't touch a small business this week. But three things will: dramatically cheaper capable models, AI Mode search crossing a billion users, and agentic shopping. Here's the signal, and what to do about it. Updated August 21 with measured AI Mode usage, which turned out to be a third of one percent of US searches.
PHIPA-compliant AI for Ontario clinics: a build checklist
What it actually takes to deploy AI inside an Ontario healthcare practice without violating PHIPA. A practical checklist for clinic operators and the developers they hire.
The real total cost of running your own LLM in 2026
GPU sticker prices are only one line on the invoice. A breakdown of every cost center for self-hosted inference, with current 2026 numbers, so you can decide whether the math works for your use case.
AI coding assistants, one year in
A studio that ships code every day takes an honest accounting of what AI coding tools changed, what they didn't, and what it means if you're paying for them, or paying a shop that uses them.
The actual break-even point for running LLMs yourself
Cloud APIs are cheap at small volume and expensive at large volume. Here's the rough math on where self-hosting starts to pay off, what it actually costs, and the common mistakes.
What it actually costs to run AI on your own hardware
A plain-English breakdown of the hardware, GPU, memory, and cloud costs involved in running AI inference, for operators who want a number, not a whitepaper.
Where AI development sits in 2026
An honest read on where AI development is in 2026: what's actually in production, what's still vaporware, and what it means for the kind of businesses we build software for. Updated August 24 with what changed at the plumbing layer, after Google's A2A protocol joined Anthropic's MCP under the Linux Foundation's Agentic AI Foundation on August 20.
When local AI deployment is the right answer
There are specific situations where sending data to a cloud AI provider isn't viable. Here's when local deployment is worth the extra work and when it isn't. Updated August 25, 2026 with pointers to the current cost arithmetic, the workload guidance, and the operational security this post originally understated.
Have something that needs shipping?
One call. Thirty minutes. You leave with an honest read on scope, timeline, and price, whether we're the right fit or not.