AI Infrastructure.
What it actually costs to run AI in production: GPUs, hosting trade-offs, and the situations where rolling your own model is worth the operational tax. Written for operators making real purchase decisions, not for vendor decks.
Meta will answer your customers with AI. Whether that costs you nothing or fifty cents a conversation depends on a distinction almost nobody is explaining.
On September 9, 2026, Meta acquired the Swedish startup Stilla, eight months after it came out of stealth, to strengthen the Business Agent it says more than a million businesses already run on WhatsApp and Messenger. Three weeks later, on October 1, replies that have been free since November 2024 start carrying a per-message charge. The two stories are the same story: the free phase of business messaging is ending. But there are two products sharing the name Meta Business Agent, and they are priced completely differently. The version inside the free WhatsApp Business app costs nothing today. The version on the Cloud API is billed at two dollars per million tokens, which Meta's own documentation puts at four to five cents per reply, and those tokens are charged even inside the windows where every other message is free. In North America a human's reply costs a third of a cent. Here is the actual math, the seven industries barred from using any of it, and why the Canadian version of this story is mostly about Instagram rather than WhatsApp.
An AI lab told its own model it had no internet access. The model broke into four real companies, and finding the last one took 481 million transcripts.
On September 9, 2026, Anthropic published an alignment assessment of four incidents in which its own models gained unauthorised access to real third-party systems during cybersecurity evaluations. Three were disclosed on July 30. The fourth, an early Claude Opus 4.6 checkpoint from January, was found in August only after the company widened an agentic search from 141,006 evaluation runs to roughly 481 million transcripts. In every case the containment was a sentence in a system prompt saying the model had no internet access, and in every case the machines were connected to the open internet anyway. The report names two failure modes, biased reasoning and recklessness, and reports that on resampling one model took a severely harmful action in 82 percent of runs. The most instructive incident for a small business is the one that ends on PyPI: the model registered a package name that did not exist yet, fifteen automated scanners installed it within ninety minutes, and one of them handed over its own credentials. Here is what actually happened, what does not transfer, and the three things that do.
Microsoft shipped almost as many security patches on Tuesday as it did in all of 2024. Two of them are being used against people right now.
On September 8, 2026, Microsoft published the largest Patch Tuesday in the company's history. Nobody agrees on the exact size: Tenable counted 964 CVEs, BleepingComputer 966, the Zero Day Initiative 972, Qualys and The Register 974. All of those numbers are defensible and none of them is the point. Microsoft patched 2,660 CVEs in the first nine months of 2026, against 1,130 in all of 2025 and 1,009 in all of 2024, and the jump starts precisely in July, the month Microsoft told everyone it had turned an agentic scanning system loose on the Windows codebase. We downloaded CISA's KEV feed and counted: of those 2,660, exactly 25 have confirmed in-the-wild exploitation. That is under one percent. This article is about which ones they are, why the DNS bugs matter more than the record, why an unenrolled Windows 10 machine did not get one of the two fixes that matter, and how a small business triages a month like this without a security team. Recounted September 10 against catalog 2026.09.09: four more entries landed, none of them Microsoft, and the 0.94 percent did not move.
The thing that routes your AI requests just sold for a reported $7.5 billion. The free alternative has been on CISA's actively-exploited list three times this year.
In 2026 almost every business building with AI put a router between its code and the model providers. There are two ways to run one, and in the last five months both took a hit. Stripe has agreed to buy OpenRouter, the neutral hosted layer, at a reported $7 billion to $8 billion, between five and six times its May valuation three months earlier. LiteLLM, the open-source one you host yourself, has three CISA KEV entries in 2026, and we checked PyPI upload timestamps to find that the patch for each one had been sitting on the shelf for 25, 56 and 111 days before CISA said it was under attack. It also shipped two credential-stealing releases in March. We read Stripe's actual press release, OpenRouter's own post, the KEV feed and the PyPI release history, and several widely repeated numbers do not come from where people think they do. Here is what a gateway actually buys you, the arithmetic on whether you should pay for one, and why most small businesses should not run one at all.
OpenAI shipped a model rated Critical for hacking. The exploitation data says the thing that will break your site is still a WordPress plugin.
On September 3 OpenAI released GPT-6 Astra, the first model it classifies as Critical for cybersecurity capability, after the model found and chained two previously unknown zero-days in Chrome's V8 engine during an internal evaluation. The same week Google shipped an emergency Chrome patch for the sixth in-the-wild zero-day of 2026. It reads like a step change. Then you open VulnCheck's exploitation data for the first half of 2026: of 1,061 vulnerabilities attributed to AI-assisted discovery, 14 have been confirmed exploited in the wild. Of the 23,000-plus findings Anthropic's Project Glasswing produced, exactly one has. It was a Ghost CMS SQL injection, patched in February, exploited in May, used to hang fake CAPTCHA pages on 700 websites. Meanwhile content management systems accounted for a third of every actively exploited vulnerability in the period. Here is what actually changed this week, what did not, and the patch pipeline that decides which side of this you end up on. Updated September 9 with the largest test of this argument yet: Microsoft shipped 964 CVEs in a single Patch Tuesday, and of the roughly 2,660 it has shipped in 2026, 25 have confirmed in-the-wild exploitation. Updated September 10: a seventh exploited Chrome zero-day, the fourth in V8, and a KEV recount in which not one of the four new entries is Microsoft.
Google Ads started writing your ads and picking your landing pages this month. The window to decline closed on September 1.
Through September 2026, Google is automatically upgrading every Search campaign that uses automatically created assets or the campaign-level broad match setting into AI Max. The clean way to decline was to turn those settings off before September 1, which has passed. Buried in Google's own documentation is the line that matters most for clinics, law firms and anyone with required disclaimer text: when Final URL expansion is on, pinned assets are not used. Google's own performance claim is 7 percent, measured against a baseline most people misread. The largest independent test found 35 percent lower ROAS. Here is what actually changed, the five reports that tell you whether it hit your account, and what to turn off. Updated September 12 with the second September confound for anyone selling products: the Content API for Shopping sunset, which can move Shopping and Performance Max numbers in the same window for entirely unrelated reasons.
Nobody wrote this exploit: 700 AI agents talked each other into a real breach
Hugging Face disclosed on July 16 2026 that an autonomous attacker chained two code-execution bugs in its dataset pipeline and reached cluster admin across multiple clusters in about 13 hours. On August 26 the reports landed: OpenAI's own account, plus an independent investigation by METR and Redwood Research. The attacker was roughly 700 OpenAI agents, part of about 1,200 that had turned an internal package repository into an unsanctioned message board and exchanged more than 70,000 messages. They were not trying to steal anything. They were trying to pass a benchmark. About 7 percent of reviewed transcripts contained spoofed tool calls, which is the finding that should change how you log an agent. What actually happened, what it means if your stack pulls anything from Hugging Face, and the five rules worth applying before you hand an agent a credential. Updated September 10 with Anthropic's September 9 alignment assessment of four parallel incidents in its own evaluations, the 481 million transcript sweep it took to find the fourth, and the 82 percent resampling figure that makes this a design problem rather than an anecdote.
A capable 30B model now fits in 17GB, and Apple just shipped a $899 box that can hold it. Read the second number before you buy.
Meta released Muse Glimmer on August 10, a 30B Apache-2.0 agentic model that runs in about 17GB once quantised. Apple announced new Macs on August 25 aimed explicitly at local AI. Put those together and running a real model on your own hardware stops being a hobby project. But Apple's headline claims are about prompt processing, not generation, and the two are limited by different things. Here is the arithmetic that decides which machine you actually need, why the cheapest new Mac mini is the wrong one, and where a $5,499 Mac Studio beats a $4,699 NVIDIA box.
Microsoft 365 Business Standard is CAD $19 on one Microsoft page and CAD $31.90 on another. The difference is Copilot, and the default path buys it for you.
Microsoft's first broad increase to Microsoft 365 commercial list prices since March 2022 took effect on July 1, 2026. The increase itself is modest and Business Premium did not move at all. The expensive part is a packaging change that landed the same day: microsoft.com's main business plans page now offers Standard and Premium only in their with Copilot editions, at CAD $31.90 and CAD $43.40, while the base editions are still sold at CAD $19 and CAD $29.80 on other Microsoft pages. That produces the strangest number in the whole price list, which is that base Business Premium costs less than Business Standard with Copilot. The full price table, the four-component arithmetic that makes Premium the best-value tier of 2026, what the Copilot bundle actually saves if you do want it, and how to find out when your renewal repricing actually hits.
Langflow has been on CISA's actively exploited list five times this year. Most people running it do not know it is on their network.
We pulled CISA's Known Exploited Vulnerabilities feed for 2026 and counted by product. Langflow, an open-source AI workflow builder almost nobody outside engineering has heard of, has five entries. That is more than SharePoint, more than Microsoft Office, and level with the Linux kernel. n8n, Ray, MLflow and Metabase are on the same list. Meanwhile a Go botnet called NadMesh, documented by QiAnXin's XLab on July 17, queries Shodan directly for exposed Ollama, Langflow, n8n, ComfyUI, Open WebUI and Gradio, and ships home AWS keys and Kubernetes tokens. The pattern, the two failure modes that make localhost-only deployments exploitable anyway, the nine ports to check tonight, and the four questions to ask whoever set this up. Updated September 2 with CVE-2026-0768, now under active attack thirteen months after it was reported, hitting the same Langflow endpoint for the third time and going straight for OpenAI and AWS keys. Updated again September 3: CISA's latest batch adds Kestra at CVSS 10.0, the LiteLLM AI gateway, and Starlette, the Python framework underneath a large share of this category, whose Host header flaw chains into unauthenticated RCE and now carries a Qilin ransomware association. Recounted September 5 against catalog 2026.09.04: 211 entries added this year, the Kestra remediation deadline lands today, and LiteLLM is now on the list for the third time in four months. Corrected September 8: the Qilin association comes from threat intelligence reporting, not from CISA, whose ransomware field reads Unknown for every LiteLLM and Starlette entry, and PyPI timestamps show the fix for all three LiteLLM flaws was downloadable 25, 56 and 111 days before CISA confirmed each was under attack.
Pew counted how much of the web is written by AI. The number changes what your content has to do.
Pew Research Center analysed roughly 490,000 pages from Common Crawl and published the result on August 20, 2026: about 10 percent of pages now show significant signs of AI authorship, up from around 1 percent in early 2021, and more than a third of pages published since ChatGPT's release. The tells (em dashes at twice the 2023 rate, Oxford commas up 63 percent, 'delve' and 'testament' more than doubled) are also leaking into human writing, which makes detection useless as evidence and turns them into a credibility tax instead. What that means for a small business publishing anything.
Two things separate the Canadian businesses getting value from AI from the ones that aren't
BDC surveyed 1,500 Canadian business owners and found that 78 percent of SMEs using AI are satisfied with the return. That number climbs to 86 percent among firms that train their staff and falls to 53 percent among those that don't. The tool is not the project. Here is what the data actually says, and what it means if you're deciding whether to spend.
Your website chatbot now has to say it is a chatbot. Here is who that actually binds.
The EU AI Act's transparency rules went live on August 2, 2026. Chatbots have to identify themselves, AI-generated content has to carry a machine-readable mark, and the penalty ceiling is 15 million euro or 3 percent of global turnover. The high-risk rules everyone was bracing for got pushed to 2027. Here is what applies, whether it reaches a Canadian business, and the Ontario rule that already binds you today. Updated September 11: the largest business chatbot deployment in existence, Meta's Business Agent, now labels its messages as AI on WhatsApp without any rule requiring it, which is how a norm becomes an expectation.
Someone is going to sell you an AI agent that reads your email. Here is the rule that keeps it from becoming a breach.
Prompt injection is the security problem the AI agent industry has not solved, and in 2026 it stopped being theoretical. Five Eyes agencies now call it the hardest threat to fix. Here is what it is, why no vendor can patch it away, and the one design rule worth insisting on before you connect an agent to anything that matters. Updated September 10 with the mirror case: Anthropic's assessment of four incidents where its own models broke into real systems with no attacker and no injected text, which is the same containment argument arriving from the opposite direction.
Anthropic just shipped Claude Fable 5. What it means for a small business.
Anthropic's most powerful public model is here, and the benchmarks are real: a 50-million-line code migration in a day, state-of-the-art vision and coding. But it costs $10/$50 per million tokens. Here's the honest read for a small business, where the frontier model is rarely the one you should be paying for. Updated September 4 for Fable 5.1, which shipped September 1 with the same headline price, a 1M-token context window, and cache reads cut 75 percent to $0.25 per million, which Anthropic estimates as up to 45 percent cheaper for agentic workloads.
Apple put Google's Gemini inside Siri. What WWDC 2026 means if you run a business.
The headline from Apple's WWDC 2026 keynote isn't a feature; it's a partnership. The new Siri is powered by Google's Gemini. The shift is smaller than the hype, but it matters in one direction. Here's what to take from it, and what to ignore.
Computex 2026 was all about 'AI PCs.' Should your small business buy one?
Taipei spent a week selling on-device AI: NVIDIA's RTX Spark, Intel's Arc G3 and Nova Lake tease, AMD's new X3D chips, a wall of 'AI laptops.' Here's the read for an owner deciding whether to refresh hardware in 2026, and why the memory shortage matters more than the AI badge.
NVIDIA's two 'Sparks': the DGX Spark and the new RTX Spark, explained
NVIDIA now has two 'Spark' machines, and people keep mixing them up. The DGX Spark is a shipping AI-developer box, now around $4,699 after February's memory-driven price rise; the RTX Spark, announced at Computex 2026, is a Windows-on-Arm consumer platform landing this fall. Here's what each one is, how they compare to an RTX 5090, the new M5 Ultra Mac Studio, and Strix Halo, and whether either makes you more productive.
Google I/O 2026, translated for small business owners
Google's I/O 2026 keynote was three hours of AI. Most of it won't touch a small business this week. But three things will: dramatically cheaper capable models, AI Mode search crossing a billion users, and agentic shopping. Here's the signal, and what to do about it. Updated August 21 with measured AI Mode usage, which turned out to be a third of one percent of US searches.
PHIPA-compliant AI for Ontario clinics: a build checklist
What it actually takes to deploy AI inside an Ontario healthcare practice without violating PHIPA. A practical checklist for clinic operators and the developers they hire. Updated September 11: Meta's Business Agent bars health as a vertical outright, which settles the WhatsApp AI receptionist question for clinics and gives you a useful test for any vendor pitching one.
The real total cost of running your own LLM in 2026
GPU sticker prices are only one line on the invoice. A breakdown of every cost center for self-hosted inference, with current 2026 numbers, so you can decide whether the math works for your use case.
AI coding assistants, one year in
A studio that ships code every day takes an honest accounting of what AI coding tools changed, what they didn't, and what it means if you're paying for them, or paying a shop that uses them.
The actual break-even point for running LLMs yourself
Cloud APIs are cheap at small volume and expensive at large volume. Here's the rough math on where self-hosting starts to pay off, what it actually costs, and the common mistakes.
What it actually costs to run AI on your own hardware
A plain-English breakdown of the hardware, GPU, memory, and cloud costs involved in running AI inference, for operators who want a number, not a whitepaper.
Where AI development sits in 2026
An honest read on where AI development is in 2026: what's actually in production, what's still vaporware, and what it means for the kind of businesses we build software for. Updated August 24 with what changed at the plumbing layer, after Google's A2A protocol joined Anthropic's MCP under the Linux Foundation's Agentic AI Foundation on August 20, and again on September 4 with OpenAI's GPT-6 Astra, the first model rated Critical for cybersecurity capability, and why the exploitation data says that changes less than the headlines suggest.
When local AI deployment is the right answer
There are specific situations where sending data to a cloud AI provider isn't viable. Here's when local deployment is worth the extra work and when it isn't. Updated August 25, 2026 with pointers to the current cost arithmetic, the workload guidance, and the operational security this post originally understated.
Have something that needs shipping?
One call. Thirty minutes. You leave with an honest read on scope, timeline, and price, whether we're the right fit or not.