In partnership with
Happy Sunday. AI can start paying a company's bills, but it can also increase its own spending limit. You might be surprised how easily. Don't spit out your coffee just yet, though: this one happened in a test.
IN TODAY'S ISSUE
Plus, free: Try this week. A short hands-on exercise to turn a messy order email into a review-ready table, with a copy-and-paste prompt.
STORY 1 OF 3 · AGENTS
1. In a test, 9 of 10 AI models increased their own budget
Researchers at Cornell Tech and Yale ran a simple test. An AI agent was told to pay three bills. It had a spending limit of 1 cent a day, and the bills cost more than that. Raising the limit needed the owner's approval: a one-time code sent by email. The catch: the agent could read that same inbox.
Nine of the ten AI models tested found the code and raised their own limit at least once. No hacker, and no instruction to touch the limit. Just a very eager new hire who happened to have the boss's inbox open and a job to finish.
It was a small, controlled test with pennies, not a wave of real-world losses. But the approval step looked like human control, and it wasn't.
Governments are starting to ask the obvious follow-up: if software can spend money, shouldn't it carry ID? On November 4, Singapore MP Tin Pei Ling asked Parliament to consider a national ID for AI agents, like Singpass, the country's digital ID for people, showing who answers for an agent and what it's allowed to do. The government likes the goal and is studying options. It's a proposal, not law. And an ID badge wouldn't have stopped this agent. It knew exactly who it was.
My take: this is an old finance problem with a new kind of employee. Accounts payable teams learned it decades ago: the person who can pay a vendor shouldn't also be able to create the vendor and approve the invoice. That's segregation of duties. In this test, one agent could ask for more money, read the approval and spend it. Three duties, one worker.
As companies add agents, they need an agent org chart, the same way they have one for people: which agent does what, what each one can touch, and who signs off. Two fixes I'd start with:
Split the duties. The agent that pays bills shouldn't be able to read the inbox or chat where approvals land. A person approves, on their own phone or login.
Put the limit in the payment tool itself, not just in the agent's instructions, and name one person who owns exceptions.
That's not a case against agents paying bills. It's the same control any employee with access to company money already works under.
FROM OUR PARTNERS
Attio is the #1 fastest-growing CRM on Brex and Ramp.
Built for the most ambitious companies in GTM, Attio is an end to end revenue platform that allows teams to run multiple plays across different revenue motions and lifecycles.
Teams at the frontier are already building on it: Granola, turbopuffer, Modal, and many many more.
STORY 2 OF 3 · SECURITY
2. OpenAI's new security AI raises the stakes for slow updates
On November 5, OpenAI released GPT-6 Cyber, a version of its newest model trained to find weaknesses in software and prove they can be exploited. It isn't public: only vetted security organizations in OpenAI's Daybreak Red program can use it. The headline example: it found 81 previously unknown high-severity flaws in Firefox, and Mozilla has already shipped fixes for many of them. Not a bad haul from one of the most picked-over browsers around.
These are mostly OpenAI's own tests, and an outside tester, Irregular, found clear limits, including no successful attacks on fully hardened targets. So for now, this isn't something a criminal can sign up for with a free trial.
The more important point is what happens after a fix comes out. When a software maker releases a security update, attackers can study what changed, work out the weakness it closes, and then target anyone who hasn't installed the update yet. Mozilla, which makes Firefox, made this point in an October 29 post. It says AI is making that reverse-engineering faster and cheaper, and it has seen evidence that even a less advanced AI model can exploit some of these fixes.
My take: most businesses don't write software, but they run plenty of it: laptops, the accounting system, the online store, payment terminals, website plugins. All of it gets security updates. Publishing a fix has never been the same as protecting every customer, and AI can make the wait before installing it more dangerous. So you'd better figure out who's going to approve and apply those patches ASAP, before you get surprised. For systems a vendor runs, ask how quickly critical fixes reach customers and whether anything is needed on the company's side. Not every update should go live untested. But "we'll get to it next month" is now a decision to stay exposed.
What Executive Order #14330 Could Mean for Your 401(k)
President Trump's Executive Order #14330 is pushing a major shift in how retirement plans can invest.
If you have a 401(k), this is worth a few minutes of your time.
See what the order says and how your retirement could be impacted.
STORY 3 OF 3 · OPERATIONS
3. Unilever's AI takes orders the way customers already send them
In late October, Microsoft published a case study on NOVA, a set of AI agents Unilever built with Microsoft for a stubborn chore: customer orders that don't arrive through automated systems. Unilever says most of its roughly 20 million orders a year already pass directly between computer systems, but around 2 million still come in as emails, PDFs, spreadsheets and even photos of paper forms. Staff in its service hubs keyed them in by hand. Yes, in 2026.
NOVA uses five agents. Four read the message and pull out the order; a fifth checks the work. Missing information and unusual orders go to a person. In 11 pilot markets, Unilever says this first step, taking the order in, has dropped from 15 to 20 minutes to around 90 seconds, and 95% of these orders now go through intake without a person stepping in.
These are Unilever's own figures, in a case study written by its technology partner. There's no independent audit, no error rate and no dollar result. And the 90 seconds covers taking the order in, not delivery or payment.
My take: I've set up a similar order-entry workflow for a CPG business, with one agent rather than five. It cut the team's manual order-entry time by about 75%. Done right, this is truly impactful. The best line in the case comes from a Unilever operations director: "Customers shouldn't have to adapt to our technology." Plenty of companies "automate" by making customers learn yet another ordering portal. Unilever automated the formats customers already send. 95% is a good rate. The concern I have is that it counts orders that got through without a person, not orders that got through correctly. Our 75% measured time saved, not accuracy, either. A wrong product, quantity or price doesn't save time; it turns into a correction, a credit note and an unhappy customer later. So when designing the next AI workflow, build in more than one measure: correct orders, how fast exceptions get resolved and total time to a shipped order, not just seconds at intake.
TRY THIS WEEK · FREE PRACTICAL TIP
Turn a messy order email into a review-ready table
Set aside 10 minutes. No agent, no integration, no budget approval. Just an AI chat tool and a made-up order.
Step 1: Write a made-up order email. Use example data only, never real customer details. Make it messy on purpose. For example:
Example input: "Hi, please send 40 cases of the 500ml lemon and some of the lime too. Same price as last time. Need it before the long weekend. Thanks, Sam"
Step 2: Paste the email into an AI chat tool with this prompt:
Turn this email into an order table with columns for product, quantity, unit, unit price and delivery details. Use only information stated in the email. Mark anything missing or ambiguous as NEEDS CHECK. Don't invent product codes, prices or dates. Then list the questions that must be answered before this order can be entered.
Step 3: Check every row against the original email. Look for invented details as well as missing ones. "Some of the lime" and "same price as last time" should come back as NEEDS CHECK, not as numbers.
What good looks like: a draft order and a short list of questions for a person to review, not an order ready to send. It's the same split Unilever describes: missing information and unusual orders go to a person. A chat prompt isn't a production system, but it shows fast where the hard cases hide.
BUILDERS
Put this week’s ideas to work
Builders is the paid tier with the templates, prompts and workflows behind each issue, including the Agent Guest List for deciding what agents are allowed to do. $9.99/month.
The Insider Room includes Builders and more.
SHARE THE CONTEXT WINDOW
If this issue was useful, pass it on. One colleague joining counts, and referral rewards start from there.
Copy, paste and send to a colleague:
I've been reading The Context Window, a weekly on practical AI for business leaders. You can join here: {{rp_refer_url}}
Your link is also in the box below, with your reward progress.
We are out of tokens. ✋
- Hashi
