Weekly Roundup: Budget AI Models Shake Up the Market, and Why Security Patching Just Got Urgent
It’s been a busy week in tech, with budget AI models making waves, some worrying security tests, and a government data leak that’s left professionals shaking their heads. Here’s what you need to know.
Budget AI Model Takes on ChatGPT at a Fraction of the Price
Chinese AI startup MiniMax dropped its M3 language model over the weekend, and the pricing has turned heads across the industry. For around $20 per month, it’s offering performance that reportedly matches or exceeds the latest models from OpenAI and Google on several benchmarks—all whilst costing just 5-10% of what enterprise users typically pay for comparable access.
The M3 comes with a massive one-million-token context window (think of it as how much text the AI can “remember” during a conversation) and can handle images, text, and code natively. For comparison, that’s the kind of capability you’d normally expect from premium subscriptions to services like ChatGPT Plus or Claude Pro.
What this means for you: If you’re a small business currently paying for ChatGPT Team or similar AI tools for content writing, coding assistance, or customer service, this aggressive pricing from newer competitors could spark a price war. We’d expect to see established players dropping their subscription costs or adding more features to justify premium pricing. Worth keeping an eye on before renewing annual subscriptions.
AI Assistants Can Be Hijacked More Easily Than We Thought
Security researchers testing Anthropic’s Claude browser agent—an AI that can actually navigate websites and perform tasks on your behalf—found it could be hijacked through prompt injection attacks 31.5% of the time before safety systems kicked in. That’s nearly one in three attempts succeeding.
Prompt injection is when malicious instructions hidden on a webpage trick an AI agent into doing something it shouldn’t—like sending sensitive data elsewhere or executing unauthorised commands. What’s particularly concerning is that other major AI companies (OpenAI, Google, Meta) haven’t published comparable vulnerability figures, leaving security professionals in the dark about how their systems perform under similar testing.
What this means for you: If you’re using AI tools like Grammarly, Notion AI, or any browser-based AI assistants, be cautious about letting them access sensitive company data or financial information. These tools are brilliant for productivity, but the technology is still maturing when it comes to security. Treat AI assistants like you would a junior employee—helpful, but requiring oversight on sensitive tasks.
Government Agency Accidentally Exposed Critical Security Keys
In what’s being called one of the most serious government data leaks in recent memory, a contractor working for the US Cybersecurity & Infrastructure Security Agency (CISA) left highly sensitive credentials publicly accessible on GitHub—the popular code-sharing platform—until just this past weekend.
The exposed data included access keys to privileged government cloud accounts and detailed information about how CISA builds and secures its internal systems. It’s a bit like leaving the keys to a bank vault on a public noticeboard, along with detailed floor plans and alarm codes.
The irony isn’t lost on anyone that this happened to the very agency responsible for cybersecurity guidance. But it highlights a broader issue: even organisations with top-tier security expertise can fall victim to basic configuration mistakes.
What this means for you: This incident underscores why basic security hygiene matters, regardless of your organisation’s size. If you’re using cloud services or GitHub for your business, review who has access and what’s being shared publicly. Consider using a password manager like NordPass to handle complex credentials securely, and enable two-factor authentication everywhere possible. The fundamentals still matter most.
AI Can Now Exploit Security Flaws Faster Than Companies Can Patch Them
Research earlier this year showed that AI models could exploit 87% of known security vulnerabilities when given their technical descriptions—but couldn’t discover vulnerabilities independently. That safety margin has reportedly narrowed with newer AI capabilities, raising concerns that the traditional patching timeline (often weeks or months) is becoming dangerously inadequate.
For small businesses, this creates a real challenge. Enterprise-grade patch management systems are often too complex and expensive, but leaving systems unpatched is increasingly risky when AI tools can potentially automate exploitation.
What this means for you: Enable automatic updates wherever possible, particularly for operating systems, browsers, and security software like antivirus tools (whether that’s Windows Defender, Intego for Mac users, or similar). For remote access tools like Splashtop or VPN services like NordVPN, check you’re running the latest version. The window between a vulnerability being announced and being actively exploited is shrinking.
That’s Your Week in IT
The common thread this week? AI is simultaneously becoming more accessible and more concerning from a security perspective. Budget models are democratising powerful capabilities, but the same technology is also being used to probe defences. Meanwhile, even cybersecurity agencies aren’t immune to basic configuration errors.
For home users and small businesses, the takeaway is clear: keep systems updated, use strong authentication, and treat AI assistants as useful tools that still require human oversight. The fundamentals of good security haven’t changed—they’ve just become more urgent.