>gabes/the letter
// the weekly letter · issue 09 · aug 24 to 28

five signals.
one week.
nobody kept
the list._

twenty four hundred a year in tools that nobody bought on purpose. six hundred and thirty billion of somebody else's capacity bill heading for your invoice. an agent taking orders from a web page. forty three percent of companies who cannot say what ai they are running. and a bot that closed no sales and took eighteen million. five stories about a list nobody wrote down.
01movemonday

the average small business spends about $2,400 a year on ai. the real number is nearer $5,000 once somebody has to learn it.

nobody bought a stack. it accumulated, one seat at a time, each charge small enough to approve without thinking.

smb ai adoption hit 66 percent this summer against 55 percent a year ago, a third of owners are spending more than they were twelve months back, and average direct spend sits near $2,400 a year against a true cost closer to $4,000 or $5,000 once training hours and integration upkeep are counted.

the condition underneath the number is that nobody ever made a purchasing decision here. a seat went on a card in march. a second tool arrived on a trial that converted. every individual charge stayed under the amount that triggers a conversation, so no conversation happened. the cost is not the line item. it is two tools doing the same job with different data inside them, a third configured halfway and abandoned, and a team that cannot tell you which one is the system of record.

the fake fix is consolidating onto one bigger platform, which swaps four small unexamined charges for one large one and moves the same confusion inside a single vendor. do the version that holds: pull ninety days of card and bank statements, list every ai charge next to the date anyone last opened it, cancel everything untouched in thirty days today, and for each survivor write the one job it does and the one person who owns it. the audit takes an afternoon and it is the only spend review that also tells you what your business actually runs on.

dopull ninety days of statements, list every ai charge with the date it was last opened, cancel the untouched ones today, and put one name on every survivor.
not thisdo not consolidate onto a bigger platform. that swaps four unexamined charges for one large one and moves the confusion inside a single vendor.
the number is not the problem. not being able to produce the number is the problem, and it takes an afternoon to fix permanently.
receiptsmb ai adoption 66 percent this summer against 55 percent a year earlier · average direct spend near $2,400 a year, true cost $4,000 to $5,000 once training and integration upkeep are counted · a third of owners spending more than twelve months ago
shipped monday · read it as it shipped →
02traptuesday

the four biggest cloud companies are budgeting up to $630 billion on ai capacity this year, up from $388 billion. that bill comes back out of somebody's invoice, and it is not theirs.

you wired a live process to a meter you do not control, at a price the vendor set to win you.

big four capital spending for 2026 is running near $630 billion against $388 billion last year, roughly a 62 percent jump, with about three quarters of it going into ai infrastructure. meta has already raised its own range twice on component and data centre costs.

the condition underneath the number is that most companies attached ai to something that matters, quoting, drafting, support triage, at introductory usage pricing with no contractual ceiling and no way to run the process without it. the cost lands twice. there is the invoice. and there is the fact that a 40 percent price move is no longer a negotiation, because the manual version of that workflow has not been run by anyone in eight months and nobody currently employed remembers how.

the fake fix is shopping vendors at renewal, which takes a quarter, moves your data onto a different meter you also do not control, and assumes the next company is not funding the same capacity bill. do the version that holds: for every ai tool sitting on revenue or payroll, write down this month's actual usage, what a doubling costs you, and whether the work can run manually for two weeks if it had to. then ask for a capped rate over a multi year term at renewal and keep your exports current, so leaving is a decision you make in a week rather than a project you cannot afford to start.

dofor every ai tool on revenue or payroll, write this month's usage, the cost of a doubling, and whether the work can run manually for two weeks.
not thisdo not plan to shop vendors at renewal. that takes a quarter and moves your data onto a different meter you also do not control.
leverage is not the price you negotiated. it is whether you can still run the week without them.
receiptbig four 2026 capital spending running near $630 billion against $388 billion in 2025, about a 62 percent increase, roughly three quarters directed at ai infrastructure · meta has raised its own capital range twice this year on component and data centre costs
shipped tuesday · read it as it shipped →
03warningwednesday

every ai browser tested at black hat fell to the same trick: a hidden line of text on a page, and the agent takes its orders from the page instead of from you.

it is already logged into your email and your card is already on file. the instruction it followed was not written by anyone you employ.

researchers at black hat usa this month reported that every ai browser they analyzed was vulnerable to prompt injection, opera's ai browser, perplexity comet and chatgpt atlas among them. brave's own researcher put it plainly: there is no clean fix for this yet.

the condition is structural rather than a bug somebody patches on tuesday. an agent that browses for you cannot reliably separate the page's content from your instruction, so invisible text on a supplier site, a review page or an email preview becomes a command it runs inside your logged in session. the cost is not a stolen password, which is what your controls were built for. it is a purchase placed, a form submitted, a document shared out of your drive, every action correctly authenticated as you, which means neither your bank nor whoever handles your it sees a problem until the statement arrives.

the fake fix is telling the team to point the agent only at sites they trust, which holds until the first trusted site carries a comment field, an ad slot or a supplier's pdf. do the version that holds: give the agent its own browser profile with no saved cards, no password manager and no session on email, banking or payroll. keep the accounts that move money in a separate browser the agent never opens. require a human click before anything spends, sends or shares. let it read the web for you. do not let it hold the card while it does.

dogive the agent its own browser profile with no cards, no password manager and no session on money, and require a human click before anything spends, sends or shares.
not thisdo not rely on pointing it at trusted sites only. that holds until the first trusted site carries a comment field, an ad slot or a supplier's pdf.
the agent is not compromised in any sense your security tooling recognises. it is doing exactly what it was told, by somebody who is not you.
receiptblack hat usa 2026: every ai browser analyzed found vulnerable to prompt injection, including opera's ai browser, perplexity comet and chatgpt atlas · brave researcher on record that no clean fix currently exists
shipped wednesday · read it as it shipped →
// the week's argument

write the list.
put a name on each line.
cancel what nobody claims.

every signal this week is the same missing artifact. the charges nobody totalled. the meter nobody capped. the agent nobody scoped. the inventory nobody kept. the seller nobody checked. none of it needed software to prevent. it needed one page with names on it, and in every case the page did not exist.
04truththursday

43 percent of companies cannot produce an accurate list of the ai already running inside their own business. they are paying for all of it.

the part finance never budgeted runs 4 to 9 percent of software spend, and every one of those tools has a login, a card and a copy of your data.

the 2026 numbers put 43 percent of organizations in the position of not being able to answer a basic question: what ai are we running. the spend is the smaller half of it, 4 to 9 percent of the software line, real money but survivable.

the part that matters is that each unlisted tool is an account somebody opened with a work email, a card on file nobody reconciles, and a pile of customer records sitting inside a vendor you never diligenced. that is also why 82 percent of workplace genai use runs through personal accounts your it people cannot see. the exposure is not the subscription. it is that your customer list has been copied into somewhere you cannot name, by somebody who was trying to do their job faster.

the fake fix is an ai policy, because a policy is a document and the tools are a fact. do the version that holds, and it takes an afternoon: pull the card statements and the sso logs, list every ai tool by name, put one person's name against each one, cancel the orphans, move the survivors onto managed accounts. you cannot govern an inventory you have never written down, and nobody is going to write it down for you.

dopull the card statements and the sso logs, list every ai tool by name, put one person against each, cancel the orphans and move the rest onto managed accounts.
not thisdo not write an ai policy first. a policy is a document and the tools are a fact, and the document does not know what the fact is.
governance starts as a list. everything people call governance before the list exists is a meeting.
receipt2026: 43 percent of organizations cannot produce an accurate inventory of ai tools in use · unbudgeted ai runs 4 to 9 percent of software spend · 82 percent of workplace genai use runs through personal accounts outside it visibility
shipped thursday · read it as it shipped →
05absurdfriday

an ai company sold small businesses a bot that would close their sales. the ftc banned the owners in march, entered an $18 million judgment, then suspended most of it because there was nothing left to collect.

the bot was never the product. the earnings claim was, and it worked well enough to take millions before anyone asked to see a customer.

the ftc's order describes the standard shape: a tool wrapped in an income promise, a refund policy that did not survive contact with a refund request, and buyers who paid up front for a business rather than for work.

the money is mostly unrecoverable, which is the part worth internalizing. a suspended judgment means the regulator agreed you were robbed and also that you are not getting paid. this category is expanding right now, because anyone can put a chat window on a landing page and call it infrastructure, and the demos are excellent for the simple reason that demos are the only thing they build.

the fake protection is more diligence on the technology, watching the demo twice, asking which model it runs on. the technology is not what fails. run one test instead: make the seller name a number already in your p&l, say how much it moves and by when, and hand you two customers in your industry who have run it for six months. if the pitch is the income rather than the work, it is a business opportunity scheme with a chatbot on the front, and the ftc will reach it about eighteen months after your card clears.

domake the seller name a number already in your p&l, how much it moves, by when, and two customers in your industry six months in.
not thisdo not diligence the technology harder. the technology is not what fails, and watching the demo twice is not a second opinion.
a suspended judgment is the regulator agreeing with you in writing, on the record, about money you will never see.
receiptftc, march 2026: owners banned from selling business opportunities, $18 million judgment entered and largely suspended for inability to pay · order cites an ai sales bot marketed with income claims and a refund policy that failed on contact
shipped friday · read it as it shipped →
// the signal daily, the letter weekly

five charges.
five owners.
none of them named.

one signal a day, monday to friday, public. the letter every friday, the same hour the fifth signal lands: the week compiled, connected, and pointed at what to do. no quizzes, no funnels, no webinar.
good. fridays, then. bring us the part that keeps breaking.
>gabes · operating systems for companies done improvising · issue 09 · past signals →