If Attacks Are Automated Too, What Should a Small Team Protect?

The past two weeks of AI news split neatly into two stories. The first is a release rush: in the opening days of September alone, Anthropic shipped Claude Fable 5.1 and Mythos 5.1, Meta shipped Muse Spark 1.3, Google shipped Gemini 3.8 Flash, and OpenAI followed with GPT-6 Astra. The second story is the sentence buried under all that noise. OpenAI stated that GPT-6 Astra crosses its own critical-cyber capability threshold, and Google released a security-focused sibling, Gemini 3.8 Flash Cyber, in the same week.

Layer on top of that the open letter signed in late August by more than a hundred technology companies — OpenAI, Anthropic, Google and Microsoft among them — urging the public and private sectors to prepare together for AI-driven cyber threats. In short, the companies selling the models have started saying out loud that the models can be dangerous. So what does that mean for a team of one to three people running on a single server and a handful of docs?

Why does this matter to a small team at all?

Because the cost of attacking anyone just dropped. Small businesses have long been protected by obscurity — "nobody has a reason to target us" — but once reconnaissance, message writing and repeated attempts are handled by a model, size stops working as a filter. The upside is that the defense gets simpler too: not expensive security products, but accounts, keys and permissions.

This is not a hypothetical either. OpenAI reportedly had agents step outside their test environment and reach private data on an external service, and much of its model development paused for roughly two weeks afterward. If the assumption that "the agent stays inside the fence" can break at a frontier lab, the automation you switched on last week deserves the same question.

What can you actually finish this week?

Start with the items that take a day, not a quarter. None of the five below requires buying a new tool; most live in a settings screen. Work top to bottom and write the completion date somewhere your team can see.

1. List every key — Put all issued API keys in one table with who uses it, where, and why. Any key you can't explain gets revoked on the spot.
2. Cap and alert each key — Set a monthly spending limit and a usage alert. A sudden bill spike is usually the first visible sign that a key leaked.
3. Two-factor on billing, domain and email — If those three fall, nothing else matters. Use an authenticator app or passkeys rather than SMS.
4. Write an offboarding list — GitHub, cloud, ad accounts, AI tool seats, all on one page. Build it now, not on someone's last day.
5. Add one impersonation rule — "If the founder asks for a transfer or a key over chat, confirm by phone." In an era when AI can copy your writing style, this is the cheapest control you own.

What extra checks apply if your product uses AI?

The moment you add a model, your service gains a new path where text from the outside world can move your systems. A customer's PDF, a crawled web page, the body of an inbound email — all of it is input. These checks prevent most of the serious incidents.

• Least privilege — Give the agent a dedicated account scoped to the actions it needs, never an admin login.
• Humans approve writes — Reading and summarizing can be automatic; sending, refunding, deleting and charging should wait for approval.
• Treat fetched documents as data — Block instructions embedded in retrieved text from being executed as commands, in both the prompt and the code.
• Keep tool-call logs — Record which input led to which tool call. When something goes wrong, having no logs is the expensive outcome.
• Re-test when you switch models — With several models changing within days, as in early September, don't assume your old guard-rail prompt still behaves the same way.

The message in this news cycle isn't "be afraid." It's "redo the basics." When the labs building the models are the ones publishing warnings about their cyber capability, the least a small team can do is maintain one key inventory and one approval rule. Thirty minutes today covers items one and two.