The finance assistant that caught a mistake, and the chatbot whose password was 123456

Efficiency

Let your accounts software watch the numbers

The problem. Haneker, a London architectural joinery firm, had grown to the point where its money information lived in emails, spreadsheets and paper delivery notes. Nobody was watching it day to day.

What they did. They switched on Sage Copilot, the AI assistant inside their accounts software, to keep an eye on the numbers and flag anything unusual.

The result. It flagged a spike in supplier costs. That led them to an ordering error that, managing director Margaret Sadzynska says, would otherwise only have come to light at month-end.

The honest bit. Haneker gave no pound figures, and the story was published by Sage itself. Treat it as a good example of what to ask for, not proof of savings.

Risk

Change the default password. All of them.

What happened. McDonald’s used McHire, an AI chatbot hiring platform supplied by Paradox.ai. In 2025 two security researchers, Ian Carroll and Sam Curry, found its admin page still accepted a default login with the password “123456”. Combined with a second flaw, that let them reach the chat records of more than 64 million job applications, including names, email addresses and phone numbers.

What went wrong. Nobody hacked anything clever. A setting that came with the tool was never changed. McDonald’s says the problem was fixed the same day it was reported.

Why a small firm should care. Small businesses sign up for AI and software tools quickly, often with default settings and nobody checking. The legal duty to protect applicants’ and customers’ data does not shrink with your headcount.

The honest bit. The 64 million figure counts applications, not unique people, and the researchers reached the data to prove the flaw; it hasn’t been shown that anyone else did. The lesson doesn’t depend on the numbers.

Prompt of the week

Warn your staff about a scam in 60 seconds

The problem. Fraudsters impersonate the owner and ask staff to buy gift cards or make urgent payments. A clear, calm warning goes out late because nobody has time to write it.

Write a short internal alert telling staff about a fake message that appears to come from me and asks them to buy gift cards. Tell them not to reply or click links, and to confirm with me directly if they're unsure.

Before you use it. Use a channel your staff already trust, and don’t paste the suspicious email itself (links, headers) into a public AI tool.

Source: Adapted from Bitdefender

What changed in the tools

Google’s new Gemini can work while you’re away, and guesses less

Google’s top model, Gemini 4 Argon, reached the Gemini app on 13 October for paying Google AI Pro and Ultra subscribers. The part that matters for a small business is tasks: hand Gemini a job and, Google says, it “can work for you even when you’re not at your computer”.

The more useful finding comes from independent testing: when Argon didn’t know an answer, it made one up 15% of the time, against 51% for OpenAI’s GPT-6 Astra. Fewer confident wrong answers means less checking, though not none.

What to ignore. Google’s own benchmark table, which puts Argon ahead of its rivals. The independent tester Artificial Analysis rates it level with GPT-6 Astra overall, not ahead. And the cheap introductory price for businesses building on it will double; Google hasn’t said when.

Sources: Google: Gemini 4 Argon in the Gemini app (published by a company that sells the product or service) · Artificial Analysis independent evaluation