Security firm Claroc reported this week that it found more than 6,800 share links for Meta's Muse AI assistant in public DNS records, because Muse built each link's web address from the conversation's title plus a random ID, and exposed pages included a marketing company's revenue review, a small business owner's loan application and a workplace's full-year staff calendar. Meta said on Oct. 20 that it has paused Muse's sharing feature while it reviews the report and considers changes to how the links can be discovered.

The direct effect is small. Few 10-to-50-person businesses run work through Muse. The useful lesson applies to every AI chat tool your staff use: a 'share' link is a web page anyone with the address can open, with no password. Claroc found Muse put a description of each chat in that address, and the address leaked into public records. ChatGPT, Claude and Grok chats have also ended up on Google Search in the past. Worked example: a 16-person accounting firm where 5 staff use personal AI chat accounts for work. If one pasted a client's loan details into a chat and shared the link with a colleague, a stranger could read it. Asking the team takes about 30 minutes. Reviewing and deleting shared links takes about 15 minutes per user, so roughly 1.25 hours for 5 people. Who should care: firms that handle client financial, legal, medical or HR data. Who can ignore it: shops where nobody uses AI chat tools for work, or where sharing is already restricted on a company account.

On Oct. 20, 2026, the Department of Homeland Security published an order directing federal civilian agencies to stop buying DeepSeek products and services and to remove them from government IT systems, citing concerns that U.S. government data could be accessible to Chinese authorities under Chinese law. The order also covers third-party products and services built using DeepSeek technology, and agencies can request exceptions.

The order binds federal civilian agencies, not private businesses, so for most readers the effect is small. It matters if you sell to those agencies, because the ban reaches third-party products built on DeepSeek technology, not just DeepSeek's own app. Example: a 28-person electrical contractor with a $350,000 subcontract on a federal office renovation uses an AI estimating add-on and a chatbot on its website. Neither touches agency IT systems, so the order does not apply to them directly. But if the contractor supplies software or hosted services to the agency, or a prime contractor sends a supply-chain questionnaire, it will need to say whether any tool runs on DeepSeek. Finding out takes about an hour: list your AI tools and automations and email each vendor asking which models they use. Some automation and chatbot tools let users pick a DeepSeek model, so check your own settings too. Shops with no federal work can ignore this. DHS's data concern is still a fair prompt for any firm holding client data to know where its AI tools send it.

OpenAI began rolling out Locked Chats in ChatGPT on Oct. 20, 2026, letting users hide conversations behind a four-digit PIN or Face ID/Touch ID on the Free, Go, Plus, Pro, Business, Enterprise and Edu plans, but not on ChatGPT for Healthcare. OpenAI says locking does not add end-to-end encryption, change how long chats are retained, remove anything Memory already holds, or change the "Improve the model for everyone" setting, and resetting the PIN permanently deletes all locked chats and files.

The effect is small. This is a screen-privacy feature, not a data-protection control. Locked chats move out of the sidebar, pinned list and search into a separate section, so they don't show when someone looks over your shoulder.

Take a 14-person accounting firm with 6 staff on ChatGPT Business. A partner drafts a staff performance review on a laptop she turns toward clients during meetings. Locking that chat keeps it off the screen. That is the whole benefit.

Client tax figures pasted into a locked chat are stored, retained and handled exactly as before. Locking a chat does not make it safe to paste anything you would not paste into a normal chat.

The main risk runs the other way. If a bookkeeper locks 40 client-memo chats, forgets the PIN and resets it, all 40 chats and their files are permanently deleted.

Who should care: people who share screens or devices. Everyone else can ignore it.

On Oct. 19, 2026, the U.S. Department of Labor said it obtained a consent judgment requiring Coway USA Inc., a California-based home appliance company, to pay $800,000 in back wages and damages to 339 employees. The Wage and Hour Division found Coway paid employees on a piece-rate basis and did not pay them for mandatory meetings, picking up and loading supplies, or work before and after shifts, in violation of the Fair Labor Standards Act.

Drafted from the DOL release excerpt; the full page did not load. No law changed, so for most owners the effect is small. This is a reminder, not a new rule. Coway's bill averages about $2,360 per worker. It matters if you pay techs, cleaners or crews by the job, flat rate or piece rate. Under federal law, meetings, loading the truck and pre-shift work count as hours worked, and piece-rate overtime is figured on all of them. Example: a 20-person plumbing shop has 8 flat-rate techs who each earn $1,200 a week and log 45 job hours, plus 5 unlogged hours at the shop. Counting all 50 hours, the overtime premium is $120 a week (half of $24 × 10 hours). Counting only 45 hours, it is $66.67. That gap is $53 per tech a week, about $21,300 a year across 8 techs. Two years of that, doubled by liquidated damages, is about $85,000. If your people are hourly and clock in when they arrive at the shop, you can ignore this.

On Oct. 19, 2026, the Labor Department's Wage and Hour Division issued Field Assistance Bulletin No. 2026-1 on how related duties performed by tipped employees are treated under the Fair Labor Standards Act. The bulletin withdraws the division's 1979, 1980 and 1985 opinion letters on applying dual jobs regulations to tipped employees, which the division says brings its guidance into line with current regulations.

Facts are thin: the full DOL release returned an error (HTTP 403), so this draft works from the announcement excerpt and does not describe the bulletin's replacement guidance. The dual-jobs rules decide when a tipped worker's non-tipped tasks, such as setup or cleanup, can still be paid at the tip-credit rate. They only apply if you claim a tip credit, which means paying a cash wage below minimum wage and counting tips to make up the difference. The federal floor is $2.13 an hour against a $7.25 minimum, a gap of up to $5.12 an hour. Several states ban the tip credit entirely. Take an 18-person residential cleaning company whose customers tip through the booking app. If it pays every cleaner at least minimum wage before tips, nothing here changes. If it claims a tip credit for 18 cleaners working 30 hours a week, it counts up to $2,765 a week of tips toward wages, and that is the amount at risk if task-splitting is handled wrongly. Owners of HVAC, plumbing, electrical, accounting, law and agency businesses that pay full wages can ignore this.