Weekend Reader Week 45

Conditional Access changes, risky Entra defaults, AI in cyber security and a few good reads from the week.

My links from this week, grouped loosely by topic.

Microsoft 365, Entra and Exchange

Microsoft Adds Conditional Access for Outlook Attachments

Microsoft has added a separate application configuration for Outlook attachments, so Conditional Access can now enforce controls directly on downloading, previewing and uploading them. Users who do not meet the policy conditions are blocked from attachment actions even though they can still read the mail, and excluding Exchange Online from a policy does not automatically exclude attachments.

Good control, nasty trap. If you’ve excluded Exchange Online somewhere, go check your policies before your users start asking why they can read the mail but can’t open the attachment.

Conditional Access Policy Plans Launch into Preview

Microsoft is previewing policy plans, which act as containers for related Conditional Access rules. Shared conditions such as break-glass exclusions or device platforms are defined once at plan level and inherited by the rules, which should reduce duplicated configuration and policy sprawl.

Finally. Anyone who has kept the same break-glass exclusion in sync across 30 policies knows how badly we needed this. I’m curious whether it actually cuts sprawl or just adds another layer to it.

Entra Multi-Tenant App Mistakes Every SaaS Builder and Admin Should Know, with Kelvin Tegelaar

Kelvin Tegelaar explains why a single multi-tenant app with one shared credential is risky for every customer that consents to it, and warns that Conditional Access cannot be applied to a vendor’s app. The advice includes retiring client secrets, enabling app management policies, and building one app per customer tenant.

Required reading before you consent to the next vendor app. One shared secret for every customer is a single key to many doors, and Conditional Access won’t save you there.

The Exchange mailbox scope that does nothing

Darius Frank tested Exchange Online’s RBAC for Applications and found that a scoped Exchange grant adds to, rather than replaces, a tenant-wide Mail.Read permission held in Entra. The scope has no effect until the Entra grant is removed.

The kind of test I wish more people published. A scope you believe restricts access but doesn’t is worse than having no scope at all, because it gives you false comfort. Clean up the Entra grant first.

Hooray! Your users are about to become agent architects! (Agder in the cloud)

From 4 November 2026, Microsoft is rolling out a setting that lets any user create agent identity blueprints, and it is on by default. Blueprints hold credentials and permissions that flow down to every agent identity created from them, and the setting is separate from the one that controls app registrations.

On by default, again. Credentials that flow down to every agent made from a blueprint aren’t something I want every user creating. This one goes on my list for Monday.

MC1409042 - Microsoft OneNote: Copilot notebook available in OneNote on Mac

A Message Center post announcing Copilot Notebook, an AI workspace in OneNote on Mac. It needs a Microsoft 365 Copilot license, is enabled by default, and is rolling out worldwide from late August to mid-October 2026 with no admin action required.

Nice for Mac users with a Copilot licence. “Enabled by default, no admin action required” is still a phrase I’ve learned to read twice.

When the meeting room starts helping you – Logitech’s new Rally devices and AI in meetings

Vesa Nopanen looks at Logitech’s Rally Bar 2 launch from a meeting participant’s point of view, covering presence detection, room booking, and voice and face recognition in Teams Rooms so that transcripts credit the right people. He has not tried the devices yet, so the details come from Logitech.

Transcripts that credit the right person in a hybrid room would really help. Face and voice recognition in the meeting room is also a conversation with the works council I’d prepare for early.

Security

What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks

Of roughly 383,000 disclosed vulnerabilities, only about 2,000 have been linked to real-world exploitation, and those are concentrated in takeover classes such as remote code execution, privilege escalation and authentication bypass. Microsoft’s data shows patching takes weeks to months on critical systems while exploitation often happens within days.

About 2,000 out of 383,000 is the useful number here. Prioritise the takeover classes and stop treating the CVE list as one big to-do list. Days to exploit versus weeks to patch is the gap we have to close.

Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years (NCSC)

The NCSC’s State of the Cyber Nation report says AI-powered malware is highly likely to be used in a ransomware attack on UK critical national infrastructure by 2028. Its chief executive argues that the era of “tech on the cheap” at the expense of security is over.

“Tech on the cheap is over” is the line I’ll be quoting in budget meetings. Swiss infrastructure is no different.

Artificial intelligence and cyber intrusion (NCSC)

An NCSC assessment of AI-enabled threat trends, with three plausible scenarios to 2028 rather than predictions. Its key judgements include that nation states will routinely use AI for cyber operations and that many systems will still be vulnerable to tools that find and exploit weaknesses.

I like that they offer scenarios rather than predictions. It’s more honest and more useful for planning than yet another “AI will change everything” headline.

AI Vulnerability Finding (Schneier on Security)

Bruce Schneier quotes a comment claiming that 3% of all critical software security bugs ever recorded were found in the last month, with about 100,000 more expected this year. He adds only that it is a new world out there, and the figures are the commenter’s rather than his own.

They’re a commenter’s numbers, so take them with salt. Even if they’re half right, Schneier’s “new world” is an understatement, and patch pipelines aren’t built for that volume.

Bias in Qwen3-Coder Model (Schneier on Security)

Research quoted by Schneier found that Qwen3-Coder produces less secure code depending on who the app is for, for example 19% more likely to be hackable for a US defence contractor than for a Chinese one. Removing the model’s alignment removed the gaps.

This is the unsettling one this week. Code that’s quietly worse depending on who it’s for is exactly the bias you won’t catch in a code review. Know which model writes your code.

AI and the future of work

Introducing Images 2.6 (OpenAI)

OpenAI’s Images 2.6 generates images 50% faster, adds animated GIFs, and brings image markup and SVG export to the API. It is available in ChatGPT and Codex across all subscription tiers.

Precise edits and SVG export bring AI images closer to everyday internal use.

GIF export, finally. After decades of humanity struggling to make a looping cat video, OpenAI has stepped in to save us. I’m sure this is what all those data centres were for.

AI-generated images don’t have to look like AI-generated images (kottke.org)

Jason Kottke points out that AI images can be made in any style you choose, and notes that it will only become harder to tell them apart from other work. He links to the poster article below.

Kottke is right, and it fits what I see in my own image experiments. The “AI look” is mostly a default, not a limit.

AI-generated posters don’t have to be horrible (John Hartnup)

Hartnup argues that identical-looking AI event posters are a prompting problem rather than a limit of the tools. Naming a specific design style and era in the prompt gave him much more varied results. Found via kottke.org.

Prompting is a design brief. Name a style and an era and you get a poster. Leave it out and you get the same purple gradient as everyone else.

The Future Of Knowledge Work With AI (Noema)

Aaron Horwath describes knowledge workers who now manage swarms of AI agents, all built on the same small set of language models. His concern is that people hired for their individual thinking are collectively running their ideas through the same few tools.

The point I keep thinking about: when everyone runs their ideas through the same three models, everything starts to sound the same. Your own thinking becomes the scarce part again.

A quote from Ben Hylak (Simon Willison)

Simon Willison shares a joke from Ben Hylak that every product he uses should be a headless MCP feeding an agent, except for his own product, where customers supposedly love the UI.

Funny because it’s true. Every vendor wants to be the platform and nobody wants to be the pipe.

Microsoft named a Leader in the 2026 Gartner Magic Quadrant for AI Agent Management Platforms

Microsoft says it has been named a Leader in Gartner’s first Magic Quadrant for AI Agent Management Platforms and that more than 50 million agents are registered in Agent 365. It credits its identity-first approach through Entra Agent ID. This is Microsoft’s own announcement.

It’s a vendor announcement, so weigh it as one. 50 million registered agents is the number that matters: agent identity is now an operational problem, not a future one. See the blueprint default above.

Elon Musk admits Grok Bot is too costly as users hit caps (AOL)

Paying users of Grok Bot ran out of usage days early, and Elon Musk wrote on X that the cost of serving it was unsustainably high relative to revenue. The article says paid weekly users reached 800,000 in early October.

A reminder that flat-rate AI is a subsidy, not a business model. I’d expect caps and price changes everywhere, not just here.

Hacker Times

A daily tech news front page. The edition saved for 6 November leads with a GitHub report alleging that Claude Code exposed a user’s email address in web-request headers, with a team member saying a fix is due early next week.

My new morning scan. The Claude Code header story is a good reminder that your coding agent also talks to the internet on your behalf.

Tech and web

Website migration costs are going to zero (Dries Buytaert)

Dries Buytaert expects the technical work of moving a website between platforms to cost close to zero within three years, and lists ten predictions. Among them, switching costs will stop protecting vendors and proprietary vendors will have to compete on price and value.

As someone who just moved this blog to a new theme with AI help, I believe it. Lock-in by pain is ending, and vendors will have to earn every renewal.

Three Dots (Rands in Repose)

Rands links Reddit’s share price drop, falling search referrals and its API and RSS shutdowns to Google’s AI Overviews and AI companies training on public data. His point is that the real value lies in humans talking to and helping each other.

Rands connects the dots well. If AI answers swallow the clicks, the places where humans actually help each other become more valuable, and also more fragile.

The Last Consumer Company (Asymco)

Horace Dediu notes that Apple captures about half of the consumer revenue of the top half of the S&P 500, and that most other very large companies now sell to institutions rather than consumers. He compares this with the top 20 companies by market capitalisation in 2010.

A striking way to look at Apple. It’s almost alone in selling to people rather than institutions, and that explains a lot about how differently it behaves.

DroidDock - Your Android files without the hassle on Mac (Korben)

DroidDock is a macOS app that connects to an Android phone over ADB and lets you browse, preview and drag and drop files like in Finder.

Android File Transfer was always painful on the Mac. Anything that makes it feel like Finder gets a try from me.

Odysseus - PewDiePie’s self-hosted AI finally runs fast on Mac (Korben)

A guide to installing the self-hosted Odysseus AI workspace natively on a Mac, since Docker cannot use the Apple Silicon GPU and runs models slowly on the CPU. It also warns to use the stable main branch rather than dev.

The Docker-can’t-use-the-GPU detail is the useful part for anyone running local models on Apple Silicon. And yes, stay on main.

Something different

The Real Kevin Bacon (The Pudding)

An interactive piece testing whether Kevin Bacon really is the centre of Hollywood in the “Six Degrees” game, listing how many movies away various actors are from him.

Pure weekend fun. I lost half an hour checking my favourite actors. Is Bacon really the centre? Go find out.