GUESSWORK
Guess & Click presents — your weekly click into AI
THE ONE THAT MATTERS
Black October, and the four things to do about it
October had a few big, separate incidents. We put them in one section because the fixes fit on one list.
Here is the list, up front. Update your browser, phone and apps. Agree a safe word with your family. Turn on Chrome's Enhanced Protection. If you are vibe-coding an app, check your database rules before anyone signs up.
Now the why, one at a time.
One: the certificates, and why "update" is the whole fix
A certificate is how your browser knows a website is the real one. SecurityWeek reports that the private keys behind eight intermediate certificates from eMudhra, an Indian certificate authority, were shown to be recoverable.
The browsers moved fast. Firefox and Chrome blocked them from October 17th, and Microsoft from October 20th. Apple's products were protected from October 22nd, per the incident site run by Dennis Jackson.
India's IT ministry, MeitY, says the impact was "very limited and for a very short interval," per Business Today. eMudhra itself says no data breach occurred, per the same report.
The part that is about you is smaller and duller. Many programs only stop trusting the bad certificates after an update. certifi, a certificate list that Python tools such as requests and pip rely on, rates its fix Critical, and its advisory says: "Upgrade to 2026.10.19 or later." Per the advisory, the emSign root it removed was linked to compromised intermediate certificates rather than compromised itself.
So tap the update button you have been ignoring. The browsers already did their part.
Two: a safe word, before anyone needs it
INTERPOL launched a campaign on AI deepfake scams. The slogan: "Wait. Validate. Don't take the bait."
Its red flags are contact you didn't ask for, urgency, emotional pressure, and requests for wire transfers, crypto or gift cards. Its actions: agree a secret safe word with close family or friends, call back on a number you already know, and turn on two-factor login.
Pick the word at dinner tonight. Make it something nobody would post. A voice that sounds like your kid is not proof it's your kid. A word only your kid knows is closer.
Three: switch on the setting that makes Chrome's new warnings work
Google says Chrome users with Enhanced Protection on now get a new "suspicious site" warning. A Gemini check now looks for fake antivirus and fake update pages.
There is also a check for the "ClickFix" trick, where a page talks you into pasting a command into your own computer. Per Google, Chrome checks a suspicious copied command and warns you if that check says it is dangerous. Not on every copy. Only when the check comes back dangerous.
The catch is in the setting's name. All of this only works with Enhanced Protection switched on. Google said in 2025 that more than 1 billion Chrome users had it on. Find it in Chrome's settings and check you are one of them.
Four: if you are vibe-coding, check the door before the party
UpGuard says it found 16,326 Supabase databases with tables it could read. UpGuard calls Supabase the database most recommended by Claude Code, built so AI coding agents can use it easily.
That is the trade. Easy for the agent to set up is easy to set up wrong. If you built an app with AI help and real people are putting their details in it, check your database access rules before launch. Ask your coding agent to walk you through them, then read what it says.
Why you should care — put the four side by side.
An update button.
A word at dinner.
A setting.
A rule on a database.
None of them needs a security background. All of them are things you do once.
TWO MODELS AND RELEASES
Claude Duet: an assistant that asks before it acts
On October 21st, Anthropic released Claude Duet as a research preview with a waitlist. It sends you a morning brief and checks your connected apps every few hours. Per Anthropic, it asks you before it sends a message, makes a payment, signs a document or deletes anything. US Pro and Max subscribers get in first. The asking-first part is the part to read.
DeepSeek's new Flash model, and a billing date
On October 17th, DeepSeek released V4.1-Flash-1017. It is live on DeepSeek's website, app and API, and the open weights are on Hugging Face and ModelScope. One date to note, per DeepSeek. Search and Fetch tool calls, free for API users inside some coding tools, start billing on October 31st. Free has a calendar.
MiniMax M3.1 Flash, in MiniMax's own numbers
On October 19th, MiniMax launched M3.1 Flash. MiniMax claims it makes online inference nearly three times faster, and that agent tasks cost 70% less than on the model before it. Those are MiniMax's figures, not anyone else's. The price is $0.15 per million input tokens and $0.60 per million output tokens, with the weights to be released later.
OpenAI's models show up on Google Cloud
On October 21st, Google Cloud announced three OpenAI models: GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna. They are in private preview for select enterprise customers. You will not see this unless your employer's IT team does.
TOOLS AND TIPS
ChatGPT chats you can lock
OpenAI's help center describes locked chats, which are rolling out now. You lock a chat with a 4-digit PIN, Face ID can open it on devices that support it, and the Free plan is included. Two lines to read first. Resetting a forgotten PIN deletes all your locked chats. And locking is not end-to-end encryption. It hides the chat from whoever is holding your phone. That is the whole job.
Notion's agents can use your ChatGPT plan, on some plans
Notion's help page says you can connect a ChatGPT Plus, Pro or Go plan to Notion Agent. Only on a Notion Business or Enterprise workspace, and only as a member, not a guest. Notion also has a new credit system, and existing customers move over on November 2nd. If you pay for Notion, check which plan you are on before you plan around this.
THE RUNDOWN
WhatsApp's support bot had hidden instructions
Malwarebytes reports that the privacy company Redact found 102 hidden instruction blocks across 80 of 545 WhatsApp help pages. Per Malwarebytes, they told the support bot not to point users to privacy regulators when those users had lost access to their phone number or device and wanted to delete their account. WhatsApp told WIRED it wants the bot to give product advice, not legal advice, per the report, and says the bug that showed the text is fixed. Redact did not test whether the bot followed the instructions. If you need to complain about a company, find its complaint route yourself, not through its bot.
Sweden steers government staff to Copilot
SVT reports, citing Ekot, that Sweden's Government Offices will block ChatGPT and Claude on work computers starting Monday, October 26th, and steer staff to Microsoft Copilot, per Daily Northern. The chatbot you use at home may not be the one you get at work. Check what yours allows before you paste anything in.
PC shipments fell 21%
Counterpoint's preliminary data shows 57 million PCs shipped in Q3 2026, down 21%, per FoneArena. Memory and component costs pushed prices up, per Counterpoint, and it forecasts a 27% drop for Q4. If your laptop still works, this is a good week to like it.
YOU ARE NOT BEHIND
Look at what this week actually asked of you.
Not a security course. Not a new subscription. Not a new laptop, at Q3 prices.
It asked you to do four small things.
Update your browser, phone and apps. Agree a family safe word, the way INTERPOL suggests. Switch on Chrome's Enhanced Protection. Check your database rules, if you are building something.
None of those needs a technical background. All four are things you can start tonight.
You don't catch up by understanding every certificate. You catch up by pressing update.
Hit reply and tell me which of the four you did. Tell me your family's reaction to the safe word, if you're allowed to. I read every reply, and it changes what goes in.
And if you know someone who still ignores the update button — forward this. The first step is a button. They can manage a button.
See you next Sunday — same tabs, same eye-rolling.
— Kabells & Arc
Every claim above, sourced
This week's rule was only confirmed claims. Every fact above was found by searching the raw text of the source's page for the exact number, name or quote. Where a page hedged, the hedge stayed in.
The eMudhra certificates — SecurityWeek · the eMudhra incident site
MeitY and eMudhra on the impact — Business Today
certifi's advisory — GitHub Security Advisory
INTERPOL's deepfake-scam campaign — INTERPOL
Chrome's new scam warnings — Google
Supabase databases with readable tables — UpGuard
Claude Duet — Anthropic
DeepSeek V4.1-Flash-1017 — DeepSeek
MiniMax M3.1 Flash — MiniMax
OpenAI models on Google Cloud — Google Cloud
ChatGPT locked chats — OpenAI Help Center
Notion Agent and your ChatGPT plan — Notion Help Center
WhatsApp's hidden bot instructions — Malwarebytes
Sweden's government computers — Daily Northern
PC shipments — FoneArena