This week an AI model helped find two serious holes in the software that runs a big share of the internet, which is the kind of help you're grateful for and slightly uneasy about at the same time.
Two days later, the SEC put super intelligence on its list of things examiners will watch next year. And in between, Anthropic released an assistant that doesn't wait for you to ask before it gets to work.
Three stories from this week that matter for your practice.
AI Just Found Two Critical Flaws in the Software Behind Many Advisor Websites.
On Wednesday, InvestmentNews reported two critical vulnerabilities in PHP, the scripting language behind roughly 70% of websites. Each one is rated 9.2 out of 10 for severity, and either can let an attacker take control of a web server without logging in.
Security firms Calif and Wiz found the bugs using frontier AI models, and OpenAI, whose model Calif used, called them "one of the most impactful security issues in recent memory." PHP's developers released fixes around 10 a.m. Eastern on Wednesday after details leaked the day before, and a security firm's decoy servers recorded exploit attempts that same day. No breach at a real organization had been confirmed by Wednesday afternoon.
Why you should care: WordPress runs on PHP, so your website, client login page, document upload or scheduling tool could be exposed if the server behind it isn't patched. Many of the vendors you rely on, like web hosts, portal providers and CRM add-ons, may run PHP without ever mentioning it.
The article points to the amended Regulation S-P, which took effect for smaller firms on June 3, 2026. Your service providers have to tell you within 72 hours of a breach involving customer information, and you generally have 30 days to notify affected clients. The practical step is the same one the article suggests, which is asking each provider in writing whether they use PHP and whether they've applied a fixed version, then keeping their answers in your vendor oversight file.
The SEC's New Exam Priorities Name Super Intelligence.
On Friday, the SEC's Division of Examinations released its examination priorities for fiscal year 2027. One of the areas on the list is "emerging technologies, including super intelligence and other advanced technologies that may affect market operations."
For investment advisers, the list covers fiduciary obligations, conflicts of interest, investment recommendations and compliance programs. Division Director Keith Cassidy said, "The markets we oversee continue to evolve rapidly, and the examination program must evolve with them."
Why you should care: The release frames super intelligence around market operations, not around how a solo advisor uses a chatbot to draft an email. But compliance programs are on the adviser list every year, and the AI tools you use for client work live inside yours.
If an examiner asked tomorrow which AI tools you use, what client information goes into them and who reviews what they produce, a one-page answer in your compliance file would make that a short conversation. Writing it down now is far easier than reconstructing it during an exam.
Source: SEC Announces Fiscal Year 2027 Examination Priorities (SEC.gov)
Claude Duet Sends You a Morning Brief Without Being Asked.
On Wednesday, Anthropic launched Claude Duet, a proactive assistant that reaches out to you first, according to MacRumors. It connects to your apps, sends a short brief each morning on what looks important, checks back every few hours and lets you know when something needs attention.
Each task runs in the cloud in its own virtual machine with a browser, so your computer doesn't need to stay on. Duet asks for your approval before it sends a message, makes a payment, signs a document or deletes a file, and Anthropic says it doesn't see your passwords. It's a research preview with a waitlist for Pro and Max subscribers in the U.S., and its background checks count toward your plan's usage limits.
Why you should care: Anthropic says it built Duet for professionals and small business owners who have too much to track, which describes many advisors running their own practice. A morning brief that pulls the urgent items out of your inbox and calendar could take a real bite out of the first part of your morning.
Before you connect it to anything with client information, remember that Pro and Max are individual plans. Check with compliance before an assistant reads client emails, and keep a record of what you connected and when. The approval step before anything goes out is a good habit to keep, even when a tool doesn't require it.
Source: Anthropic Launches Claude Duet, a Proactive AI Agent (MacRumors)
Watt, the Amplify for Advisors Agent
See Watt solve this.
Paste your website once, and Watt drafts a week of posts with graphics in your voice and brand, ready for you to approve.
This week · ready for your review
Open now. Watt drafts a week of posts, emails and graphics in your voice, with no client data needed.
Start your 7-day free trialONE THING TO TRY THIS WEEK
The PHP warning landed on a Wednesday, and the firms that answered it fastest already knew which of their vendors run websites and portals. Security alerts like this one will keep coming, so this week set up a checker that tells you which of your vendors a new alert might touch and drafts the questions to send them.
Step 1. In Claude, create a Project called "Security alert check" (in ChatGPT, a custom GPT works the same way). Open its instructions and paste this.
You help me, a financial advisor running a small practice, respond to security alerts about the software and vendors my firm uses. My vendor list is saved in this project, with each vendor's name, what they do for me, whether they hold or see client information and my contact there. When I paste a security alert, a news article or a vendor notice, read it and tell me in plain language what the problem is, how serious it is and what kind of software it affects. Then go through my vendor list and sort each vendor into likely affected, possibly affected or unlikely to be affected, with one sentence explaining why, and say clearly when you're guessing because my list doesn't include enough detail. For every vendor that's likely or possibly affected, write a short email I can send that asks whether they use the affected software, whether they've applied the fix and when, whether they've seen any sign that client information was accessed, and that asks for a written reply I can keep on file. Finish with a short note for my compliance file that lists the date, the alert, the vendors I contacted and the open items, and remind me that under Regulation S-P service providers must notify me within 72 hours of a breach involving customer information. Never include client names, account numbers or other client details in anything you write, and if the alert doesn't say something, say it's not stated instead of filling it in.
Step 2. Add your vendor list to the project as a file. Your web host, website builder, client portal, CRM, scheduling tool, document storage and email provider are a good start, and your custodian and planning software belong on it too.
Step 3. Test it by pasting the InvestmentNews article about the PHP flaws. Send the emails it writes to anyone flagged as likely or possibly affected, and save the note in your compliance file. The next time an alert shows up, paste it in and you'll be done before your coffee gets cold.
Most of good security is knowing who to ask, and having the question already written.
Sam is the founder of Amplify for Advisors and Watt, the Amplify for Advisors Agent. A former RIA owner whose work has been featured in Forbes, NerdWallet, Nasdaq, and more, he teaches financial advisors to use AI in their own voice while staying compliant.