The Labour Court warned against rigid equity targets, Absa said an AI agent holding your bank login may leave you liable, and this week's job is listing every app that can reach your mail.

Employment equity targets cannot be applied mechanically in a promotion. In Solidarity obo Benjamin v Department of Correctional Services, the panel strongly recommended its top candidate, but the Department declined to appoint her because national targets showed her group over-represented. The Labour Court set the arbitration award aside, said numerical targets should have been a neutral factor with merit decisive, and awarded 12 months' compensation. The report does not give the decision date. (Labour Guide) Read →

FNB was fined R1 million by the Information Regulator. An assessment found shortcomings in how the bank handled repeated security incidents and in its safeguards against unauthorised access to personal information on its digital home loan application platform. FNB says it has fixed the shortcomings and that no customer suffered financial harm. The size of the fine is the cost; the finding is the lesson, because the weakness was in handling incidents, not only in the platform. (Bizcommunity, ITWeb)

Banks warn that giving an AI agent your login may leave you liable. Absa says a customer who hands banking credentials to an AI agent may be held liable, and local banks are keeping outside agents out. The report does not say which clause applies or which other banks are quoted. Until you have read your own bank's terms, treat a banking login as something no agent holds. (TechCentral)

2 248 795 vehicle licence discs expire over November and December. The RTMC says Gauteng has 851 687 of them, the Western Cape 374 761 and KwaZulu-Natal 327 014, and that traffic enforcement will be more visible from November to January. Exact expiry days are given only as the end of each month. A fleet with one expired disc can lose a vehicle at a roadblock in the busiest weeks, and renewals can be done on the RTMC's online portal. (htxt.africa)

Vodacom's CTO says South Africa could switch off 3G within two years. He says it can happen if the operators act together. That is a position, not a regulator's date. Anything in your business on a 3G-only SIM, such as a tracker, an alarm panel or an older card machine, is worth listing now while there is still time to replace it on your own schedule. (TechCentral)

The Soweto Labour Centre is shut under an occupational health and safety prohibition notice. The Department of Employment and Labour says its digital portals remain 100 percent operational and sends walk-ins to Maponya Thusong, Randburg and Roodepoort. No reopening date has been given. If you register staff or file claims, use the online route first. (Labour Guide)

Anthropic's IPO filing shows nearly half its sales go through Amazon and Google. The first-half net loss was $80.7 billion, largely a non-operating convertible-bond item, and the operating loss narrowed to $693 million. For you the point is concentration: if your work depends on one AI supplier, keep your files and prompts in a form you can move. (TLDR IT)

Google's shares fell about 10 percent as search advertising growth slowed. Alphabet reported 25 percent revenue growth, with Cloud contributing $30.7 billion of $127.6 billion in sales, but search ads decelerated as the company works out how to earn from AI. If enquiries reach you through Google searches, expect the way people ask, and what Google shows them, to keep shifting. (TLDR)

Microsoft will retire most of Azure Communication Services by 30 September 2028. Standalone chat, SMS and WhatsApp on the service will shut, and new customer onboarding was restricted from late 2026. If a software supplier built your customer messaging on it, ask them in writing what they will move to and when. (TLDR IT)

AWS says its large capacity commitments are booked through 2027. Some commitments extend into 2028. Amazon says it still reserves capacity for on-demand customers, so new workloads are not blocked. The practical reading for a small buyer is that cloud prices and priority will follow the big contracts, so get any multi-year commitment in writing. (TLDR IT)

A 16-year-old flaw in the firmware behind most servers can run code before Secure Boot loads. CVE-2026-97631 scores 9.5 and sits in the network-boot code of the reference UEFI software. Exploitation needs local network access. If you run a server on site, ask the vendor for patched firmware and turn off network boot if you do not use it. (Ars Technica, TLDR InfoSec)

Amazon told staff that counting AI usage is a flawed measure. The memo says token use, adoption rates and code volume can drive cost and complexity, and the company is looking at launches and successful changes instead. For forty people the translation is simple: measure quotes sent and jobs closed, not how often anyone opened the tool. (TLDR)

Microsoft fixed a Microsoft Authenticator flaw on Android. A malicious app could pretend to be a trusted Microsoft app and obtain work-account tokens, exposing email, files and calendars in the researchers' tests. Microsoft says it needed the user to complete a sign-in and reports no known attacks. Update to version 6.2606.4246 or later on every staff Android phone. (TLDR IT)

Emergency patches landed for a critical Brotli flaw in Node.js, .NET and several Python libraries. A specially crafted compressed stream can trigger a buffer overflow. You will not patch this yourself, but anyone who built or hosts your website or app will. Ask them whether it has been applied and on what date. (TLDR InfoSec)

Gemini now lets you edit Google Docs, Sheets, slides and PDFs inside the chat. It is available to all Gemini users from this week, and highlighting text lets you ask questions or prompt changes. PDF editing works on web and mobile, the other formats on web only. It removes the copy and paste from drafting a quote or a policy, but check what your plan lets staff upload before anyone pastes a client's details in. (The Verge) Read →

New Outlook for Windows adds an All Accounts view. Mail from several connected accounts appears in one place while each mailbox stays separate, and Microsoft expects the rollout to finish by late October. Administrator controls are planned separately, so until they arrive, tell staff whether personal accounts may be connected to a work Outlook. (TLDR IT)

OpenAI now bundles API credits with its $100, $200 and $500 plans. Anthropic announced the same deal earlier this month, and the credits expire. If one person on your team already pays for a plan and wants to test an automation, the test may now cost nothing extra. The sources do not say whether South African accounts qualify, so check before planning around it. See the translation below. (Simon Willison) Read →

1Password for Agents lets you approve an AI agent's sign-in while 1Password fills the credential. The agent never sees the password. It is included at no extra cost for Individual and Family accounts on 1Password.com, and 1Password.eu and .ca accounts are not supported yet. The report does not mention business plans, so for a company this is something to watch, not buy. (TLDR IT)

Gemini 4 Carbon launched, but you cannot buy it yet. Google has opened it only to selected cybersecurity defenders until it improves the guardrails. The announced price travels as a benchmark: $2 per million input tokens and $10 per million output tokens, with a 95 percent discount on cached inputs, rising to $4 and $20 when the introductory period ends. No end date is given in our sources. (TLDR)

What shipped. A plan that costs $100, $200 or $500 a month now comes with the same dollar amount in credits, which can be applied to one of your API organisations. Anthropic did it first, for Max and Team plans, and OpenAI has matched it. (Simon Willison) Read →

What it costs. Nothing extra on top of a plan you already pay for. The rand figures above use the rate of 16.61 to the dollar that Moneyweb showed on 30 October. Your card's rate will differ, and the plan prices in rands are not in our sources. (Moneyweb)

What it means for forty staff here. The person who already pays for a plan can build and test one automation, such as sorting supplier emails or drafting quotes from a template, without opening a separate API bill. The credits expire, so the saving only exists if the test is run.

What blocks it locally. Our sources do not say which plans are eligible or whether South African accounts qualify. Credits are tied to one API organisation, so if that account belongs to one person, the work and the data sit with them.

What to do. Ask whoever holds a plan to check whether the benefit shows on their account. If it does, pick one repeatable job, run it ten times, and write down the credits used.

1. Sign in as the administrator of your mail system. Microsoft 365 or Google Workspace. If you do not know who that is, that is the first finding.

2. Open the list of apps connected to company accounts. In Microsoft 365 it is the enterprise applications list. In Google Workspace it is the list of apps with access to data.

3. Open a sheet with four columns. App, what it can read, who approved it, still needed.

4. Copy every app into the sheet. Include AI note takers, calendar tools, e-signature tools and anything that says assistant or agent.

5. Ask the person who approved each one if it is still needed. Silence counts as no.

6. Remove every app marked no. Removing an app revokes its access, so a changed password alone is not enough.

7. Look at who is allowed to approve new apps. If any staff member can, change it to require an administrator.

8. Write one rule and send it to staff. Nobody gives an AI tool a login, a bank password or a code from a sign-in page.

9. Put the next review in the calendar. Three months from today, same list.

Never enter a code from a sign-in page you reached through a PDF or a shared link. A phishing campaign this week sends password-protected contracts that lead into a real Microsoft sign-in, and finishing it hands the attacker a token. Open the app yourself instead.

Ring a new carrier on a number you already hold before you give them a load. Thieves have taken over freight accounts through malicious links and bid on shipments in the hijacked identity. A call-back to a known number defeats it.

Count jobs finished, not tool opens. Put one number on the wall for each AI trial: quotes sent, invoices issued or hours saved on a real task.

Write down why a promotion departs from the panel's ranking. The Court looked for the reasoning behind the decision. A dated note against your equity plan's own targets, made before the announcement, is the record.

Open any case an AI gives you before you cite it. A CCMA commissioner has been criticised by the Labour Court for relying on a judgment that does not exist. One search on the court's own site settles it.