> ## Content Index > Fetch the complete content index at: https://operators-ai.ghost.io/llms.txt > Use this file to discover other available public pages before exploring further. # This week: the doors you didn't know were open - URL: https://operators-ai.ghost.io/the-doors-you-didnt-know-were-open/ - Published: 2026-09-18T21:34:04.000Z - Updated: 2026-09-18T21:34:04.000Z - Description: A plugin that updates itself in the background, a workflow toggle that says run on your own, and the clever fix I announced on Monday for a client's data that turned out to be the wrong problem solved well. Plus the answer sheet for when a client asks where their data goes. - Author: Justin Zsimovan - Tags: weekly ## On the bench On Monday I told my agent I had solved a problem. I had not. Here is the arc, because I think a lot of you are about to walk the same one. The setup: a consulting engagement for a customer whose data falls under a federal safeguarding regime. Some of what they would normally hand a consultant is not allowed to touch a cloud model, and depending on how the paper is written, not allowed to sit on my laptop either. This is the first engagement I have taken where the rules about the data are stricter than the rules about the work. My Monday idea was clever, and I was pleased with it. Run an open model on my own hardware. Have it strip every identifying detail from the customer's documents. Do the real work on the scrubbed copy with whatever model is best for the job. Have the local model put the names back at the end. Nothing sensitive leaves the machine. I typed "I solved our customer issue" and went to make coffee. My agent read it back against the rules I had loaded into it months ago and pushed back in two sentences. Stripping the names does not change what the material is; the classification rides with the content, not the nouns. And a local model changes where the inference runs. It does not change whether the material is allowed on my machine at all. I had engineered a very good answer to the question "which model" when the actual question was "which door." The boundary I was trying to route around is not technical. It is a list of endpoints the customer has authorized to hold their material, and my hard drive was not on it. I did not take that gracefully. My exact words, mid-week, were that if they send me the data, that is on them. It is not. Once the file is on your disk, the obligations that came with it are yours, whether or not you asked for it. I had that pointed out to me by the thing I built to help me think, and it was right, and I was annoyed for about an hour. Where it landed by Friday: the statement of work I drafted today carries two lines that were not in my head on Monday. The customer does not send me controlled material, full stop; anything I need, I work on inside their environment. And AI tooling gets used on their engagement only where they have approved it in writing. The fix moved from my hardware into the contract. The local model is still a good tool. It just was not the fix. I keep coming back to how close I came to shipping the wrong version. The clever technical answer was faster, it was mine, and it would have felt like I was protecting the customer. The real answer was slower, involved a lawyer's paragraph, and moved the decision to the people who own the risk. That is the theme of this whole issue. The doors that matter are the ones you did not notice you had opened. ## The gauges ### Your coding agent's plugins update themselves. Someone just proved that can be turned against you. What I saw: on Wednesday a security firm called AIR published [Plugin4Shell](https://www.air.security/blog-posts/plugin4shell?ref=operators-ai.ghost.io), a zero-click remote code execution bug in the plugin systems of Claude Code, Codex, GitHub Copilot, and Gemini CLI. The mechanism matters more than the name. All four agents "pin" a plugin to a specific reviewed version of its code, and all four check out that version without verifying the checkout actually landed there. An attacker who controls the plugin's repository can make the pinned version resolve to something else while the pin looks honored. What makes it zero-click is background auto-update, which AIR says is the default in Claude Code and Codex: the swap reaches plugins you already installed and trusted, with no prompt and nothing to notice. [Help Net Security's summary](https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/?ref=operators-ai.ghost.io) has the patch state: Claude Code fixed in 2.1.179, Codex in 0.146.0, Copilot not patched as of Friday, and Google chose to deprecate Gemini CLI rather than fix it. Should you pay attention? Yes, today, if you run any of the four. The agent runs with everything you can reach: your files, your logins, your client folders. A plugin inherits that by default. AIR's earlier work found 925 skills already in use had been hijacked out from under their maintainers, so "it came from a marketplace I trust" is not the defense it sounds like. My position: two moves. First, update. Then open your plugin list (`/plugin` in Claude Code, the equivalent in Codex) and read it like a list of contractors with keys to the building. Anything you cannot say why it is there, remove. And decide on purpose whether a machine that runs unattended jobs should update its plugins in the background at all. I have been letting mine, because it was the default. That is the whole point of this week: a default is a door someone else propped open, and you are the one living behind it. ### Anthropic's small-business kit now has a toggle that says "run on your own." Read what its own safety page says before you flip it. What I saw: on Monday Anthropic [expanded Claude for Small Business](https://claude.com/blog/claude-for-small-business-launches-new-workflows-integrations-and-training-programs?ref=operators-ai.ghost.io) to 43 workflows and 27 more connectors, including Gusto, Stripe, Square, Xero, and Shopify, and said the package has been installed more than 900,000 times since May. The workflows are the ones you would want: a Monday brief that reads your cash position and pipeline, an inbound-lead responder, a proposal builder, a month-end close. Every workflow starts in approval mode, where Claude drafts and stages the work and waits for your OK. New this release: you can let a workflow run on its own, "one workflow at a time." Now the page next to it. Anthropic's own [Cowork safety guide](https://support.claude.com/en/articles/13364135-use-claude-cowork-safely?ref=operators-ai.ghost.io) says: "Isolation limits where Claude's code runs. It doesn't limit what Claude reads or does." And under how to minimize risk, first bullet: "Avoid granting access to local files with sensitive information, like financial documents." That sits beside a plugin whose headline workflow is closing your books. Both statements are on vendor pages this week. I am quoting both because you need both. Should you pay attention? Yes if you have it installed, and especially if you are a one-person business running it on a personal Pro or Max plan. Approval mode is a gate on actions, meaning send, post, and pay. It is not a gate on reading. Your ledger goes to Anthropic's servers either way. And the no-training promise on the launch page is scoped, in Anthropic's words, to Team and Enterprise plans. On a personal plan, the consumer toggle governs, and whatever Claude writes into the chat about your business (the P&L summary, the overdue list) is conversation content. My position: the plugin is good and I would rather you use it than the $2,000-a-month chatbot some rep is pitching you. But treat "run on its own" as a promotion each workflow has to earn, the same way you would not give a new hire the company card in week one. The Monday brief, which only reads, is a fine first candidate. Anything that pays or sends stays in approval mode until you have read a month of its drafts. And if more than one person touches it, buy the Team plan; that is where the data promises actually live. The full map of who trains on what is the playbook this week. ### OpenAI is retiring custom GPTs. The part that will not migrate is the part you built. What I saw: OpenAI's [retirement and migration FAQ](https://help.openai.com/articles/20001519?ref=operators-ai.ghost.io), updated this week, gives the dates for Enterprise workspaces and says other plans "may follow the same transition timeline." No new custom GPTs after September 25\. Existing ones stop running December 11\. The replacement is a "plugin" that carries your instructions over as a skill. Then the line that matters: "GPT custom actions do not transfer through the migration workflow." If your GPT called out to your booking system, your price sheet, your CRM, that integration has to be rebuilt as a connector or a custom MCP server. Conversation starters and prior chats "may not copy." The model choice does not carry over. And a public GPT you share with customers does not guarantee those customers access to its replacement. Should you pay attention? If you or your staff use a custom GPT for anything real, yes, and the deadline for the first step is a week out. This is the quieter cousin of the plugin story. You built something on a surface that belonged to a vendor, and the vendor moved the surface. Nothing malicious about it. It is just what it looks like to have a door in someone else's wall. My position: this weekend, list every custom GPT your business touches, who made it, and whether it has a custom action. Publish any drafts before the 25th so they can be migrated at all. Anything with an action goes on the rebuild list, and I would build the rebuild as a plain document of instructions plus a connector you control, so the next time a vendor retires a feature you are moving a file, not a business process. ### Quick reads Three more things from the week, one line each, because they are real but they are not this issue's theme. The Claude Code weekly limit change I warned about [two weeks ago](https://operators-ai.ghost.io/the-month-the-subscriptions-stopped-covering-it/) landed on September 14: the summer promotion ended, the permanent bucket is 25 percent over the pre-promo level, which Anthropic's own developer account [confirmed](https://x.com/ClaudeDevs/status/2093742321473065266?ref=operators-ai.ghost.io) works out to 17 percent less than you had last week. First full week on the smaller tank. OpenAI [paused new sign-ups](https://help.openai.com/articles/9793128?ref=operators-ai.ghost.io) to the $200 Pro plan on September 10; if you are on it, do not let a card swap fail. And [GPT-5.5 leaves ChatGPT and Codex on October 14](https://learn.chatgpt.com/docs/changelog?ref=operators-ai.ghost.io); anything pinned to it in a scheduled task silently reroutes. One more that belongs to this theme: three separate people this week described a coding agent destroying something it had been told not to touch, including [a production database during a declared code freeze](https://x.com/jsaunders%5F/status/2099861562068517142?ref=operators-ai.ghost.io) and [a codebase wiped by Codex](https://x.com/johnmyleswhite/status/2100006417289609411?ref=operators-ai.ghost.io). The reply that traveled: models do not price blast radius, your tool allowlist has to. Last week I told you to check whether your agent's credentials could reach your only backup. This week [The Hacker News gave the pattern a name](https://thehackernews.com/expert-insights/2026/09/stop-trying-to-control-ai-behavior.html?ref=operators-ai.ghost.io): control what the agent can reach, not how it behaves. Same door, from the other side. ## Your move Ten minutes. Call it the door census. You are not fixing anything yet; you are finding out how many doors are open that you did not open on purpose. 1. (2 min) Plugins and skills. Open your agent harness and list every installed plugin, skill, and MCP server. Next to each, write who published it and whether you would recognize a change to it. Note whether background auto-update is on. 2. (2 min) Autonomy. List every workflow, scheduled task, or automation that runs without a human click: the ones set to "auto," "run on its own," or on a schedule. For each, write what it can read and what it can send or pay. 3. (2 min) Accounts. For every AI tool that sees client or customer material, write which plan it runs on. Personal or business. If it is personal, write down whether the training toggle is off, or "don't know." 4. (2 min) Vendor surfaces. List anything you built inside a vendor's product that the business depends on: custom GPTs, a vendor's AI feature wired into a process, a chatbot on the website. Write what happens if it disappears in ninety days. 5. (2 min) Circle every line where you wrote "don't know," "default," or "I'd have to check." That is your count. Mine, this morning, was nine. The playbook below is what I did about the third column, because that is the one a client will ask you about, and you want the answer ready before they do. ## The meme ![One does not simply type don't touch prod and call it a control](https://storage.ghost.io/c/6f/e7/6fe775a0-dff8-49ae-9628-ec858b8ecd0e/content/images/2026/09/2026-09-18-one-does-not-simply.png) Three people found out the hard way this week. The rule in the prompt is a wish. The rule in the permissions is a wall. ## The playbook: the answer sheet for "is my data going into AI?" Operators: the bench told you what happened when I got this question wrong on my own engagement. This is the working file for getting it right, built so a consultant, an agency, a bookkeeper, a contractor with a government prime, or a reseller with a supplier's price list can hand it to their own agent and come back with a tiered routing map for their business. Every vendor fact below was read from the vendor's own page this week, and the page is linked, because these pages changed at least twice this year and will change again. Not legal advice. This is what the vendors say and how I route work against it. ### The idea The client's question sounds like one question. It is three. Is my material used to train the model? Where is it stored, and for how long? And who else can see it, including the vendor's own staff and the vendor's partners? A good answer names all three for the specific tool and the specific plan you run, because the answers change at the plan boundary far more than at the vendor boundary. The most common mistake, the one I see in the community every week and made a version of myself on Monday, is answering for the vendor ("I use Claude, they don't train on business data") when the promise only exists on a plan you are not on. ### 1\. The vendor map, September 2026 Read down, not across. The plan is the row that matters. **OpenAI** | Surface | Training | Retention | The catch | | -------------------------------------- | -------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ChatGPT Free, Go, Plus, Pro (personal) | On by default. Off via Settings, Data Controls, "Improve the model for everyone." Not retroactive. | Chats kept until deleted; deleted within 30 days | Codex cloud has a [separate training toggle](https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance?ref=operators-ai.ghost.io) the ChatGPT switch does not touch. Thumbs up or down shares the whole conversation. | | ChatGPT Business (per seat) | Off by default | Admin-controlled; deleted within 30 days | DPA is click-through. [No BAA on Business](https://openai.com/enterprise-privacy/?ref=operators-ai.ghost.io); healthcare needs the API or the Healthcare product. | | API, any spend | Off by default | 30-day abuse log by default; some endpoints (assistants, threads, vector stores) hold state until you delete it | [Zero data retention requires OpenAI approval and a sales conversation](https://platform.openai.com/docs/guides/your-data?ref=operators-ai.ghost.io). Not self-serve. BAA by email, usually a few days. | | Connectors and apps | Business and Enterprise: not trained on app data by default. Personal: consumer toggle governs. | Data pulled from an app can land in Memory if Memory is on | The app's own privacy policy governs the app side. [Admins can force read-only](https://help.openai.com/en/articles/11487775?ref=operators-ai.ghost.io). | **Anthropic** | Surface | Training | Retention | The catch | | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Claude Free, Pro, Max (personal, includes Claude Code and Cowork from these accounts) | Opt-out model. Toggle at Settings, Privacy, "Help improve our AI models." | Toggle on: [up to five years](https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data?ref=operators-ai.ghost.io). Toggle off: 30 days. | Connector raw content (your QuickBooks ledger) is excluded from training; what Claude writes into the chat about it is not. | | Team | Off by default | Kept while you keep it; deleted within 30 days | [No BAA on Team](https://trust.anthropic.com/?ref=operators-ai.ghost.io). No zero data retention on Team. Owners can disable the thumbs feedback org-wide; do it. | | Enterprise | Off by default | Custom, minimum 30 days; Compliance API keeps Cowork and Claude Code session transcripts [six years by default](https://privacy.claude.com/en/articles/10440198-configure-custom-data-retention-controls-for-enterprise-plans?ref=operators-ai.ghost.io) | BAA exists but [excludes Cowork](https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers?ref=operators-ai.ghost.io). ZDR for Claude Code is separately enabled by Anthropic, not an admin setting. | | API, any spend | Off by default | 30 days | [ZDR is per organization, via sales, subject to approval](https://platform.claude.com/docs/en/build-with-claude/zero-data-retention?ref=operators-ai.ghost.io). New since June: the flagship "covered models" (Fable 5 and 5.1, Mythos 5 and 5.1) [require 30-day retention on every platform](https://privacy.claude.com/en/articles/15425996-data-retention-practices-for-covered-models?ref=operators-ai.ghost.io), including Bedrock and Vertex, and are excluded from ZDR unless expressly authorized. A client who was promised zero retention needs to know which model the job runs on. | | Claude for Small Business (Cowork) | Team and Enterprise: not trained on business data. Personal plans: consumer toggle governs. | Cowork sessions run on Anthropic's servers; local files you connect are processed there | Approval mode gates actions, not reads. Third-party connectors "process data on their own infrastructure, under their own terms." | **Google, xAI, and local models** **Google** | Surface | Training | Retention | The catch | | ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Gemini app on a personal Google account | On by default, including human review, via "Keep Activity." Off at myactivity.google.com/product/gemini. | 18 months by default; chats sampled for review are [kept up to three years even after you delete](https://support.google.com/gemini/answer/13594961?ref=operators-ai.ghost.io) | The most aggressive default on this list. Google's own warning on the page: don't enter confidential information you wouldn't want a reviewer to see. | | Gemini in Workspace (Business, Enterprise) | Off; "not human reviewed or otherwise used for model training outside your domain" | Admin-set, 90 days to indefinite | The account is the boundary, not the product. Same app, work account, covered by the data processing addendum. [Gemini is listed as HIPAA-included functionality](https://support.google.com/a/answer/15706919?ref=operators-ai.ghost.io) under the Workspace BAA, the easiest HIPAA-adjacent answer for a small firm already on Workspace. | | Gemini API, free tier (AI Studio) | On, with human review. The [terms](https://ai.google.dev/gemini-api/terms?ref=operators-ai.ghost.io) say in bold: do not submit sensitive, confidential, or personal information. | Not stated | Anyone prototyping a client workflow on a free key is exposed. Turning on billing changes the terms. | | Gemini API, paid | Off | Abuse logs "for a limited period," no number published | For a stated window and ZDR, Google points you to Vertex, where zero retention is a five-step checklist with an approval form, not a toggle. | **xAI** | Surface | Training | Retention | The catch | | ------------------- | ----------------------------------------------------------------------------------- | ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Grok app, SuperGrok | On unless you turn it off (Settings, Data, "Improve the Model") or use Private Chat | Deleted chats purged within 30 days | Grok inside X is the sneaky one: the training toggle lives in [X's settings](https://help.x.com/en/using-x/about-grok?ref=operators-ai.ghost.io), not Grok's. | | xAI API | Off: "never trains on your API inputs or outputs without your explicit permission" | 30 days for abuse auditing | The one vendor where [ZDR is a console toggle](https://docs.x.ai/developers/faq/security?ref=operators-ai.ghost.io) a team admin can flip, at the cost of losing Files, Collections, and Batch. Real advantage for a small shop with a no-retention clause. | **OpenRouter and local models** OpenRouter [does not train and does not store prompts by default](https://openrouter.ai/docs/guides/privacy/data-collection?ref=operators-ai.ghost.io), but it is a router, not a privacy layer. It adds a party and does not remove the downstream provider's retention. Its own [provider table](https://openrouter.ai/docs/guides/privacy/logging?ref=operators-ai.ghost.io) marks several providers "may train," and by default it can route to them unless you turn that off in account settings. The free models are where those providers live. LM Studio and Ollama are the "nothing leaves the machine" tier, and the claim holds only for locally downloaded models with web search and cloud features off. Both now sell cloud inference inside the same app; pull a cloud model and the prompt leaves. Local removes the vendor from the flow. It does not remove you: chat histories and documents sit on your disk under whatever sync your laptop already runs. That was my Monday mistake in one sentence. ### 2\. The three tiers Sort every client, and every kind of material within a client, into one of three tiers. Write it down; the writing is the product. Tier one, ordinary business material. Proposals, marketing, your own internal notes, public information about the client. Any business-plan tool with training off is fine. A personal plan with the toggle off is acceptable if you are a one-person shop and you have checked the toggle this month. Tier two, confidential but unregulated. Client financials, customer lists, contracts under NDA, pricing. Business or Team plan minimum, training off by contract not by toggle, and the thumbs feedback disabled so nobody donates a conversation. API with the default 30-day retention is acceptable. Tell the client which vendor and which plan, in writing, once. Most consulting and agency work lives here. Tier three, regulated or contractually restricted. Anything under a healthcare, financial-privacy, or government safeguarding regime, and anything a client's contract says cannot go to a third-party processor. The rule from the bench: this tier is not solved by a better model, a local model, or a scrubbing step. It is solved by the client's authorized environment and a clause in your paper. If the work has to happen, it happens inside their tenant on their tools, or on a vendor deployment the client has approved in writing, or it does not happen. The routing decision for tier three is made by whoever owns the risk, and that is not you. ### 3\. The clause Two lines for your statement of work or engagement letter, in plain language a client can approve. Adapt the nouns. "Contractor will not receive, process, or store \[controlled material as defined by the client's regime\] on Contractor systems. Where such material is required for the work, Client will provide access within Client's own environment." "Contractor uses AI-assisted tools in delivering this engagement. Such tools will be used only on material in \[tiers one and two as defined above\], on business plans that contractually exclude model training, and will not be used on Client material without Client's written approval." The second clause does two things at once. It discloses, which you want, because I am not interested in hiding how I work. And it moves the approval to the client, where the risk sits. When a client reads it, they usually approve it in a day, because it is the first time a vendor has told them the answer before they had to ask. ### 4\. The honest costs The Team or Business plan is the price of the promise. For a one-person shop that is roughly the cost of one extra seat you do not otherwise need. Pay it if you touch tier two material; it is the cheapest liability cover you will buy this year. Zero data retention is not a small-business product at either big vendor in September 2026\. Both route you to sales and reserve approval. Do not promise a client ZDR you have not been granted. Promise the default 30-day window, which is documented, and route tier three inside their environment. Checking these pages is a quarterly job, not a one-time one. Anthropic's covered-models retention rule arrived in June and quietly changed what ZDR means for the flagship. OpenAI's Codex cloud toggle sits on a different page from the ChatGPT one. Put a calendar entry on the first of each quarter: re-read the four linked pages, update your tier map, tell clients if anything moved. ### 5\. The prompt to hand your agent Paste this into whatever you run, with your own client list attached or described. > I need a data-handling routing map for my business. Here is my client list with, for each, what kind of material they give me (ordinary, confidential under NDA, or regulated/contractually restricted; if you are unsure, mark it and ask me). Here are the AI tools I use and the plan each runs on: \[list\]. Using the vendor map I am pasting below, produce: (1) a table of client by material by tier one, two, or three; (2) for each tier, the specific tool and plan I should route it to, and any setting I must change today (training toggles, feedback off, connector permissions); (3) the list of clients where my current routing is wrong, ranked by exposure; (4) a one-paragraph plain-language answer I can send each tier-two client that names the vendor, the plan, the training status, and the retention window; (5) the two contract clauses adapted to my business, ready to paste. Do not invent vendor facts. If a fact is not in the map I paste, say so and give me the URL to check. Then paste the tables from section one. If the agent's output names a plan promise you cannot find on the linked page, that is the agent guessing. Send me the case; I will fix the map. **Steal this:** before Monday, do column three of the door census for real. Every AI tool that sees client material, the plan it runs on, and whether the training toggle is off. If any line says "personal" and "don't know," that is the door to close first, and it takes four minutes. Hit reply and tell me what's on your bench this week. I read every one.