The Budget Puts £700m Into AI Security and Nothing Into Grants for Your Business. Chrome Fixed 52 Flaws on Tuesday, Several Found by Claude. Meta Switched On Product Browsing in Your Live Ads Yesterday.

On Wednesday 28 October Chancellor John Healey delivered his first Budget. The Treasury's own summary says the government is "investing £700 million to tackle the risks of AI".

The money goes to security bodies, not to products or grants: £120m more for the AI Security Institute, £40m for what the Treasury calls "a world-first national capability" to deal with agentic security incidents (an agent is software that carries out a task step by step on its own, and this is the unit that responds when one goes wrong), and £140m more for the Sovereign AI Unit, which channels government investment into UK AI firms.

The line aimed at firms like yours is smaller: £30m to pilot local partnerships that help small businesses adopt AI, starting with West Yorkshire, South Yorkshire, and York and North Yorkshire. Nothing is open to apply for yet and no date is given.

The Chancellor also committed to using AI inside government: "I'm investing in AI for the Civil Service transformation, to support saving a further £600m from back-office budgets", plus a review of NHS productivity and AI.

The measures that touch a service business more directly are not AI at all. The trading allowance, the amount a new venture can earn tax-free, triples from £1,000 to £3,000 (trade coverage puts the start at 6 April 2027; the Treasury release gives no date). The Small Business Rates Relief threshold for retail, hospitality and leisure rises so that "half of all retail, hospitality and leisure properties will pay no business rates", about 70,000 firms (trade coverage says £12,000 to £18,000 rateable value from April 2027). Tax-free mileage rates rise permanently for about 1 million self-employed people. From October 2027 online marketplaces collect VAT on qualifying UK business sales. And HMRC gets "stronger powers to collect overdue tax".

On Tuesday 27 October Anthropic's Frontier Red Team published what an unreleased internal model found when pointed at everyday software: a one-click chain in Google Chrome on Mac that ran code outside the browser's protective sandbox, a one-click flaw in Apple Safari that exposed browsing history, cookies and logged-in sessions, a lock-screen bypass on a Google Pixel 9 over USB, a Windows flaw (CVE-2026-33096) that could crash a machine with a few network packets, and a Linux networking flaw.

Anthropic says all are patched: Chrome in version 156, Safari with a fix "available to users", Android "addressed", and the Windows flaw resolved by Microsoft. Google assigned 62 CVEs (catalogued vulnerabilities) to the Chrome findings, all rated critical or high.

Google's own Chrome release notes for the same day confirm the Stable channel moved to 156.0.8078.73 for Windows, Mac and Linux with 52 security fixes, four of them rated Critical. Three of the listed reports are credited to "Xinyang Ge (Anthropic), assisted by Claude", and one High-rated fix was reported by "OpenAI Codex Security".

Anthropic estimates "several million" Windows servers listening on the internet could be affected by the Windows flaw. Its advice to anyone who ships software: "scanning your own code is more important than ever".

From Wednesday 28 October Meta turns on product browsing by default in ads that are already running. Until now it was an optional Advantage+ creative enhancement that advertisers switched on per ad.

What it does: when someone taps your ad, Meta may show them a page of product details and suggestions inside Facebook or Instagram before sending them on to your website. Meta's own description says the enhancement "may send people to an experience on Facebook and Instagram first before your website".

Meta's justification, from the notice: "On average, businesses saw 3% more conversions with in-app product browsing experiences." The footnote cites a test from 6 to 21 August 2026 across about 117,700 advertisers. The notice does not define which conversion was counted and gives no cost per conversion.

The notice carried an "Opt out" button to be used before 28 October. After that, control is per ad: in Ads Manager, open the ad, Advantage+ creative enhancements, Personalised destinations, switch Product browsing off. Advertisers report the setting can come back on when an ad is duplicated.

As of 15 October the trade outlet PPC Land could find no Meta Help Centre article, changelog or newsroom post about the change. We found none today either, so the advertiser notice as quoted is the only written source.

On Monday 27 October Google announced live integrations between Workspace and three compliance archiving providers, Smarsh, Global Relay and Mimecast, so a regulated firm can use Gemini in Gmail, Meet, Sheets, Docs and Slides while keeping the records its regulator expects.

Two routes: SMTP journaling copies Gmail, Chat and Calendar messages to the archive in real time, including BCC recipients, and direct exports send Meet recordings, transcripts and metadata to a Cloud Storage bucket, with Drive files going to write-once storage through AODocs.

The post is written for US FINRA rules. It says the requirement extends to "more than a dozen other regions" but names none, and the FCA is not mentioned. The compliant exports need the Assured Controls add-on, and no price is given.