Sunday Signal Report: November 1, 2026
Microsoft's school AI protections went live today, for districts that sign for them. Pennsylvania signed a bell-to-bell phone law and left the how to every school. A national cyber report found most districts have one or two people on security. This week the protections showed up as work someone still has to do.
Listen to this week's episode
The protections arrived as paperwork
I turned 50 yesterday and spent the weekend in Omaha with family and friends. It sent me back through three decades of technology: one-hour photo in Oman, wiring school buildings for wireless, a phone in every pocket, and now AI. The tools get faster, but the job doesn't change. I wonder what I'll be looking back on at 60.
Starting today, any school district in the country can add 10 AI protections to its Microsoft agreement: no training on student data, no AI companions, breach reports within 72 hours. Nobody adds them for you. That was the week. Pennsylvania signed a bell-to-bell phone law and gave every school until fall 2027 to decide how. Two senators gave Google until Monday to explain, among other things, why AI features are on by default on school devices. Cleveland's schools dropped a camera contract after an audit found outside agencies had searched district data more than 130,000 times, some of them through default settings. And the national K-12 cyber report found that most districts have one or two people watching the doors. Capability keeps arriving on schedule. Implementation is still a person with a calendar.
The protection is real if you sign for it
What changed: on Nov. 1 Microsoft began offering every U.S. school district the AI Safety and Privacy Standard it negotiated with the American Federation of Teachers and the United Federation of Teachers. Districts can add the 10 protections to new or existing Microsoft agreements with no renegotiation or renewal, and Microsoft's fact sheet says they are contractually enforceable. They include no training on student or educator data apart from a narrow safety and security exception, a ban on AI companions, human review for high-risk decisions, breach reports within 72 hours, notice and control over material new features, and deletion and breach duties that continue after the contract ends. The same week, SETDA's fifth State EdTech Trends report, built on 73 responses from 45 states and one territory, found that 53% of states have published guidance on buying AI tools and 79% of that guidance now includes evidence standards. It also found that 68% of state leaders say vendor claims about AI products are hard to verify independently, and 52% say their state collects no data on whether edtech tools are used or work. Sens. Richard Blumenthal and Josh Hawley gave Google until Nov. 2 to answer questions that include why AI features were made the default on school devices. And on Oct. 26 the Cleveland Metropolitan School District said it was ending its $603,000-a-year Flock license plate camera contract. Its own audit, dated Sept. 30, showed more than 500 outside law enforcement agencies had searched district camera data more than 130,000 times before outside access was cut off July 7. Some got access through the system's default settings, and 341 were approved by a named district administrator. The district had told the public that only its security staff and Cleveland police could see the data. Why it matters now: three of these four stories are about defaults. A protection a district has to add, an AI feature that ships switched on, and a camera system that shared by default all land on the same desk. A default is a policy someone else wrote for you. Rob's take: the Microsoft and AFT terms are the most concrete student-data commitments a major vendor has put in front of schools, and they should become the floor every vendor gets asked to match. But they only protect the districts that put them in writing. Cleveland is the other half of the lesson: a contract is not a log. Somebody has to read the sharing settings, and somebody has to read them again in six months. Concrete implication for a district leader: this month, send your three largest AI-enabled vendors the 10 protections and ask, in writing, which ones they will sign. Then pull the default sharing and AI settings for every system that touches student data, and put one named owner next to each.
- AI Safety & Privacy Standard for Schools fact sheetMicrosoft
- AFT, UFT and Microsoft announce National AI Safety & Privacy Standard for schoolsAmerican Federation of Teachers
- New Report: AI Remains Top State EdTech Priority Amid Growing Debate About Technology in SchoolsSETDA via PR Newswire
- Sens. Blumenthal and Hawley Question Google's Push for AI in SchoolsGovTech
- CMSD Flock searches largely unexamined, audit showsSignal Cleveland
A ban is a decision. The plan is the work.
What changed: on Oct. 26 Gov. Josh Shapiro signed Senate Bill 1014, which his office says makes Pennsylvania the 25th state with a bell-to-bell phone policy. Last week it was waiting on his signature; now it is law. Every public, charter, cyber charter and private school must adopt and implement a policy that prohibits student phone use for the entire school day, including lunch, recess and time between classes, by the start of the 2027-28 school year. The law does not require schools to take physical possession of phones, and it carves out documented medical needs, IEP and 504 accommodations, English learners' translation devices and pre-approved instructional use. City & State Pennsylvania reports that schools must also tell families how to reach students during the day, including in emergencies, which is the exact worry high schoolers named in last week's poll. SETDA's survey found strict statewide bans are now the most common state phone policy, reported by 57% of respondents, up from 22% in 2025. Student AI restrictions are running into their own definitions. Chalkbeat obtained New York City's list of 38 flagged products on Oct. 23, and several companies said they do not use the kind of AI the policy prohibits. A translation tool was flagged even though the policy carves out tools for English learners. In EdSurge on Oct. 26, Common Sense Media's Yvette Renteria cited a nationally representative study done before the New York and Los Angeles bans: of the 44% of teens who said a tool had been banned at school, 59% used it anyway on a personal device. On the instruction side of the ledger, Dr. Sabba Quidwai's Oct. 29 Designing Schools issue is worth a teacher's 10 minutes. Editing one video used to take her 10 hours. A Claude skill she built now does it in 30 to 40 minutes, and she corrects it every time. Her line: "The skill doesn't decide which story matters. I still decide what to say, what to cut and what lands." Why it matters now: restriction is easy to pass and easy to count. Pennsylvania gave schools a year and a list of exceptions. New York shows what happens when the inventory comes after the announcement. None of these policies measures learning, and none should be read as proof of it. Rob's take: bell-to-bell may well be the right call. But restriction and instruction are separate questions. A phone law answers one of them and says nothing about the school-issued laptop in front of the student or the AI on the phone at home. Quidwai's sentence is the one I would hand every teacher. Judgment about which story matters is the thing we should be teaching, ban or no ban. Concrete implication for a district leader: before any restriction takes effect, publish four things. The definition, meaning exactly what counts. The inventory, meaning which products. The exceptions process. And how families reach their kids during the day. Then spend the same energy on one assignment per grade band where students use AI and have to show their own judgment about the result.
- Gov. Shapiro Signs Bell-to-Bell Ban into Law, Students Learn Without DistractionOffice of the Governor of Pennsylvania
- Gov. Josh Shapiro signs bell-to-bell school cell phone ban into lawCity & State Pennsylvania
- NYC's AI ban confusion: what's allowed and what's banned in city schoolsChalkbeat New York
- Pause AI in Schools. But Not Before You Do This First.EdSurge
- AI Skills Challenge: Using Claude to Edit VideosDesigning Schools, Dr. Sabba Quidwai
Your neighbor's breach is your next phishing email
What changed: CIS and MS-ISAC, with CoSN, published The State of K-12 Cybersecurity 2026. As Help Net Security reported on Oct. 29, MS-ISAC warned 808 of its 6,116 K-12 members last school year that staff accounts or credentials were circulating on underground markets. CIS calls what happens next account takeover hopping: an attacker phishes one district account, then uses it to phish that account's contacts, including staff at other districts, over real accounts and authenticated email that filters tend to trust. CIS assesses with high confidence that it will continue this school year, and attackers have also posed as superintendents from hijacked accounts to commit fraud. About 65% of 1,796 malware infections at K-12 members traced to malicious ads on legitimate websites. In a survey of 426 school IT and security practitioners, 66% have one or two people responsible for cybersecurity, 11% have no dedicated security staff, 70% delayed security work over budget limits, 59% keep an incident response plan, 15% exercise it regularly, and 51% had a cyber incident in the past 12 months. The week supplied examples. Richmond Public Schools, attacked Oct. 21, turned to the FBI and a private contractor, was checking out school lunch by hand on Oct. 29. The station reports the same attack hit multiple school divisions across the country. On Oct. 29 CISA added two actively exploited flaws to its known-exploited catalog, one in Cisco ASA and FTD firewall software and one in GitLab. Why it matters now: the most important number in the report is two. Most districts are defended by one or two people, and attackers now arrive through the accounts of people you already trust. Rob's take: we still talk about school cybersecurity as a local problem. CIS just showed it is a regional one. If a staff account in one district gets taken, the next phishing email reaches the district next door from a real address. That makes credential monitoring and shared response something districts should do together, not alone. And with only 15% exercising their plan, most districts will learn how their incident response plan works during the incident. Concrete implication for a district leader: before winter break, ask your state or regional network for two things, a shared alert when staff credentials show up for sale and a current list of security contacts at neighboring districts. Then run one tabletop exercise that starts with a convincing email from a neighboring superintendent's real account.
- The State of K-12 Cybersecurity 2026Center for Internet Security
- Stolen staff logins are spreading attacks between K-12 school districtsHelp Net Security
- Richmond Public Schools turns to FBI, third party after cyberattack12 On Your Side (WWBT)
- CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oct. 29)CISA
Released, phased, promised: read the status line
What changed: Google announced Gemini 4 Carbon on Oct. 28 as its strongest model, with state-of-the-art claims in cybersecurity and long-running agentic work. It is not generally available. Google is giving it to a subset of cyber defenders first, phasing in trusted partners through its Fairwind program, and taking part in the U.S. government's voluntary pre-release testing, with developer, business and consumer access promised "as soon as possible" at an introductory $2 per million input tokens and $10 per million output tokens. The benchmark results are Google's own. Mistral released the weights of Mistral Large 4 on Oct. 29, a 1-trillion-parameter model under a modified MIT license that is free to use, modify and commercialize, except that businesses running a model-as-a-service offering need a separate commercial license. Last week this report listed those weights as promised. They are out. Mistral also wrote that it saw "a potential for uplift to conduct real attacks" in live traffic since the preview and is changing its guardrails. Moonshot's Kimi K3.1 Pro is live in its apps and API, with full weights promised "by Nov 4," and its headline coding scores come from Moonshot's own harness. Anthropic described an unreleased internal research model that chained vulnerabilities into a one-click Chrome exploit; 62 resulting CVEs, all rated critical or high, are patched as of Chrome 156. Why it matters now: a district deciding whether to pilot, host or block a model needs the status, not the leaderboard. Phased access, API-only, downloadable under a license, and promised are four different things, and only one of them puts weights on your hardware. Rob's take: the capability that showed up this week was cyber, on both sides. The same class of model that finds 62 Chrome bugs is the one an attacker wants. That turns the most boring line item in district IT, browser update cadence on every Chromebook and laptop, into a frontier AI story. Downloadable weights are not a supported deployment, and a vendor benchmark is not an independent test. Concrete implication for a district leader: confirm this week that Chrome 156 or later is running fleet-wide. Then keep a one-page register for any model staff want to use: who hosts it, what data leaves the building, the license, the release status, and whether anyone outside the vendor has tested it.
The extension had the right name and the wrong code
What changed: for about 11 hours on Oct. 29, Cursor's VS Code extension marketplace served tampered builds of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313, to macOS and Windows users. Cursor says at most 5,000 users were affected and that the builds were not developed by Anthropic. The code collected host details and the names of environment variables, tried to add an attacker's SSH key and open a reverse tunnel, and installed persistence that uninstalling the extension does not remove. Cursor says turning on SSH needed admin rights the extension lacked on most machines, that it took the attacker's server offline, and that it rebuilt the marketplace after auditing it. Separately, Zenity Labs published PleaseFix, a set of attack chains against five agentic browsers, Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas and Copilot Edge, in which instructions hidden in ordinary content such as an email or a calendar invite steer the agent. Zenity says one chain worked even in Claude's ask-before-acting mode. Those are the researchers' claims; Zenity says it disclosed the Claude chain to Anthropic. Release status, from canonical GitHub releases: OpenClaw shipped stable 2026.10.8 on Oct. 27 and 2026.10.9 on Oct. 29, plus extended-stable 2026.9.35 and 2026.9.36 on the same days. 2026.10.9 patches vulnerable runtime dependencies, keeps live credentials out of MCP CLI inspection, applies workspace-only file limits to tools the Gateway builds so delegate changes still require approval, and makes failed update rollbacks safe. 2026.10.10-beta.4 (Oct. 27) and beta.5 (Oct. 30) are prereleases, not production releases. Hermes Agent had no new release in the window. The latest stable is still v0.22.5, published Oct. 23, and its full curated notes are still waiting on v0.23.0. Why it matters now: the supply chain around agents is now an attack surface of its own. A trusted name in a marketplace is not a signature. Rob's take: every agent pitch assumes the agent is the risky part. This week the risky part was the install button. Approval prompts matter, and most of OpenClaw's notes this week are about making approvals and rollbacks hold, but no prompt protects you from code that ran before the first prompt. Concrete implication for a district leader: on any staff or student machine that runs coding agents or agentic browsers, allow extensions only from named sources and versions through device management, keep agentic browsers off machines that hold student data, and make sure you can answer one question within an hour: which machines installed what, and when.
- Security notice: malicious version of Anthropic.claude-code identified in the Cursor VS Code Extension MarketplaceCursor
- Claude Code extension poisoned with persistent SSH backdoorHelp Net Security
- PleaseFix: 0Click Exploits Against Agentic BrowsersZenity Labs
- openclaw 2026.10.9GitHub, openclaw/openclaw
- Hermes Agent v0.22.5GitHub, NousResearch/hermes-agent