Will | FixChat (@FixChatWill) header
Will | FixChat (@FixChatWill) profile picture

Will | FixChat

@FixChatWill

Founder of FixChat, building in public. Practical notes for MSPs and IT teams on M365, tenant migrations, and keeping AI agents in IT on a short leash.

Joined August 2026
  • Tweets368
  • Following142
  • Followers36
Your MFA worked. The attacker still got in.

Your MFA worked. The attacker still got in.

Article · @FixChatWill
1
1
79
Forever Security showed a browser extension on claude.ai can drive Claude Desktop through Dispatch and auto-click every Allow prompt. They've also seen personal Claude accounts with Dispatch on corporate endpoints. Do you know which of your endpoints have one?
Image from Will | FixChat (@FixChatWill)
2
1
32
forever.security/blog/thisba…
ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS · Forever Security

ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS · Forever Security

A Claude Dispatch flaw let a browser extension escape the browser and run code on the OS through Claude Desktop, even on another computer. Dispatch is being retired, but the design flaw behind it...

forever.security
12
OpenAI priced GPT-6 Cyber at $20/$100 per million tokens. Daybreak Red alone isn't enough, separate model approval and IP allowlisting are required. Worth jumping from 5.6 Cyber at $12.50/$75?
Checklist card. Headline: Four gates before Cyber. Four gates: Daybreak Red org, Separate GPT-6 Cyber approval, SSO and MFA on, IP allowlist for API. Source: OpenAI Daybreak onboarding.

ALT Checklist card. Headline: Four gates before Cyber. Four gates: Daybreak Red org, Separate GPT-6 Cyber approval, SSO and MFA on, IP allowlist for API. Source: OpenAI Daybreak onboarding.

1
19
developers.openai.com/api/do…
GPT-6-Cyber Model | OpenAI API

GPT-6-Cyber Model | OpenAI API

developers.openai.com
6
Microsoft's Message Center says GPT-6 Astra and Claude Fable 5.1 show up in Copilot for Word, Excel and PowerPoint only where an admin turns on usage-based billing and allocates credits. General availability slipped to early December. Who sets credits for your clients' users?
Two-column card. Headline: Same Copilot, two meters. Left: In the license — Auto, GPT 5.6, Sonnet (fair use). Right: Uses credits — GPT-6 Astra, Claude Fable 5.1. Source: Microsoft Learn, Nov 3.

ALT Two-column card. Headline: Same Copilot, two meters. Left: In the license — Auto, GPT 5.6, Sonnet (fair use). Right: Uses credits — GPT-6 Astra, Claude Fable 5.1. Source: Microsoft Learn, Nov 3.

1
1
24
mc.merill.net/message/MC1519…
MC1519122 - Microsoft Copilot: UBB models in Chat and Word, Excel, and PowerPoint via the model...

MC1519122 - Microsoft Copilot: UBB models in Chat and Word, Excel, and PowerPoint via the model...

Microsoft is rolling out usage-based billing (UBB) models for Copilot Chat and Copilot in Word, Excel, and PowerPoint starting November 2026. Users need a Copilot subscription…

mc.merill.net
7
Todyl says an attacker has been signing into MSP and client tenants as the apps themselves since at least Oct 28, using stolen secrets that still worked. No MFA prompt, and user-scoped Conditional Access doesn't apply. Which of your app registrations still run on a client secret?
Comparison card. Headline: Same tenant. Two sign-ins. Workload identity CA needs Workload ID Premium. Source: Todyl. Left, user sign-in: MFA prompt, Conditional Access applies. Right, app plus secret: no MFA prompt, user Conditional Access doesn't apply.

ALT Comparison card. Headline: Same tenant. Two sign-ins. Workload identity CA needs Workload ID Premium. Source: Todyl. Left, user sign-in: MFA prompt, Conditional Access applies. Right, app plus secret: no MFA prompt, user Conditional Access doesn't apply.

1
9
todyl.com/blog/stolen-app-cr…
Stolen App Credentials, Real Access: An Actor Is Signing Into Entra ID and Azure DevOps as Your...

Stolen App Credentials, Real Access: An Actor Is Signing Into Entra ID and Azure DevOps as Your...

Todyl is investigating an actor that signs in to Microsoft Entra ID as application service principals using valid, pre-existing credentials.

todyl.com
5
How I'd actually stop device code phishing: check sign-in logs for who uses the flow, exclude the couple of shared device accounts that need it, then block it with Conditional Access in report-only mode first. No P1? Security defaults block it, with no exceptions.
Will | FixChat (@FixChatWill) profile pictureWill | FixChat
@FixChatWillNov 5
Your MFA worked. The attacker still got in.

Your MFA worked. The attacker still got in.

Article · @FixChatWill
1
1
23
SemiAnalysis's new GDPx benchmark tops out at 12%, but the number I'd look at is cost per task. Opus 5.5 scored 12.0 at $51.41 a task, Gemini 4 Carbon 10.9 at $16.29. Would you pay about three times the price for 1.1 more points on your own agent work?
Comparison card. Headline: 1.1 points, costs 3x. Claude Opus 5.5 scores 12.0% at $51.41 per task; Gemini 4 Carbon scores 10.9% at $16.29 per task. GDPx, cost per task. Source: SemiAnalysis.

ALT Comparison card. Headline: 1.1 points, costs 3x. Claude Opus 5.5 scores 12.0% at $51.41 per task; Gemini 4 Carbon scores 10.9% at $16.29 per task. GDPx, cost per task. Source: SemiAnalysis.

2
1
79
gdpx.semianalysis.com/
GDPx: The General Agentic Benchmark

GDPx: The General Agentic Benchmark

GDPx measures general agentic capability across 11 economically valuable domains, built with domain-specialist partners. Live leaderboard, per-domain results, and cost per task for frontier models.

gdpx.semianalysis.com
20
Entra retired the memberOf operator yesterday, per Windows Report on MC1529463. Nothing breaks loudly. Dynamic groups and admin units using it just freeze in their last known state, so new hires don't get added and leavers stay in. Did you go assigned or rebuild the rule?
FixChat checklist card headed "Three things stopped moving": dynamic groups, dynamic admin units and access package auto-assignment, each marked stops updating. Support line: Replace the rule or switch to assigned.

ALT FixChat checklist card headed "Three things stopped moving": dynamic groups, dynamic admin units and access package auto-assignment, each marked stops updating. Support line: Replace the rule or switch to assigned.

1
18
windowsreport.com/microsoft-…
Microsoft Entra ID memberOf Operator Retires Tomorrow, Admins Must Act Now

Microsoft Entra ID memberOf Operator Retires Tomorrow, Admins Must Act Now

Microsoft issues a final warning as Entra ID memberOf retires tomorrow, affecting dynamic groups and entitlement management policies.

windowsreport.com
17
ChatGPT and Codex are moving to one shared allowance on Pro, per BleepingComputer, and only Instant stays outside it. Easier to track, but a long Codex session now spends the same pool your heavier chat work needs. When it runs dry, do you wait for the reset or buy credits?
A battery-style allowance bar. A long Codex session fills most of it as spent, a small Chat segment follows, and little is left, with a reset marker below. Headline: Same fuel. Less room. Support: Chat + Codex on Pro. Instant stays outside.

ALT A battery-style allowance bar. A long Codex session fills most of it as spent, a small Chat segment follows, and little is left, with a reset marker below. Headline: Same fuel. Less room. Support: Chat + Codex on Pro. Instant stays outside.

1
69
bleepingcomputer.com/news/ar…
OpenAI says it's doubling Pro usage limits and bringing Work features to Chat

OpenAI says it's doubling Pro usage limits and bringing Work features to Chat

OpenAI has just confirmed that it's rolling out ChatGPT Work capabilities directly into regular Chat, while also combining usage allowances across ChatGPT and Codex.

bleepingcomputer.com
12
Windows Hello and Mac Platform SSO become standalone MFA factors in Entra from early November, per Maxime Hiez. Both are device-bound, so a user with only that method can't do MFA from another device and won't be prompted to add one. Are you requiring a portable passkey first?
Two padlocks. Left, dark and closed: No backup. Locked out. Right, lit and open with a USB security key: Portable passkey enrolled first. Headline: New device. Another way in.

ALT Two padlocks. Left, dark and closed: No backup. Locked out. Right, lit and open with a USB security key: Portable passkey enrolled first. Headline: New device. Another way in.

1
15
maxime.hiez.ca/en/blog/2026-…
WHfB and Platform SSO become standalone MFA factors in Entra ID

WHfB and Platform SSO become standalone MFA factors in Entra ID

maxime.hiez.ca
7
Microsoft retires its own SMS and voice MFA in Entra starting Feb 1, 2027 (via BleepingComputer). In small business tenants I'd bet the holdouts are the owner and the front desk phone. Has anyone run the SMS/voice scanner across their tenants yet? bleepingcomputer.com/news/mi…
Microsoft urges Entra ID admins to migrate users to passkeys

Microsoft urges Entra ID admins to migrate users to passkeys

Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027.

bleepingcomputer.com
38
SkyW4lker doesn't fake the login page, it gets your user to type the attacker's code into the real Microsoft device login, and MFA passes because they did it. Most small business users never need device code sign-in, so who's blocking it in every tenant? thehackernews.com/2026/10/am…
Real Microsoft device login page asking the user to enter a code, with its own warning 'Do not enter codes from sources you don't trust' highlighted.

ALT Real Microsoft device login page asking the user to enter a code, with its own warning 'Do not enter codes from sources you don't trust' highlighted.

33
Load more