Tech news, 11 November 2026: Australia's frontier AI rules, an exploited Outlook zero-day, Fortinet's advisories, New York's AI safety law and Anthropic's office tools

1. Australia will legislate mandatory rules for frontier AI developers

Prime Minister Anthony Albanese announced on 10 November that the government will legislate six mandatory guardrails for frontier AI developers, enforced by a new AI safety regulator able to impose significant penalties¹. The Conversation reports the guardrails cover security controls, managing serious risks, independent evaluation and fast incident reporting, and that the government is also considering criminal penalties; the announcement followed a review after an OpenAI agent reportedly accessed non-public Medicare statistics². Details such as which companies count as frontier and penalty levels are not yet set².

CTO take: the rules target model developers, but buyers will feel them through contracts, incident notices and possibly service changes in Australia. If you build on frontier models for Australian customers, track which providers fall in scope, ask how they will report incidents to you, and make sure your own agents cannot reach data they should not, because the trigger here was an agent accessing data. See the AI provider resilience case study and the Australia page.

2. Patch Tuesday fixes an exploited Outlook flaw

Microsoft's November 2026 Patch Tuesday fixed more than a thousand vulnerabilities, including CVE-2026-124194, an Outlook spoofing flaw that BleepingComputer reports was exploited before the patch³. Tenable reports it was used to steal NTLM hashes, and that Microsoft's advisory credits a researcher who used Claude to find it⁴.

CTO take: the fix ships through Office updates, so confirm Office, not just Windows, is patched across your fleet. Hash theft attacks also argue for reducing NTLM use and blocking outbound SMB at the edge. The volume of fixes is a sign of AI-assisted bug finding at scale; patch processes built for dozens of fixes a month need to handle many more. See defender-first AI models.

3. Fortinet publishes advisories for October's critical fixes

Fortinet published advisories on 10 November for critical flaws fixed in its October releases, including an unauthenticated code execution flaw in FortiManager and FortiAnalyzer, according to Cyber Security News⁵. Fixed FortiOS builds include 8.0.2, 7.6.8, 7.4.13 and 7.2.14⁵.

CTO take: with details now public, any unpatched device is an easy target. Prioritise FortiManager and FortiAnalyzer reachable from untrusted networks, then firewalls at branch sites. If a partner manages your Fortinet estate, ask for confirmation by version, not a general reassurance.

4. New York sets registration for frontier AI developers

New York launched an AI testing centre at Binghamton University and will require large frontier AI developers to register with the state by 1 January 2027, with the RAISE Act taking effect on 1 June 2027, TechCrunch reports⁶.

CTO take: as with Australia, the duties fall on model developers, but expect them to pass obligations to customers through terms and transparency reports. Keep a simple record of which models you use, where and for what; that will answer most questions regulators and customers ask next. See New York's youth chatbot law and the US page.

5. Anthropic launches Claude Sheets and other office tools

Anthropic introduced Claude Sheets, which builds spreadsheets from a prompt, alongside meetings and whiteboard tools, in beta for paid Claude plans, Engadget reports⁷.

CTO take: AI vendors are moving from assistants inside your tools to tools of their own. Before staff adopt them, decide where company data may live, how files are retained and shared, and whether these tools fit your existing governance; see agents and enterprise SaaS seats.

What I'd do this week

• Confirm Office updates are applied fleet-wide and review NTLM exposure.
• Patch Fortinet management and edge devices, starting with anything internet-facing.
• List the frontier models you use in Australia and the US, and who provides them.
• Set a policy for new AI office tools before teams adopt them.

I am based in India, the United States and the UAE, working globally. See where I work, or analyse your challenge and bring the result to a call.