Should Your MSP Take the Fall If AI Leads to Malware? | MSP agreements

A significant development highlighted is the recent compromise involving ConnectWise Backup, which originated from ConnectWise’s acquisition of SkyKick. The breach stemmed from the compromise of OAuth app credentials within Microsoft 365 tenants, enabling attackers to access and elevate permissions, primarily targeting MSP tenants. The full method of credential compromise has not been disclosed. However, the presence of lingering OAuth permissions is posited as an ongoing risk vector.

Further details presented by Amy Babinchak specify that attackers targeted a few hundred MSP tenants, seeking to elevate Exchange permissions and control additional ConnectWise-related OAuth apps. It is emphasized that deactivating an unused app is insufficient, as historic use of SkyKick over the past decade could still leave MSPs exposed. A recommended response is a comprehensive review of OAuth permissions, referencing guidance from Guardz, which outlines multiple mitigation steps for MSPs to follow, regardless of current product usage.

Other topics addressed include evolving responsibilities when artificial intelligence (AI) tools direct users to malicious destinations. MSPs were advised to maintain protective controls and thorough documentation, as operational accountability typically resides with the MSP, especially when security layers like EDR effectively prevent incidents. Additional coverage centers on Anthropic’s creation of a public benefit corporation, MapQuest’s feature updates including surveillance detection, and Pax8’s announcement of AI agent solutions that MSPs may resell to clients.

The practical implications for MSPs and IT decision-makers center on maintaining vigilance over third-party integrations and long-lived permissions, enforcing clear lines of communication with clients and vendors, and proactively documenting risk mitigation efforts. Vendor management and operational transparency, especially regarding software vendor issues or AI-related incidents, are underscored as essential practices for reducing harm and preserving client trust.

1. Show Rundown & Banter: AI security, the ConnectWise incident, MapQuest, Anthropic, and Pax8.
2. Something Fun: Michelangelus Font
   • Microsoft’s project preserving Michelangelo’s work inspired a new font for Word.
   • https://www.microsoft.com/en-us/download/details.aspx?id=108856
3. Question of the Week: Who’s Responsible When AI Directs Users to Malware?
   • A user followed ChatGPT’s instructions to a fake verification site. EDR caught the threat. Where does the MSP’s responsibility begin and end?
4. ConnectWise Backup Incident
   • Attackers exploited application credentials and excessive permissions, affecting a targeted group of MSPs.
   • https://app.notion.com/p/Connectwise-Backup-Incident-3f98e07a4534804c9181e7c8c603dde3?pvs=21
5. MapQuest’s Comeback
   • MapQuest adds surveillance-camera alerts to its maps.
   • https://app.notion.com/p/MapQuest-surveillance-notices-3e88e07a453480f38df1d2fb15eeb486?pvs=21
6. Anthropic’s Public Benefit Corporation
   • A new structure aims to direct company equity toward a public-benefit mission.
   • https://app.notion.com/p/Anthropic-public-benefit-LLC-3fe8e07a453480f0834fd414d8e470f9?pvs=21
7. Pax8’s AI Revenue Opportunity
   • MSPs can manage AI agents, control usage, and set their own pricing.
   • https://app.notion.com/p/PAX-8-AI-money-making-opportunity-3fe8e07a45348022b281d63cd11355df?pvs=21
8. Tales from the Field: The Ungrateful Client?
   • An MSP worked nights and weekends to recover from a software update failure, only to be fired by the client.

About the SMB Community Podcast: Weekly business advice for small MSP owners from Amy Babinchak and James Kernan of the Small Biz Thoughts community — MSP sales, MSP pricing and agreements, hiring and leading an MSP team, MSP operations, selling your MSP, and AI for small MSPs. Produced by MSP Radio. More for MSP owners at smallbizthoughts.com.

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.