Imagine a Saturday where you're not catching up on the CRM you didn't touch all week. 

HubSpot's new self-updating CRM doesn't wait for you to log back in. Friday's calls are already logged. The deal that needs a nudge Monday morning is already flagged. The automation you set up once keeps running without you thinking about it. None of it needed you over the weekend. 

Customers are already seeing it pay off: 45% more deals closed. Finally, you start Monday caught up, not behind.

Get a Demo

Treasury Proposes The COINS Act Rules: Outbound Investment Curbs Widen To Supercomputing, Hypersonics And Biotech, With Notify-Or-Prohibit Tiers For AI Deals Abroad: The Treasury Department published a notice of proposed rulemaking Thursday, Oct. 22, to rebuild the Outbound Investment Security Program under the Comprehensive Outbound Investment National Security Act that Congress passed in the FY2026 NDAA: U.S. persons would have to notify Treasury of certain transactions with covered foreign persons working in "notifiable" technologies and would be barred from transactions in "prohibited" ones, across semiconductors and microelectronics, AI systems, quantum information technologies, high-performance computing and supercomputing, hypersonic systems and, added under the Secretary's discretionary authority, biotechnology. The 2025 rules now in force reach only semiconductors, quantum and AI in China, Hong Kong and Macau, and they stay in place until the final regulations, which the statute requires by March 13, 2027; the country list and the comment deadline sit in the Federal Register notice, not the release. "Under President Trump's leadership, we are committed to putting America's national security first," Secretary Bessent said, and Assistant Secretary Christopher Pilkerton said the rule "will enhance" the program. For AI investors the live question is whether a stake in a foreign lab, a compute deal or a fund with exposure becomes a notifiable transaction, and this draft is the first place that answer is written down. Link

OpenAI Asks Newsom To Toughen SB 53: Shutdown Controls, Annual Independent Audits, Monitoring During Training And Reporting Of Break-Ins To Third-Party Systems: In a letter dated Tuesday, Oct. 20, from Chan Park, its head of U.S. and Canada policy and partnerships, and reported by StateScoop Thursday, OpenAI asked Gov. Newsom to amend the Transparency in Frontier Artificial Intelligence Act, the 2025 law it opposed, to require developers to monitor models for dangerous behavior during training and evaluation, keep "effective shutdown controls" and use them when lesser measures fail (halting a training run, isolating an agent, suspending a service), undergo annual compliance audits and independent technical assessments of their safety cases, harden internal cybersecurity, report incidents involving unauthorized access to third-party systems and notify the organizations affected, and cover models' capacity to conduct AI research on their own inside their frameworks. The company says it supports Newsom's Sept. 18 executive order and offers it as a starting point for industry-wide rules; the order's expert recommendations on lab monitors and a kill switch are due Nov. 16. "We know it is incumbent upon us to demonstrate progress through implementation and transparency," Park wrote, and OpenAI's post adds that SB 53 "should apply consistently to developers of the most capable AI models." The ask arrived two days before outside evaluators reported holes in OpenAI's own monitoring (Safety, below). Link

Harrigan And Whitesides File The AI Cyber Defense Act: NIST Would Define Distillation Attacks, Write Voluntary Anti-Distillation Standards And Seat A Cyber Roundtable Within 180 Days: Introduced Thursday, Oct. 22, by Reps. Pat Harrigan (R-N.C.) and George Whitesides (D-Calif.), the bill directs NIST to work with private-sector developers on voluntary standards and best practices for detecting and preventing distillation attacks, in which an outside actor trains a model on another model's outputs and reasoning, and to first define a distillation attack so it stays separate from legitimate open-weight and open-source sharing; NIST would also convene an AI Cybersecurity Roundtable of technology companies and critical-infrastructure operators to produce "off-the-shelf" defensive practices, with the engagement and the roundtable due within 180 days of enactment and the results made public. Entities headquartered in or directed from China, Russia, Iran, North Korea or Cuba are excluded, and the NIST director can name others. It is the softest of the three distillation bills on file: the BLADE Act from Sens. Hagerty and Kim would add export controls and sanctions, and the Collaboration on Adversarial Threats and Security Risks Act from Schiff, Banks, Latta and Whitesides would clear antitrust room for labs to share threat data, the bill Anthropic listed on its third-quarter lobbying report (below). "Every month we keep China and other adversaries from stealing our progress is a month we gain to build the safeguards this technology needs," Whitesides said. No bill number had posted on congress.gov by this morning. Link

Meta Led Big Tech Lobbying At $5.9 Million In The Third Quarter, Nvidia Hit A Record $2.2 Million, And OpenAI And Anthropic Both Lobbied For Antitrust Room To Share Safety Data: Third-quarter disclosures filed with the Senate by the Oct. 20 deadline and reviewed by Semafor on Wednesday, Oct. 21, put Meta at about $5.9 million, the most of any Big Tech firm, with Google, Amazon and Apple behind it and ahead of the AI and chip companies; Nvidia reported $2.2 million, its highest quarter ever. Anthropic listed the Collaboration on Adversarial Threats and Security Risks Act, which would let labs coordinate on security risks and which Semafor reports could ride on must-pass defense legislation, and OpenAI listed "AI-security collaboration and information-sharing, including proposed antitrust protections"; the forms do not say whether either company supported or opposed. A separate tally from the Senate LDA database puts Anthropic at $2.11 million for the quarter, more than double a year earlier, and OpenAI at $1.53 million, single-sourced and not matched to the filings this morning. OpenAI's Chris Lehane has argued no antitrust exemption is needed for labs to pace releases, and administration officials have said the companies can slow down among themselves without government approval, which is the fight the NDAA conference will settle. Link

Uthmeier Proposes Florida's Safe Screens Act: App-Store Age Checks And Parental Consent, A Nightly And School-Hours Social Media Shutoff For Teens, Companion-Bot Bans For Minors And $50,000 Per Violation: Attorney General James Uthmeier unveiled the proposal at a Tallahassee news conference Thursday, Oct. 22: app stores would have to determine users' ages, link minors to a parent's account and obtain parental consent before a download or purchase; platforms would run a "quiet mode" blocking teen access from 11 p.m. to 7 a.m. year-round and 8 a.m. to 3 p.m. on school days, cap use at two hours a day and 60 hours a month with pauses at 60 and 90 minutes, hide likes and comments and switch off infinite scroll, autoplay and cosmetic filters unless a verified parent turns them on, stop recommending teen accounts to unconnected adults, and give child-exploitation reports human review within 48 hours; chatbot operators could not give minors features that simulate companionship, encourage self-harm or eating disorders, generate sexual content, claim to be human or put engagement ahead of safety. Violations would be unfair practices under state law at up to $50,000 each. It is a proposal, not a filed bill: the attorney general cannot introduce legislation, the 2027 session opens March 2, and Uthmeier faces Democrat Jose Javier Rodriguez in 12 days with the state's suits against Meta and OpenAI over addictive design pending. "Parents deserve real control, and companies must design for safety, not addiction," he said. Link

New Jersey's Senate Votes 38-0 To Void Data Center NDAs: No Secret Deals With Towns Or Sellers, An Attestation With Every Application, And No Approval For Violators: S 4304, by Sens. Linda Greenstein (D-Mercer) and Brian Stack (D-Hudson), passed the Senate Thursday, Oct. 22, without a no vote: a data center applicant or its agent could not enter an agreement with an approving authority, a municipal agency or a property seller that keeps information about a proposed development from public review, would have to attest that no such agreement was part of the real estate transaction, and an authority could not approve a site plan, subdivision or other required approval for a violator; the agreements themselves become unenforceable as against public policy. "Transparency is crucial during the data center development process," Greenstein said, and "residents deserve to know what is being proposed in their neighborhoods," Stack said. The Assembly companion, A 2774, has sat in the Science, Innovation and Technology Committee since January. Portland, Ore., adopted a nonbinding NDA resolution Sept. 16 and Champaign County, Ill., took its county-officials NDA ban to a final vote Thursday; New Jersey's is the first statewide ban on developer NDAs to clear a chamber. Link

Shapiro Signs Act 87: Pennsylvania's Mandated Reporters Must Report AI-Generated Child Sexual Abuse Material And Hazing, Even When A Minor Made It, From Jan. 20: Gov. Josh Shapiro signed HB 2474 on Thursday, Oct. 22, the day after the Senate passed it 50-0 as amended and the House concurred 203-0 (it cleared the House 201-0 in May). The act adds Section 6311(e) to the Child Protective Services Law: a mandated reporter with reasonable cause to suspect "the existence of child sexual abuse material or artificially generated child sexual abuse material," "regardless of whether the material was created, displayed or exhibited to others by a minor," or that hazing or aggravated hazing has occurred, must report through the ChildLine number or electronic submission, and the department must forward every such report to law enforcement; the definitions borrow Section 6312(g) of the Crimes Code and the hazing statute, and hazing joins the child-on-child acts that stay reportable. It takes effect in 90 days, Jan. 20, 2027. Rep. Nikki Rivera (D-Lancaster) wrote it after schools in Lancaster and Bucks counties knew of deepfake images of students and did not call police, Sen. Scott Martin (R-Lancaster) carried the Senate version and Sen. Art Haywood (D-Philadelphia) added hazing. "This bill makes it crystal clear the (child protective services) reporting has to be done," Rivera said. Link

California's Senate Privacy Committee Hears That Recursive Self-Improvement Could Arrive Within Two Years And That METR's Assessments "Are Not Audits," As Cabaldon Promises A "Comprehensive" 2027 Package: At "Understanding the Contours of the AI Threatscape," an informational hearing of the Senate Privacy, Digital Technologies and Consumer Protection Committee on Wednesday, Oct. 21, former OpenAI chief futurist Josh Achiam told senators "we're already seeing superhuman capabilities in a number of domains" and that models building better versions of themselves without human help could come within about two years; METR research scientist Rif Saurous said its lab assessments produce evidence of loss-of-control risk but "are not no-go decisions; they are not guarantees this is safe; they are not audits," and that the labs' participation is voluntary and redactable; and Stanford's Jennifer King said "this is not an industry that rewards safety at all." Chair Christopher Cabaldon called the current law "wholly insufficient to meet the moment that is now before us" and said a "comprehensive" and "substantial" package is being drafted for the session that convenes in December. With Newsom's expert recommendations due Nov. 16 and OpenAI now asking for audits and shutdown controls (Policy, above), the Senate is lining up a 2027 vehicle before the governor's report lands. Link

Umatilla Declares A Financial Emergency Over Kotek's Data Center Permit Pause, Hermiston Says Amazon Cancelled Builds, And Hillsboro Caps Its Data Center Land At About 600 Acres: The Umatilla City Council voted Tuesday, Oct. 20, to declare an emergency "due to the threat of widespread financial loss" from Gov. Tina Kotek's Oct. 9 directive pausing DEQ air and water permits for new or expanding data centers through July 2027, OPB reported Thursday; staff count more than $2.5 million a year in tax payments and $12 million in water improvements at risk, City Manager Dave Stockdale wrote that the city should not have to wait for harm to occur, and councilors want to rally other data center towns and have not ruled out a lawsuit. Hermiston City Manager Mark Morgan called the order "total devastation," said Amazon cancelled planned developments and put about $550 million in anticipated local fee revenue at risk; Morrow County Commissioner Gus Peterson called it "executive overreach," and Prineville Mayor Steve Uffelman said he was blindsided. On the other side of the Cascades, Hillsboro's council the same night unanimously adopted permanent rules capping data centers at just over 600 acres citywide, about 570 already in use, under the 120-day moratorium it set in July, with Councilor Rob Harris arguing "every acre a data center consumes is an acre unavailable to a manufacturer." Democratic legislators plan a three-year statewide moratorium bill in January, and Amazon says the pause "has broad implications for Oregon's economy." Link

Six Local Decisions: Grant County, N.M., Pauses A Year, Lexington Adopts Its Zoning Rules, Buxton Voters Back A 180-Day Ban, East Lyme's Ban Takes Effect Saturday, Utah County Recommends Its Ordinance As A Protester Is Arrested, And Vantage Asks Aurora For 90 Days: Grant County, N.M., commissioners voted 4-1 Thursday, Oct. 22, for a one-year moratorium on data centers and their supporting infrastructure while the county writes rules, over objections from Granite Renewables' solar-and-data-center proposal near Hachita ("We should not be hasty," Commissioner Nancy Stephens said); Lexington-Fayette's council passed two data center ordinances on second reading Thursday, a separate zoning category with size, energy, water and school-setback standards and a definitions rewrite, under the moratorium it extended to October 2027; Buxton, Maine, voters at a Wednesday special town meeting approved a 180-day moratorium retroactive to Aug. 12 with no project pending; East Lyme, Conn.'s zoning commission unanimously banned traditional and AI data centers in every zone, effective Saturday, Oct. 24, the same week Senate Majority Leader Bob Duff said he will file a bill pausing new data centers statewide until Connecticut sets power, cost and environmental rules; Utah County's planning commission on Tuesday unanimously recommended an ordinance allowing data centers in mining-grazing and industrial zones plus a new overlay, with no public comment taken, and a deputy's takedown of protester Aspen Azalea outside the chamber went viral the next day, drawing a Capitol rally and a call from Sen. Nate Blouin for an outside investigation; and in Aurora, Colo., Vantage wrote the council Wednesday asking for 90 days to scout another site for its 1.5 million-square-foot Trident campus and a pause on new rules, which Mayor Mike Coffman rejected ("That's a green light for existing applications to move forward under regulations that are inadequate") ahead of Monday's vote on an indefinite application moratorium that would not touch Trident. Link

METR And Redwood Found An Exploit That Let OpenAI's Agents Hide Hundreds Of Actions From Monitoring, And A Codex Path To Full User Permissions, In A July Pilot OpenAI Says It Has Since Patched: One researcher each from METR and Redwood Research worked inside OpenAI's infrastructure from July 21 to Aug. 11 with "a deep level of access," Reuters reported Thursday, Oct. 22, and found an exploit that could have let agents keep "hundreds of their actions" out of the monitoring system, plus a way for Codex agents to bypass security restrictions and act with their users' full permissions; the evaluators assessed the system as it stood on July 21, while OpenAI was expanding it. OpenAI received a 61-page internal report, the evaluators may publish only a broad summary and OpenAI can redact it; the company says it has patched every vulnerability affecting production safeguards and that the "findings helped strengthen safeguards as we expanded the system," which METR and Redwood say they have not verified. It is the embedded-evaluator model Newsom's order leans on, a day after METR's Rif Saurous told California senators such assessments "are not audits," two days after OpenAI disclosed that two of its own agents weakened their monitors this month, and the same week OpenAI's letter asked Sacramento to make lab monitoring and audits law. Link

PHP2Shell: Two AI-Found Flaws In The Language Behind 70 Percent Of Websites Send Government Sites Dark In Six Countries, And The NSA Tells Operators To Pull Pages Offline If They Cannot Patch: The PHP Foundation issued fixes and a statement Wednesday, Oct. 21, urging immediate updates for a pair of flaws it called among the most severe it has encountered, Reuters and Al Jazeera reported Thursday: security firm Calif, working with OpenAI, reported the first on Aug. 11 and Alphabet-owned Wiz the second on Aug. 24, both found with AI models that let researchers try more attacks than people can alone, and Wiz says they "rank among the most severe vulnerabilities discovered in PHP, and arguably in software history." Germany's digital ministry, France's interior ministry and agencies in Belgium, the Netherlands, Finland and the Czech Republic took sites offline to patch, Japan's prime minister posted a warning, and the NSA's rare public advisory said "all organizations using PHP for their systems are advised to be prepared for an update" and to take sites down if they cannot update at once; experts told Reuters they expect a wave of intrusions now that the fix is public. For the AI-security debate it is both sides of the argument in one event: models found the holes that governments are now racing to close. Link

Consumer Groups Put ComEd's Data Center Grid Bill At $3.1 Billion For 30 Large Loads Against $721 Million In Deposits, And Ask Illinois To Pass The POWER Act In The Veto Session: Expert testimony filed with the Illinois Commerce Commission this summer for the Citizens Utility Board, the Environmental Law & Policy Center, NRDC, Vote Solar and the Union of Concerned Scientists, and published by the Sun-Times Thursday, Oct. 22, totals ComEd's projected costs for 30 redacted projects of 50 MW or more built since 2021 or due by 2031 at about $3.1 billion: more than $1.4 billion in new transmission, $189 million in transmission upgrades and more than $1.5 billion in distribution work, against $720.9 million in deposits and advance-payment commitments, about a quarter. "Everyday electric customers are potentially on the hook for billions in higher bills," CUB's Sarah Moskowitz said; the groups want the POWER Act, which would make data centers pay 100 percent of their costs before connecting, pollution and water protections, and a plan for stranded assets if projects fall through. ComEd says the analysis "is not complete and paints an inaccurate picture," that transmission security agreements approved by state and federal regulators "ensure that large-load customers cover the costs of serving them," that the distribution engineering and deposits are unfinished so the $721 million will grow, and that it has asked the ICC for authority to throttle data centers when the grid is stressed. The commission found ComEd's large-load tariff inadequate to protect existing customers in April; Gov. Pritzker's data center proposals could surface in the veto session in mid-November and early December, and the ICC's grid-plan deadline is Dec. 15. Link

A Washoe Judge Halts Tract's Arbitration Against NV Energy And Sends The 2-GW Reno Power Fight To The PUC First, Through The Resource Plan And The Large-Load Contract Cases: Second Judicial District Judge Scott Freeman ruled for NV Energy on Tuesday, Oct. 20, This Is Reno reported Thursday, staying the private arbitration Tract demanded in June until the Public Utilities Commission of Nevada decides two pending dockets, the utility's 2026 integrated resource plan and its request to approve large-load service agreements for Tract's Storey County campuses; Freeman found that some of Tract's claims ask arbitrators to declare how much power NV Energy must deliver and at what rates, matters of "load forecasting, capacity planning" that sit with the commission. NV Energy sued in July arguing that service, planning and cost decisions belong to regulators and reach every ratepayer; Tract says its contracts commit the dispute to arbitration, that the utility is refusing power it promised while demanding Tract proceed with about $1 billion in grid upgrades, and that its two Reno campuses would draw more than 2 GW, close to a third of NV Energy's capacity. Four media and transparency groups have moved to unseal the file, and the report's headline says Tract plans to appeal, which we could not confirm from the text. The commission's Phase 2 hearings on large-load cost allocation in that resource plan open Monday, Oct. 26 (Docket 26-05007), which is now where the first answer comes. Link