Sponsored by
The TV Box Story Got Worse
Three weeks ago, I told you Anthropicโs red team thinks AI could copy itself onto cheap Android TV boxes by Christmas.
Monday Google announced the boxes were already compromised.
By the company that made them.
Hereโs what happened.
Googleโs Threat Intelligence Group took down a botnet called XCPE.
More than 1.3 million Android TV set-top boxes, infected before they left the factory.
The backdoor was written into the firmware by Videostrong.
Thatโs the Shenzhen manufacturer behind the MECOOL brand and a contract builder for other labels.
Translation: nobody broke in.
The door was built in.
The builder sold the key. ๐ณ
Hereโs how it got past Google.
Videostrong submitted the boxes for certification with the malicious code dormant.
It only loaded after the first boot in someoneโs living room.
Google admits that exploited a gap in its own tests.
Once live, the boxes were rented out as residential proxies and used for ad fraud.
More than a dozen malware families rode along as modules.
Googleโs partner TrendAI counted 1,472,554 infected devices across 206 models.
Owners canโt remove it.
Think about that.
The malware is in the firmware.
A factory reset puts it right back.
It wasnโt only TV boxes.
Google found the same backdoor on telehealth devices, karaoke machines and digital signage.
Google says taking down the affiliate servers cuts criminal access to at least 10 million more devices.
Videostrong is banned from certified Android for good.
Hereโs why these matters to you.
Every โsmartโ thing in your office and your clientsโ offices has firmware someone else wrote.
The breach you canโt patch is the one that shipped in the box.
What to do, in five minutes:
If you own a MECOOL box or an off-brand Android TV box, unplug it from the network today.
On any Android TV device, open the Play Store settings and check for Play Protect certification.
Uncertified means no Google security checks, which makes it a stranger on your Wi-Fi.
The same goes for the cheap digital signage in your lobby and the karaoke machine in the break room.
Speaking of connections...
The whole story today is about a connection you didnโt choose.
The same week, the most useful thing you can do with AI is a connection you do choose, on purpose, with boundaries.
Claude Code can plug into your tools through MCP and go from a brief to a review-ready draft in one session.
Set up badly, thatโs another door on your network.
Set up properly, itโs the biggest leverage youโll get this quarter.
I put together a free 23-page build-along guide: connect Claude Code to your tools safely, run a working demo, and turn your first brief into a marketing draft you can review.
Videostrong connected 1.3 million boxes nobody asked for.
Connect one thing you did ask for.
Read the permissions first. ๐
Did You Know?
In March 2025 Google helped take down BadBox 2.0, a botnet of more than 10 million uncertified Android TV boxes.
It sued 25 Chinese entities over it that July.
Google now says that takedown is what pushed XCPEโs authors to get better at hiding.
This time they hid inside certified devices. ๐
A CRM so smart, it updates itself.
HubSpot's CRM is so smart, it now updates itself. Calls get logged and summarized the moment they end. New leads get researched and a first outreach drafted, automatically. Deals move forward on their own, with next steps flagged before you have to ask.ย
Even the one repetitive task you've been meaning to fix can now run itself, no code required. Customers using it are already seeing the difference.ย
This isn't the CRM you have to work hard to figure out. It's the one already working before you log in.
๐๏ธ The Tip AI News ๐๏ธ
Google is moving Geminiโs best model behind a $19.99 wall on November 13.
Google AI Plus subscribers, the $4.99 tier, have been getting emails since mid-October saying manual Pro model selection moves to AI Pro and AI Ultra.
They keep Flash-Lite and Flash in the Gemini app and AI Mode.
Old Pro chats stay readable.
Continuing one means switching to a lesser model.
Google says the exact date is set per account.
November 13 is the date in the emails subscribers have shared.
Hereโs the context.
On October 9 free Gemini users lost Flash and Pro and were left with Flash-Lite, the lightest model Google makes.
Now the cheapest paid tier loses Pro too.
To keep the model you had in September, the bill goes from $4.99 to $19.99.
Thatโs a 4x price rise with no feature added. ๐ฐ
Hereโs why.
Two weeks ago, Google shipped Gemini 4 Argon to AI Pro subscribers and above.
Last week it shipped Gemini 4 Carbon to nobody yet.
Last Wednesday it reported $51 billions of capex in one quarter and a stock that fell 10%.
The model tiers are how that bill reaches you.
Anthropicโs filing said 80% of its revenue is usage.
Googleโs answer is to make the usage worth paying for by removing the free version.
If youโre on AI Plus, you have ten days to decide whether Pro is worth $15 more a month or whether Flash does the job. ๐
๐Meme of the Day
Over to You...
Walk through your office tonight and count the devices that run Android and didnโt come from a brand youโd recognize.
Each one is a firmware youโve never read, on a network that holds your invoices. ๐ฅ
Founder,ย AI Persona Method | TheTip.ai
Get paid to solve problems like this โ AI Certified Consultant
PS.Anthropicโs roadshow window opens November 10, fifteen days after its public filing. Thatโs the earliest the ANT price range can appear. When it does, Iโll tell you what the number says about the $20 a month you pay.
ยป Join the AI Money Group ยซ
๐ฐ AI Money Blueprint: Your First $1K with AI - Learn the 7 proven ways to make money with AI right now
๐ Zero to Product Masterclass - Watch us build a sellable AI product LIVE, then do it yourself
๐ Monthly Group Calls - Live training, Q&A, and strategy sessions with Jeff
Sent to: {{ email }}
Jeff J Hunter, 3220 W Monte Vista Ave #105, Turlock,
CA 95380, United States
Don't want future emails?
