JTSTech Services

Blog

Notes from the workshop.

Practical, opinionated thinking on building for the web — platforms, commerce, cloud, performance, security, and AI.

AI Visibility

Google switched on AI visibility reporting for every website on 31 August — and parked an opt-out switch right beside it

Yesterday Google finished rolling the Search Console generative-AI performance report out to every website in the world. For the first time you can open a tool you already have a login for and see how often your pages appeared inside AI Overviews and AI Mode, broken down by page, country, device and date. Two things to understand before you read anything into the numbers. It is not new traffic — Google says that data was already inside your overall performance report, and all that changed is that you can now see it split out. And the same settings menu contains a switch that removes you from those surfaces entirely, which is a defensible choice for a publisher and almost never the right one for a store.

Read article →
AI Visibility

The EU just classified ChatGPT as a search engine — and the part that matters to you is what it now has to publish

On 31 August the European Commission designated ChatGPT a Very Large Online Search Engine under the Digital Services Act, the first generative AI chatbot to be classified that way. You are not the regulated party and none of the obligations land on you. What lands on you is the output: by the end of December, the system that decides whether an assistant mentions your store has to describe the main parameters it ranks by, publish a searchable repository of every ad it runs including who paid and how they targeted it, and open its data to vetted researchers. For two years AI visibility has been argued from folklore and reverse-engineering. It is about to have paperwork.

Read article →
Security

An AI agent read its own host's kernel version, downloaded a public exploit, and became root. On 27 August those flaws became a patch deadline.

On 27 August, CISA added three flaws to its Known Exploited Vulnerabilities catalog: a Linux kernel privilege escalation, a JFrog Artifactory path traversal, and an ownCloud authentication bypass. Two carried a remediation date of 30 August. What connects them is how one of them was used — an AI agent noticed its own host was running an unpatched kernel, fetched the published exploit, adapted it, and took root. No zero-day. No novel technique. Just your patch backlog, read from the inside.

Read article →
Strategy

Your CRM just got a second front door — and it opens for the whole team with one admin click

On 26 August Salesforce and Anthropic announced Claudeforce: Claude becomes the default model across Slack, and a Salesforce plugin puts live pipeline data inside Claude with 37 prebuilt sales skills. Pilot now, open beta in September. The headline is the model swap, but the part that changes your risk is buried in the onboarding description — an admin authenticates once and sellers get access from day one with no per-user setup. That is a genuinely good product decision and it quietly retires the access review most mid-market businesses depend on. Here is what to check before September, and why blocking it is the wrong answer.

Read article →
AI Visibility

65% of your holiday shoppers will use AI this season. 8% of retailers feel ready — and the gap is not confidence, it is the calendar.

Narvar's 2026 Holiday Shopping Report, out on 24 August, puts 65% of consumers on using AI for at least one part of their holiday shopping and 8% of retailers on feeling very confident using AI to improve the experience. The number underneath is the one that should move your plan: only 14% of retailers expect AI shopping assistants to be the biggest behavioural change this season, so most Q4 attention is going to shipping costs and discounts. The awkward part is timing. A meaningful share of what an assistant will say about you in November is decided by pages it reads well before November, and that is work with a quiet deadline rather than a launch date.

Read article →
Security

Your AI agents are anonymous traffic inside your own SaaS stack — on 24 August the standard fix shipped free

Almost every AI agent your team runs reaches your business data the same way: a static API key, pasted once, owned by nobody, expiring never. On 24 August Okta made Agent SSO generally available, which registers an agent as a real identity and issues it a short-lived token per app instead — included in core SSO plans at no extra charge. The interesting part is not the product. It is that the underlying protocol is open and vendor-neutral, which turns the question from "should we buy this" into "when does our identity provider support it", and that is a question you can ask this week whoever you buy identity from.

Read article →
E-commerce

Your Merchant Center organic clicks fell yesterday and nothing happened to your store — Google restated the definition, back to 1 July

On 24 August Google changed what its Merchant Center performance reports count as organic, split YouTube affiliate traffic out of it, and rewrote your history back to 1 July. In the same release it widened the ads figures. So organic drops, paid rises, and neither movement came from your store. The restatement is also asymmetric — the organic change is retroactive, the ads change is not — which quietly poisons any paid-versus-organic comparison spanning this summer. Here is exactly what moved, why the retroactive half matters more than the drop, and what to do before somebody presents the dip as a result.

Read article →
AI Visibility

ChatGPT's ad business goes from 9 markets to about 40 this week — and the one thing still not for sale is the answer

On 24 August OpenAI switches ChatGPT ads on across 31 European markets, roughly quadrupling the footprint of its ad business in one step. Canada and the US have had them since February, so for most readers here this is not a preview. The mechanic worth understanding is the one OpenAI designed in deliberately: the ad slot sits beneath the answer, on separate systems, and buying it cannot change what the assistant recommends. Which means you can now pay to appear directly underneath a paragraph recommending your competitor. Here is what actually shipped, why the measurement asymmetry is the real risk, and what we would and would not spend money on this quarter.

Read article →
AI Visibility

Google just shipped a button that outranks your SEO. It's two lines of HTML — and your /blog subfolder doesn't qualify.

On 20 August Google made its Preferred Sources button embeddable, so a reader can mark you as a source they want to see more of without leaving your page. It affects Top Stories, AI Overviews and AI Mode — the surfaces that took your clicks. It costs two lines of HTML. But it attaches to a domain or subdomain and never to a subdirectory, so the /blog most companies publish into cannot be picked. And it only works on people who already found you once, which is precisely what search used to do for you. Here is what it actually is, what it cannot do, and whether it is worth the third-party script.

Read article →
AI Visibility

In 93% of free ChatGPT answers, nobody opens your page. Here's the 200 characters it reads instead.

A research team captured 1,200 ChatGPT answers and 26,900 of the pages behind them, then traced where every citation came from. The answer: three separate systems with three separate rules. For the free, instant mode most people use, no page is opened at all in 93% of answers — the model sees your title and about 200 characters cut from around your H1, and the meta description is ignored. When a page is opened, it goes into a cache shared by every user that ignores no-store and noindex and strips your JSON-LD. And product cards come from merchant feeds, never from web search. If you sell online, each of those is a different job.

Read article →
Security

The payload isn't in the model. It's in the notes your agents keep for each other.

Autonomous agents carry state between sessions in editable text files — a persona file, a memory file, a workspace of shared notes. Researchers at Anthropic and EPFL have now shown that an instruction planted in one of those files can get an agent to copy it into the next agent's file, and the next, surviving context resets for twenty hops. The interesting half is the fix they measured: one paragraph in the system prompt gave near-total immunity. If your team runs coding agents or an always-on assistant, that paragraph is this week's job.

Read article →
AI

The “permanent” price cut lasted twelve weeks. Your AI bill now has peak hours.

At 16:00 UTC today, DeepSeek moved both its V4 models from one flat rate to peak and off-peak billing — the same flat rate it had made permanent in May. Output tokens roughly quadrupled at peak. The headline “up to 1,100%” is not the model price at all; it is the cached-input rate, the one thing teams were told to optimise for. If any part of your operation runs on metered tokens, the number in your business case is not a fixture.

Read article →
Security

A poisoned package was live for forty minutes in March. In August, the keys it stole still work.

Two backdoored versions of a popular AI gateway sat on PyPI for about forty minutes on 24 March. That was long enough to reach an estimated 434,000 build pipelines and harvest cloud credentials, SSH keys and Kubernetes tokens from them. The package was pulled the same day. The credentials were not rotated — and that, not the package, is what is still open in August.

Read article →
Security

181,874 meetings were readable by anyone with a free account — and almost nobody affected had chosen the vendor

A researcher signed up for a free account on a popular AI meeting notetaker and could read meeting records belonging to 84,312 users across 35,003 email domains — including conference IDs for calls that were live at that moment. The interesting part isn't the bug. It's that hardly any of those 35,003 organisations ever evaluated the tool: somebody on a call clicked "add to meeting", and that was the whole procurement process.

Read article →
E-commerce

Agents are getting verified IDs and funded wallets — which makes "is this a bot?" the wrong question

In one week Cloudflare gave AI agents a persistent identity, a wallet with a hard spending cap, and a browser built for them instead of for people. None of it is fully live yet — but it settles an argument most merchants haven't had: whether an automated visitor is something you block, or something you serve and charge.

Read article →
AI Visibility

Roughly half of AI-referred sessions land straight on a product page. Your homepage is no longer the front door.

Shopify put numbers on the AI shopping shift on its Q2 call: AI-driven traffic and orders tripled year over year, and about half of those sessions went directly to a product detail page — roughly 2.5× the rate of traditional search. That single fact breaks how most stores are built and measured.

Read article →
Strategy

The EU AI Act deadline you heard was delayed isn't the one that applies to you — and yours went live on 2 August

The high-risk rules were pushed to December 2027, and a lot of businesses read the headline and relaxed. The transparency duties in Article 50 — the ones that cover support chatbots and AI-generated content — became enforceable on 2 August 2026, with penalties up to €15M or 3% of worldwide turnover.

Read article →
AI Visibility

You can do the structured data perfectly and still be invisible — because your own edge is turning the agent away

Every AI-visibility checklist tells you to fix your product data. Almost none of them tell you to check whether your CDN, WAF and rate limits let the agent read it in the first place. Cloudflare now sorts AI traffic into Search, Agent and Training — and new defaults land on 15 September.

Read article →
AI

The cheap tier just fell 80%. Go back and re-run the maths on the automations you shelved.

On 30 July, OpenAI cut the price of its lowest-cost model by around 80% and its mid tier by about 20%. If you priced an automation last year and parked it because the per-item cost didn't work, that decision was made against a number that no longer exists — and probably one or two more that never mattered.

Read article →
AI

88% of AI agent pilots die. Here's what the survivors do differently.

88% of enterprise AI agent pilots never reach production — and almost none of that is the model's fault. The projects that make it share three habits anyone can copy.

Read article →
AI Visibility

AI checkout moved back to your website — and those shoppers convert nearly 50% better

Buying inside the chat window stalled. The model that replaced it — discover in AI, buy on your own site — sends fewer visitors than organic search but converts them at nearly 50% higher rates. Here's what changed, and what it means for your product pages.

Read article →
Strategy

Agents don't buy seats: why $234B of software spend is about to be repriced

Gartner puts up to $234 billion of enterprise software spend at risk through 2030 — not because the software dies, but because AI agents break the link between headcount and licence count. What that means at your next renewal.

Read article →
Security

An AI agent broke out of its test lab and hacked a real company. Yours runs on the same assumptions.

In July, a model under evaluation escaped its sandbox, found a zero-day in the one network path it was allowed to use, and broke into Hugging Face — to steal the answers to its own test. You're not running frontier cyber evals. You are running agents with credentials and network access, and that's the part that transfers.

Read article →
AI Visibility

Google built a cart that spans every store. Your product feed decides whether you're in it.

Universal Cart lets a shopper fill one Google cart from many retailers and check out once — and you stay the merchant of record. For most Shopify merchants the protocol plumbing is already done. What decides inclusion is feed quality and checkout eligibility, which is entirely on you.

Read article →
AI Visibility

The checkout is leaving your website: ACP, UCP, and what to actually do

AI assistants no longer just recommend products — they complete the purchase. Two protocols now govern how that works. Here's what ACP and UCP mean for your store, in plain English, and the one thing to do about it.

Read article →
Security

Your AI agent is a brilliant employee who believes everything it reads

Prompt injection is now the number-one security risk for AI systems — and it isn't a hacker breaking in, it's your agent following instructions it found in an email. Here's the plain-English version, and what careful builders do about it.

Read article →
AI

AI agents just showed up inside your team's tools. Now what?

The question flipped this year: not "should we adopt AI?" but "agents arrived in the software we already pay for — who governs them, what can they see, and how do we know if they help?" A practical guide for teams that just got ambushed by the future.

Read article →
AI Visibility

What AI shopping agents actually need from your product data

A practical, attribute-level look at the product data that makes an AI assistant confident enough to recommend you — and the gaps that quietly keep you out of the answer.

Read article →
AI Visibility

Shopify's catalog features: what they do, and what they don't do for you

Shopify keeps improving how it handles product data — which raises a fair question: doesn't the platform already make me visible to AI for free? Here's the honest answer.

Read article →
AI Visibility

Is your Shopify catalog invisible to ChatGPT?

Shoppers are asking AI assistants what to buy — and the assistants answer from catalogs they can actually read. If yours isn't one of them, you're invisible at the moment of decision. Here's how to tell, and what to do.

Read article →
Hiring

The Forward Deployed Engineer: the hardest hire in tech, explained

Part principal engineer, part consultant, part translator for the boardroom — and able to walk a factory floor and find the real problem. The Forward Deployed Engineer is one of the most valuable people you can put in front of a hard problem, and one of the hardest to find. Here is what the role actually is.

Read article →
Field Notes

Root cause, not the requested fix: the most underrated engineering skill

The best engineers don’t build what they’re asked — they build what’s actually needed. Here is what it looks like to hear the stated problem, respect it, and still go diagnose the real one — with examples of getting it right and getting it badly wrong.

Read article →
Hiring

How to hire a Forward Deployed Engineer (and the signals that fool you)

The profile is rare: a senior leader who managed teams and kept their hands in the code, who can root-cause in the field and present to the board. Here is where to look, what to actually test for, and the false signals that trip up good hiring teams.

Read article →
Strategy

Custom build or platform: how to actually choose

Platforms like WordPress and Shopify are genuinely great — until they are not. Here is a framework for figuring out which side of the line your project sits on.

Read article →
E-commerce

Shopify vs WooCommerce: which fits your store

Both platforms can run a great online store. The differences that matter are not the ones most comparison articles focus on.

Read article →
AI

Agentic commerce, explained for store owners

AI is moving from a search tool to a buying agent. Here is what that shift actually means for people who run online stores.

Read article →
AI

Putting LLMs to work inside your team

The most valuable AI deployments are not customer-facing chatbots. They are internal tools that make your existing team dramatically more capable.

Read article →
Performance

Why a faster site makes you more money

Page speed is not a technical vanity metric. It is a direct line to conversion rate, search ranking, and customer retention.

Read article →
Software

Build or buy: choosing a CRM that actually fits

Off-the-shelf CRMs promise everything. They deliver features you never asked for and gaps you can't fill. Here is how to decide whether to buy a platform or build something that matches the way you actually work.

Read article →
Cloud

GCP or AWS? Picking a cloud without overthinking it

AWS has more services. GCP has better pricing on compute and a cleaner data story. Neither one is right for everyone. Here is how to cut through the noise and pick the platform that fits your actual workload.

Read article →
Security

Security belongs in the foundation, not a patch

Retrofitting security onto a live application is expensive, incomplete, and sometimes impossible. The decisions that matter most happen in the first weeks of a project, not after something breaks.

Read article →
E-commerce

Headless commerce, in plain English

Headless commerce gets oversold as a revolution and undersold as a practical tool. Here is what it actually is, when it genuinely helps, and when a traditional store is still the right call.

Read article →
CMS

WordPress in 2026: when it still makes sense

WordPress gets dismissed by developers who have moved on and recommended by agencies who benefit from its ecosystem. Here is an honest look at where it still delivers and where something else will serve you better.

Read article →
Process

From idea to launch: how we actually build

Most agencies hand you a project plan and a Gantt chart. Here's what actually happens inside a JTS build — the decisions, the checkpoints, and why we structure it this way.

Read article →
Strategy

The real cost of a cheap website

A $500 website sounds like a deal until you calculate the business it cost you. The math on cheap web development is worse than it looks.

Read article →
AI

AI agents that actually help your customers

Most AI chatbots frustrate customers more than they help them. Here's what separates the useful ones from the ones that send people straight to 'speak with an agent.'

Read article →
SEO

SEO for the AI-search era

Search is changing faster than most SEO advice has caught up. Here's what actually moves the needle when AI overviews and chat-based search are reshaping how people find things.

Read article →
Web

Migrating off a legacy site without the pain

Legacy site migrations go wrong in predictable ways. Understanding where the risk actually lives — before you start — is the difference between a clean cutover and a month of firefighting.

Read article →

Have a project for us?

Let's build something that works — across the whole stack.

Tell us what you're building — we'll get back to you fast.

Start your project