Newsletter · September 4, 2026
The AI headlines are loud. These three have dates.
New York City just told its elementary and middle schoolers they cannot use AI, and that is the story every tech director gets asked about this month. But three other things landed in the same stretch with something the AI debate does not have yet: actual dates.
If anything here sparks a question, we are a conversation away.
Trail Ahead
New York City banned student AI through 8th grade
On September 2, New York City released guidance banning student-facing generative AI, including chatbots and AI tutors, for students from age two through eighth grade in the nation's largest school system. It also bars individual devices for preschool through second grade and caps screen time at 30 minutes for grades 3 to 5 and 45 minutes for middle school. Teachers may still use approved AI for lesson planning and translation, but not for grading or special education plans. Chalkbeat reports it is not yet clear how the city will enforce any of it, with the first day of school on September 10.
Read the full story at Chalkbeat
Pine Cove connection: Enforcement is the whole job. A rule that students cannot reach generative AI is a filtering, device management and network policy question long before it is a classroom question. When your board asks whether you could do that here, the honest answer depends on what your filtering and MDM can actually see and block today.
🌲 Quick Bytes
Microsoft made passkeys the default on September 1
As of September 1, passkeys are the default sign-in experience in Microsoft Entra ID. Anyone still on Microsoft-provided SMS or voice is auto-enrolled for passkeys and nudged to register one at their next sign-in. Those methods retire entirely on February 1, 2027, and tenants that still need phone-based MFA have to configure their own telecom provider before then.
Read Microsoft's retirement guidance
Pine Cove connection: Two things at once. Put the February date on the calendar now if you have staff or substitutes still on SMS codes. And tell your people a real passkey prompt shows up inside a sign-in they started, never in a phone call from someone claiming to be IT. Crews are running exactly that call right now.
Two PaperCut flaws are being actively exploited
CISA added CVE-2026-81578 and CVE-2026-82078, both in PaperCut NG/MF, to its Known Exploited Vulnerabilities catalog on August 31, based on evidence of active exploitation. One is a missing authentication flaw on a critical function. The other is unsafe reflection.
Pine Cove connection: Print management sits on nearly every district network and almost never makes the patch rotation. It is a server, it talks to your directory, and it usually has a web console. Worth finding out this week which version you are running.
Your alert system only works if you use it
Schools sent nearly 20 million notifications last school year and only 8% were emergencies, according to a Singlewire analysis of roughly 16,000 schools. The argument from K-12 technology leaders: the other 92% is your test. Routine daily use across speakers, displays, email and text is what proves the system works before the day you need it.
Pine Cove connection: We wire and support these systems, and the pattern holds: the districts steady on a bad day are the ones whose staff use the same tools on an ordinary Tuesday. If your PA, bells, and mass notification live on three unrelated systems, that is worth untangling before winter.
🌲 Partner Pulse
Attackers are impersonating the AI brands your staff are searching for
Sophos published research on August 19 on fake AI tools delivering real malware. Across a year of Sophos MDR casework, the team found attackers impersonating Claude, ChatGPT, Perplexity and Copilot through typosquatted domains, malicious ads and poisoned search results, then talking the user into running an install command. Claude was the most abused lure, in 26 of the cases reviewed.
Pine Cove connection: This lands right on top of the AI policy conversation. Staff told not to use the approved tool, or who cannot find one, go looking, and searching for an AI client is now a real malware path. We run Sophos across districts and government buildings in Montana and Wyoming, and this is what endpoint protection and DNS filtering are for.
Pine Cove Corner
There is a version of this job where you spend all fall arguing about AI and never get to the print server. The AI questions are real, and they are coming to your board. They also do not have a date on them yet. Passkeys, patches and a notification system nobody has tested do. Pathfinder 360 exists so the second list does not get buried under the first.
Schedule your Pathfinder 360 call at pinecc.com
Stay Connected Beyond the Trail Report
Our newsletter only scratches the surface of what is happening every day in the world of IT, security, and education. For the latest updates, quick insights, and resources you will not find here, follow us on LinkedIn. It is the best way to stay in the loop with Pine Cove and catch what is new before the next issue lands in your inbox.
- The Pine Cove Team
