I spent three weeks in Cabo yelling at my phone.

Not at people. At my AI agents.

If you've been reading this newsletter for any length of time, you know I don't recommend being polite to AI. I recommend smacking it around a little.

Correcting. Scolding. Liberally using F-bombs.

That's a little awkward when you're sitting poolside, shouting expletives into Telegram like a lunatic… while fellow gringos pretend not to stare.

(Real CEO energy right there.)

Look.

You can run your entire business from your phone right now.

Not "check your email and respond to a few Slack messages."

Run it.

CRM. Content. Sales pipeline. Automations. All of it.

That's an insane amount of power for something that (awkwardly) fits in your swim trunks.

It's also a b.a.n.a.n.a.s. amount of risk (if not properly mitigated).

Both of those became very clear to me in Cabo.

And before you ask… no, I'm not talking about my OpenClaw setup here.

If you've been following the “Jenny” saga, you don't need a Mac Mini or 45 hours of configuration to do what I'm about to show you.

But First… a Confession

I have a safe word.

Relax. It’s not a bedroom thing.

(Well, we have one of those too. But that's a different newsletter.)

It's something I've shared with every member of my family.

Wife. Kids. Everyone.

Here's why…

My digital voice sounds a lot like me. I've been building AI systems that use voice cloning for months now.

If you haven’t already heard my ElevenLabs AI twin, you will soon enough.

And it gets worse.

It takes as little as 3 seconds of audio to clone someone's voice.

Three seconds.

A voicemail greeting. A clip from a Facebook video. A snippet from an Instagram Reel. That's all it takes.

The technology is available to anyone with a laptop and an internet connection.

And it's not just voice anymore. AI-generated video is getting scary good. You've probably seen the Tom Cruise / Brad Pitt deepfake.

Every week there's a new clip that makes me go "OK wait, is that real or not?" And I work with this stuff every day.

There's even a whole subreddit (r/RealOrAI) dedicated to people arguing about whether something is real or AI. Half the time nobody can tell.

So yeah.

I have a safe word with my family.

And if that sounds paranoid… keep reading.

Here's Why I'm Not Overreacting

Picture this.

My wife and I are in Cabo. Posting photos from the resort. Broadcasting our whereabouts to hundreds of people via my newsletter and social media.

Meanwhile... a cartel uprising pops off in Puerto Vallarta.

Now here's the thing most people don't realize about Mexican geography. Cabo and Puerto Vallarta are a few hundred miles apart as the crow flies. There's no direct route by road. They're basically different worlds.

But the media doesn't care about geography.

The media made it sound like the entire country was on fire. Cartel henchmen storming resorts. Cars getting firebombed. Total chaos.

So everyone back home is watching CNN thinking we're dodging bullets at the pool bar.

Now imagine my mom gets a call.

My voice. Panicked. Breathing hard.

"Mom, something happened. We got separated from the group and we're trying to get to the embassy. I need you to wire $8,000 right now. Don't call anyone else... the phone service is spotty and I might lose this connection. I'll explain everything when we're safe."

Except it's not me.

It's my AI-cloned voice.

And my mom... who's already been watching the news for three days, terrified that her son is caught in the middle of a cartel war...

She's not thinking straight. She's thinking "Oh my God, he's in danger."

She drives to the bank. Wires the money.

Because of course she does.

That's her kid.

This isn't some futuristic "what if."

It's happening right now. To real people. For real money.

Last July, a Florida woman named Sharon Brightwell got a call that sounded exactly like her daughter April. Sobbing. Panicked. Claiming she'd been in a car accident and hit a pregnant woman while texting and driving.

A man got on the line. Said he was April's attorney. Told Sharon her daughter was being detained and needed $15,000 cash for bail.

He gave very specific instructions. Don't tell the bank what the money's for. It could affect your daughter's credit.

Sharon withdrew $15,000 and handed it to a driver who showed up at her house.

Her grandson eventually called the real April. She was at work. Completely fine. Had no idea any of this happened.

"I know my daughter's cry," Sharon told reporters. "There is nobody that could convince me that it wasn't her."

Fifteen grand. From a retired couple's savings. The scammer's biggest expense was probably the burner phone.

And that's not even the biggest case.

In February 2025, scammers cloned the voice of Italy's Defense Minister, Guido Crosetto. Called some of Italy's wealthiest business leaders… Giorgio Armani, former Inter Milan owner Massimo Moratti, Prada co-founder Patrizio Bertelli… claiming they needed ransom money to free kidnapped Italian journalists.

Moratti wired €1 million to an account in Hong Kong before anyone figured out what happened.

One. Million. Euros.

Italian police eventually froze the funds. But look at what they pulled off. AI-cloned voice of a government official. Spoofed phone numbers traced back to the minister's actual staff. A cover story ripped from real headlines about an Italian journalist who'd been detained in Iran just weeks before.

And the scale of this stuff is only growing.

The FTC reported $2.7 billion in imposter scam losses in 2023 alone.

Not million. Billion.

According to a Hiya 2026 report, 1 in 4 Americans have already received a deepfake voice call in the past 12 months.

The FCC ruled in February 2024 that AI-generated voices in robocalls are illegal under the Telephone Consumer Protection Act.

(Criminals everywhere breathed a sigh of relief, I'm sure.)

The safe word exists for exactly this reason.

Enough of That. Let's Get to the Cool Sh!t.

I didn't write this whole newsletter just to ruin your morning.

The AI powering those scams is the same AI I use to run my business. Same technology. Different intentions.

Here's what mine wasn’t doing in Cabo…

Checking emails. Scrolling dashboards. Pecking at spreadsheets on a tiny screen.

I was telling my AI agent what to do inside my CRM… and it just did it.

You can connect your AI agents directly to your CRM now.

I won't bore you with the technical aspects. All you need to know is that you can talk to your phone like a person… and your AI goes and executes tasks independently using a protocol called MCP.

You can identify contacts. Send messages. Update pipelines. Publish content. Build automations.

No menus. No dashboards. No 14 browser tabs.

Let me give you a few examples from one afternoon.

I'm sitting at the pool bar. Phone in hand. Skinny margarita sweating on the coaster.

I say: "Find everyone on my email list who's engaged with me in the last couple weeks and send them an email. Let them know I just added an updated training for creating their BrandDNA inside the Magnetic Brand System... and that they can get their AI Writing Specialist set up in about 45 minutes. Write it using my email style guide. Emphasize the benefits. Include a call to action to grab the course."

Done.

Never opened my CRM. Never wrote a single word of copy. Never even set down my drink.

Later that day I checked my daily reports.

I get these automatically from an AI agent that queries my CRM. Basically a 30-second summary of where every prospect stands... who's requested more info, who my most engaged leads are, who needs follow-up.

It's a valuable report. But honestly, anyone with ChatGPT can set something like this up pretty easily.

Here's where it gets interesting...

This isn't just a reporting automation. We're talking about agentic AI. Stuff that can think, reason, and make autonomous decisions.

So my agent flagged a hot lead that hadn't been responded to. Then it asked me if it should follow up.

I said "yes."

It emailed them back. Then... without me asking... it sent a Slack message to Josh with the hot leads, a quick summary of their activity, who to prioritize, and who to follow up with.

I didn't tell it to message Josh. I didn't tell it to prioritize anything. I didn't build a workflow for this.

It just... did it.

Between then and dinner I also knocked out a social post, pushed it to three platforms with one voice prompt.

(Meanwhile most business owners are using AI to write LinkedIn slop.)

It gets even wilder.

Full disclosure, I haven't nailed this one yet. But the capability exists.

You can build complete multi-step workflows by voice. It's only going to be a few months before they iron out all the kinks.

Which will automate what used to take an afternoon of dragging and dropping triggers in an automation builder. Testing. Debugging. Building trees. Swearing at it when it’s not working like you expect.

OK Now the Scary Part Again

I'll be honest.

Sitting at the pool bar… a thought crept in.

If someone slipped something in my drink, waited for me to pass out, and held my iPhone up to my face…

Face ID would let them into my entire business (and bank account).

That's a fun thing to realize when you're running your whole operation from a 6-inch screen in a foreign country.

So I made some changes.

My first instinct was to just turn off Face ID and go back to a passcode. Sounds logical… you can't type a PIN while you're passed out, but your face works just fine.

I've read too many stories about digital nomads getting “roofied” and waking up to empty crypto wallets because their Tinder date held their phone up to their unconscious face.

Except turning off Face ID entirely creates a different problem.

There's a feature called Stolen Device Protection that requires Face ID with no passcode fallback to access your saved passwords and banking apps. Turn off Face ID and you lose that layer. You're just trading one risk for another.

Here's what I do now…

👉 Press and hold the side button and either volume button for two seconds. 👈

The shutdown screen pops up. You’ll feel haptic feedback. Press the side button again to dismiss.

That's it.

Your phone goes into a mode where Face ID stops working entirely until you type your passcode. You can do it in your pocket. You can do it without looking at the phone. You can do it while some guy at the bar is mid-sentence and he'll never know.

Now I do it every time I set the phone down. Pool bar. Restaurant. Airport. Anywhere I'm not holding it. Two seconds. Done.

Once you’ve done it a time or two it becomes second nature.

Also, be sure to turn off lock-screen notifications. This one comes straight from the NSA's travel security guidance. If your phone is sitting on a bar and a text comes in with a two-factor auth code… anyone looking at your screen can read it without unlocking.

Of course, I'm not a cybersecurity expert.

But I'm a guy who runs his business from his phone while traveling internationally.

(This is the sh!t I think about now.)

The Workshop

Everything I just showed you… the follow-ups, the content publishing, the pipeline management… all by talking into my phone… none of it works unless you've done the foundational setup first.

Your AI has to know your voice. Your brand. Your visual style. Your frameworks.

Otherwise… nothing sounds like you. Nothing looks like you. You can connect all the tools in the world, but the output is generic garbage.

The voice guide. The creative director. The repurposing system. All of it has to be built and trained on YOU before any of the cool sh!t I just described becomes possible.

On March 28th, I'm doing a live workshop with Jessica Davis where we build every one of those prerequisites.

Over the shoulder. One day. Same foundation I'm running everything on.

I'll be using my favorite tool. The one I've spent hundreds of hours testing at this point.

But you can implement the same system in whatever AI you're already using. Claude, ChatGPT, whatever. The framework transfers.

You show up. We build it. You leave with the foundation that makes everything else possible.

Saturday, March 28th. 11:00am to 6:00pm Eastern. Live on Zoom.

👉  Get All the Details Right Here.

If not, no worries.

I'll be here next Friday either way. Probably yelling at my phone about something.

Until next time,

—Tim Erway

P.S. Five years ago, telling someone "I have a safe word with my family" would've gotten you some very concerned looks at a dinner party. Now it's just common sense. Welcome to 2026.