JadidJust-in AI Developments, Incidents & Deadlines
May 2026
SMTWTFS12345678910111213141516171819202122232425262728293031

AI news, Thursday, May 7, 2026

9 stories

TLDR

  • Anthropic leases all of xAI's Colossus 1 in Memphis (May 6) — 300 MW / ~220k Nvidia GPUsGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ from Musk's data center go to Anthropic; Claude Code rate limits doubled, peak-hour caps removed for Pro/Max. xAI quietly pivots to "neocloud."
  • "Bleeding Llama" — critical Ollama memory leak (CVE-2026-7482, CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 9.1) (disclosed May 5) — Unauthenticated attackers can leak heap memory containing API keys, prompts, PII from any of ~300k internet-exposed Ollama servers. Patch in 0.17.1 was shipped Feb 25 without a security label — most operators never upgraded.
  • Braintrust confirms AWS breach; every customer told to rotate API keys (May 6) — The AI eval startup's compromised AWS account held customers' AI provider keys (OpenAI, Anthropic, etc.). Suspicious activity detected May 4.
  • PayPal cuts 20% (~4,760 jobs) under new CEO's "AI overhaul" (May 5) — Targeting $1.5B savings; sixth major fintech cut in 6 months citing AI as a named driver.
  • SpaceX files for $55B (could scale to $119B) "Terafab" chip plant in Texas (May 6) — Vertically integrated fab for Tesla/SpaceX/xAI silicon; Intel partnering on 14A. Output not expected before mid-2028.

Action Items

Things your engineering team should look at or do this week.

  • Patch any Ollama deployment to ≥ v0.17.1 today — CVE-2026-7482 ("Bleeding Llama") leaks process memory unauthenticated; if your Ollama instance is internet-reachable, assume environment variables, API keys, and prompt content are exposed. The fix shipped Feb 25 but was not labeled as a security release. Audit external exposure (curl http://<host>:11434/api/version) and restrict to localhost or VPN. (Cyera Research | SecurityWeek)
  • If you use Braintrust, rotate every AI provider key stored there — Braintrust's notification on May 6 told customers to rotate any keys held by the platform. Even though the company says it "has not found evidence of broader exposure," the affected AWS environment held customer-supplied OpenAI/Anthropic/etc. keys. Treat this as a confirmed credential-compromise event for any team running evals through Braintrust. (TechCrunch)
  • Re-baseline Claude Code / Claude API capacity assumptions — The xAI/SpaceX deal removes peak-hour throttles for Claude Pro and Max and raises Opus API rate limits. If you've throttled internal rollouts due to Anthropic capacity issues this past month, those limits are likely to relax materially over the next few weeks; re-test before adding fallbacks. (Anthropic)
  • DALL-E API shutoff is now in 5 days (May 12) — Reminder: gpt-image-1 migration is not a drop-in swap (covered May 6). If you haven't migrated yet, this is the last week.

Models & Tools

  • Pinecone Nexus + KnowQL (May 4–5) [Data] [Agents] — Pinecone's pitch: stop doing per-request retrieval. Nexus is a "Knowledge Engine" that compiles enterprise data into structured artifacts agents query in one step; KnowQL is a declarative query language with primitives for intent, output shape, confidence, and budget. Pinecone's own internal benchmark: a financial analysis task that previously consumed 2.8M tokensA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗ completed with 4k tokens (98% reduction). Customer-validated numbers not yet available. Worth piloting if your agents are bottlenecked on retrieval token spend or recall. (Pinecone Blog | VentureBeat)

  • Google AI Search adds "Expert Advice" panel quoting Reddit, forums, blogs (May 6) [Customer AI] — AI Overviews and AI Mode now surface previews of perspectives from public forum/social posts, with creator name and community attached. Pros: matches the "+reddit" search behavior users have already adopted. Cons: same untrusted-input source that produced the "glue on pizza" and "eat one rock per day" answers in 2024 — and now the input lands directly in AI-generated summaries. Keep an eye on what gets surfaced about your products. (TechCrunch | MacRumors)

Security

  • Bleeding Llama (CVE-2026-7482, CVSS 9.1) — heap memory leak in Ollama (disclosed May 5; patched Feb 25 in v0.17.1) — Cyera Research's disclosure: an unauthenticated remote heap out-of-bounds read leaks process memory from any reachable Ollama instance. Exposed material can include system prompts, fragments of other users' chats, env vars (API keys, tokens, DB creds), code being processed, and PII/PHI. Cyera estimates ~300k internet-exposed servers. The original Feb fix was not flagged as a security release, so many operators never upgraded. Update to 0.17.1+ and lock network access. (Cyera Research | Cybersecurity News)

  • Braintrust AWS account compromise; AI-provider keys exposed (detected May 4, disclosed May 6) [Production] — One AWS account at the AI eval startup was accessed by an unauthorized party. The account held API keys customers had configured for use with OpenAI, Anthropic, and other model providers. Braintrust says it has only confirmed exposure for one customer "to date" but emailed every customer to rotate stored keys. Account locked, internal secrets rotated, related systems audited. (TechCrunch)

Industry & Business

  • Anthropic ↔ SpaceX/xAI: full Colossus 1 lease + space-compute MoU (May 6) [Infra] [Trending] — Anthropic gets all 300 MW of capacity at xAI's Memphis data center (~220k H100/H200/GB200 GPUs) and signaled intent to co-develop multi-gigawatt orbital data centers with SpaceX. Capacity online "within the month." Strategic read: xAI has effectively become a neocloud — buying GPUs from Nvidia and renting to model labs — and the Musk–Amodei rivalry has been monetized. Earlier the same day, Ross Nordeen (xAI cofounder) joined Anthropic to lead compute. (CNBC | Bloomberg | TechCrunch — "Is xAI a neocloud now?" | DCD on Nordeen)

  • PayPal: 20% workforce cut (~4,760) under "becoming a technology company again" (May 5 Q1 call) [Hiring] — New CEO Enrique Lores (former HP) framed the reductions as a 2–3 year reorg, targeting $1.5B in run-rate savings. PayPal stood up an "AI transformation and simplification" team. The cuts are not a single-day RIF — expect waves over 24–36 months. Sixth major fintech in six months to cite AI as a named driver in workforce reductions. (TechCrunch | Bloomberg)

  • Meta: 8,000 layoffs land in 13 days (May 20) [Hiring] — Reminder/countdown: the 10% cut Meta disclosed April 23 takes effect May 20, and Meta is also leaving 6,000 open roles unfilled. Practical signal for hiring teams: expect a wave of senior Meta candidates on the market the week of May 25. (CBS News | TechCrunch)

  • SpaceX files for $55B (scaling to $119B) "Terafab" chip plant in Grimes County, TX (May 6) [Infra] — Phase 1: $55B vertically integrated semiconductor facility (design + fab + memory + packaging). Two target product families: an edge-inference chip for Tesla FSD/Optimus/Robotaxi, and a space-hardened variant for SpaceX satellites and orbital DCs. Intel signed on in April to help with 14A-process production. Morgan Stanley estimates first chip output mid-2028 at the earliest. Confirms vertical-stack ambition: Musk's bet that owning silicon-to-orbit is a moat. (TechCrunch | Tom's Hardware | Bloomberg)

AI in Production

  • Microsoft weighs delaying or scrapping its 2030 100%-hourly-clean-power goal (May 6) [Infra] — Internal debate first reported by Bloomberg: AI data center buildout has made the company's hourly clean-energy matching commitment effectively unworkable. Microsoft will "continue to look for opportunities to maintain our annual matching goal" — a quiet downgrade from hourly to annual. Practical signal: the largest AI hyperscaler is publicly admitting AI buildout is breaking the climate-pledge baseline; expect peers (Google, AWS) to follow. Watch for natural-gas / nuclear PPAs. (TechCrunch | Bloomberg via Yahoo)

Type to search · ↑↓ to move · enter to open