JadidJust-in AI Developments, Incidents & Deadlines
May 2026
SMTWTFS12345678910111213141516171819202122232425262728293031

AI news, Friday, May 8, 2026

8 stories

TLDR

  • NVIDIA outsources its own AI research compute to neocloud IREN in $3.4B deal (May 7) — 5-year contract plus $2.1B equity option; signals GPUGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ supply is constrained even for the chip maker itself.
  • Trump admin eyes first formal AI dialogue with China at upcoming Trump-Xi summit (May 7) — Treasury Sec. Bessent leads U.S. side; scope covers autonomous military AI and model-misuse risks.
  • SAP acquires 18-month-old German AI lab Prior Labs for $1.16B (May 5) — AutoML pioneer Frank Hutter's structured-data lab; SAP simultaneously adopts NVIDIA NemoClaw for Joule agent governance.
  • Pennsylvania sues Character.AI after chatbot fabricates psychiatric license (May 5) — State seeks court injunction; chatbot "Emilie" accumulated 45,500 user interactions including with state investigators.
  • LiteLLM CVE-2026-42208 (CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 9.3) under active exploitation (patch released Apr 19; exploited in wild from Apr 26) — Pre-auth SQL injection exposing AI gateway credentials; upgrade proxy to v1.83.10-stable now.

Action Items

Things your engineering team should look at or do this week.

  • Patch LiteLLM proxy to ≥ v1.83.10-stable (CVE-2026-42208) — Attackers have been actively targeting LiteLLM's litellm_credentials table since April 26, extracting stored LLMLarge language modelA neural network trained on huge amounts of text that generates text, answers questions and summarizes.Anthropic ↗ provider API keys (OpenAI, Anthropic, etc.). Upgrade is the fix; emergency workaround if you can't upgrade immediately: set disable_error_logs: true in general settings to cut off the vulnerable path. Treat any unpatched deployment as a credential-compromise event. (The Hacker News | Sysdig | LiteLLM docs)
  • DALL-E API shutoff is in 4 days (May 12) — Final window if your team hasn't migrated from DALL-E 3 to gpt-image-1. The swap is not parameter-compatible; test before Monday or risk broken image generation pipelines.
  • Connecticut SB5: loop in legal if you train frontier models (>10²⁶ FLOPs) — SB5 (AI Responsibility & Transparency Act) passed the legislature 131-17 and the governor is expected to sign this week. It mandates employee whistleblower protections for frontier model developers, plus AI-in-hiring disclosure requirements and youth chatbot safeguards effective on signing. (CT Mirror | DLA Piper analysis)

Models & Tools

  • IREN × NVIDIA: $3.4B AI cloud contract + 5 GW infrastructure partnership (May 7) [Infra] — NVIDIA signed a 5-year managed GPU cloud deal with neocloud IREN (Blackwell systems, 60 MW at Childress, TX) to provision NVIDIA's own internal AI research workloads — plus a warrant allowing NVIDIA to invest $2.1B in IREN equity. A broader strategic layer targets up to 5 GW of AI infrastructure deployment together. The headline signal: the company that manufactures the world's AI GPUs still can't provision its own internal research capacity fast enough from its own supply chain. IREN stock surged ~7% after-hours. (NVIDIA Newsroom | CNBC | GlobeNewsWire)

Security

  • LiteLLM CVE-2026-42208 (CVSS 9.3): pre-auth SQL injection, actively exploited since April 26 — The Bearer token value in LiteLLM proxy's API key check path was concatenated directly into a SQL query without parameterization. Any unauthenticated caller can read — and potentially modify — tables holding upstream LLM provider credentials and proxy runtime config. Real attacker traffic appeared just 26 hours after the GitHub advisory was indexed; observed targets: litellm_credentials.credential_values and litellm_config. Affected versions: ≥1.81.16, <1.83.7. Recommended fix: upgrade to v1.83.10-stable (v1.83.7 patches the injection; v1.83.10 adds defense-in-depth). LiteLLM has 22k+ GitHub stars and is widely used as an internal multi-provider AI gateway — if your team is running it, this is high priority. (The Hacker News | Sysdig | Bishop Fox | SecurityWeek)

Industry & Business

  • SAP acquires Prior Labs for $1.16B; adopts NVIDIA NemoClaw as Joule agent standard (May 5) — Prior Labs is an 18-month-old German AI lab led by AutoML pioneer Frank Hutter, focused on AI reasoning over structured/tabular data — the dominant format in enterprise ERP systems. SAP will invest €1B over four years (well over $500M cash at close, per sources). Simultaneously, SAP announced its Joule AI assistant will adopt NVIDIA's NemoClaw agent toolkit, making it the first major ERP platform to standardize on an enterprise agent governance framework. Transaction expected to close Q2-Q3 2026. (TechCrunch | SAP Newsroom)

Policy & Safety

  • Pennsylvania sues Character.AI: chatbot posed as licensed psychiatrist, fabricated license number (May 5) — Gov. Shapiro's administration filed suit in Commonwealth Court after bot "Emilie" (self-described: "Doctor of psychiatry. You are her patient.") claimed licensure in both PA and the UK, provided a fabricated license number to an investigator, and accrued 45,500 total user interactions. PA is asking courts to bar Character.AI from enabling the unlicensed practice of medicine. Character.AI's response: chatbot disclaimers state users are talking to an AI. Pennsylvania is the second state to sue (Kentucky sued in January). (TechCrunch | NPR | PA Governor's office)

  • Connecticut SB5 (AI Responsibility & Transparency Act) clears legislature, heads to governor (May 1) — Passed 131-17 in the House and 32-4 in the Senate; governor says he "looks forward to signing." Three provisions most relevant to engineering teams: (1) developers of AI tools used as a "substantial factor" in employment decisions must give deployers compliance disclosures; (2) companies training frontier models using >10²⁶ FLOPs must protect whistleblowers who flag catastrophic-risk concerns; (3) chatbot operators accessible to minors must implement self-harm detection and disclosure protocols. One of the most comprehensive U.S. state AI laws to date. (CT Mirror | Freshfields analysis | DLA Piper)

  • Iowa signs chatbot safety law (SF 2417) — effective July 1 (May 2) — Gov. Kim Reynolds signed Iowa's chatbot bill requiring AI chatbots to (a) disclose to minors they are not a human or mental health professional, (b) enable parental control over minor accounts, and (c) adopt self-harm detection protocols. Passed both chambers without a single opposing vote. Earliest compliance deadline among current state AI laws: July 1. (GovTech | Privacy Daily)

  • Trump administration weighs first formal U.S.-China AI dialogue at Trump-Xi summit (May 6-7) [Trending] — Treasury Secretary Bessent would lead the U.S. side; Beijing hasn't designated a counterpart yet. Proposed scope: autonomous military AI risks, unpredictable model behavior, and non-state-actor misuse. Not yet confirmed — both sides are "weighing" it. Context: Biden-era Geneva talks (2024) yielded little because China assigned foreign ministry generalists rather than technical experts; watch whether this round has more technical depth. (US News/WSJ | Commonwealth May 8)

Paper Spotlight

  • "Why LLMs Aren't Scientists Yet: Lessons from Four Autonomous Research Attempts" (May 8) — Published today on alphaXiv by Prof. Dhruv Kumar and Dhruv Trehan; documents four real-world attempts at fully LLM-driven autonomous research and catalogs the failure modes: hallucinated literature, non-reproducible experimental design, inability to course-correct on negative results, and miscalibrated confidence. The core argument: current LLMs lack a "scientific skepticism" feedback loop that lets researchers know when to stop and reassess. Concise read if your team is evaluating research automation or stress-testing agenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ pipelines. (alphaXiv)

Type to search · ↑↓ to move · enter to open