JadidJust-in AI Developments, Incidents & Deadlines
May 2026
SMTWTFS12345678910111213141516171819202122232425262728293031

AI news, Monday, May 11, 2026

13 stories

TLDR

  • CISACybersecurity and Infrastructure Security AgencyThe U.S. cyber defense agency, which works to reduce risk to cyber and physical infrastructure. It runs KEV.CISA ↗ LiteLLM CVE-2026-42208 patch deadline is TODAY — Pre-auth SQL injection actively exploited since April 26; upgrade to v1.83.7+ now; FCEB agencies had until today.
  • OpenAI launches GPT-Realtime-2 with GPT-5-class reasoning (May 7) — Plus two companion models: live 70-language translation and streaming speech-to-text, all in the API.
  • Anthropic locks up SpaceX's entire Colossus 1 data center (May 6) — 300+ MW, 220,000+ NVIDIA GPUsGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗; company also signals interest in orbital AI compute.
  • Connecticut passes sweeping AI Responsibility Act (May 1, pending signature) — Covers frontier model provenance, employment AI disclosures, and whistleblower protections.
  • Coinbase cuts 14% of staff, restructures into AI-native pods (May 5) — Joins a growing list of firms flattening management and replacing roles with agent-driven workflows.

Action Items

Things your engineering team should look at or do this week.

  • Patch LiteLLM NOW — CVE-2026-42208 CISA deadline is today (May 11) — Versions v1.81.16 through v1.83.6 of the LiteLLM proxy have a pre-auth SQL injection in the API-key authentication path (CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 9.3). Attackers can read litellm_credentials and litellm_config tables — meaning your upstream LLMLarge language modelA neural network trained on huge amounts of text that generates text, answers questions and summarizes.Anthropic ↗ provider keys. Exploitation was observed 36 hours after disclosure on April 26. Upgrade to v1.83.7+. (CISA KEV | Bishop Fox writeup | LiteLLM advisory)
  • Final 24 hours: DALL-E 2 & 3 retire tomorrow, May 12 — After today, all calls to dall-e-2 and dall-e-3 fail. The replacement is gpt-image-1/gpt-image-1-mini; the request/response shape is not a drop-in swap (resolution options and billing model both changed). (OpenAI deprecations)
  • Review OpenAI GPT-Realtime-2 for any voice agent work — New voice API launched May 7 adds GPT-5-class reasoning with 128K context, parallel tool calls, and adjustable reasoning effort (normal / high / xhigh). GPT-Realtime-Translate adds live 70-language speech-to-speech translation; GPT-Realtime-Whisper adds streaming transcription. Pricing: $32/$64 per MTok audio in/out. (OpenAI announcement | TechCrunch)
  • DeepSeek V4 Pro at 75% off through May 31 — $0.44/$0.87 per MTok in/out at discount vs $1.74/$3.48 at list. Worth evaluating for reasoning-heavy workloads before the discount expires. (DeepSeek API docs)

Models & Tools

  • OpenAI GPT-Realtime-2 + GPT-Realtime-Translate + GPT-Realtime-Whisper (May 7) [Agents] [Customer AI] — Three new realtime audio models in the API. GPT-Realtime-2 is OpenAI's first voice model with GPT-5-class reasoning: 128K context (4× predecessor), handles interruptions without losing state, calls tools in parallel, and scores 15.2% higher on Big Bench Audio than v1.5. GPT-Realtime-Translate handles 70 input languages → 13 output at $0.034/min. GPT-Realtime-Whisper streams transcription live at $0.017/min. Adjustable reasoning effort (normal, high, xhigh) lets developers tune latency vs. intelligence. (OpenAI | 9to5Mac)

  • GPT-5.5 Instant ships as new default ChatGPT model (May 5) [Trending] — OpenAI replaced GPT-5.3 Instant as the ChatGPT default. Key improvement: 52.5% fewer hallucinated claims on high-stakes prompts (medicine, law, finance). Can now use search to reference past conversations, files, and Gmail for personalized answers (Plus/Pro on web; mobile rollout pending). API access available. (OpenAI | TechCrunch)

  • GitHub Spec Kit v0.8.7 (May 7) [Open Source] — The most-adopted open-source tool for spec-driven development shipped v0.8.7, now supporting 30+ AI coding agents including Claude Code, Cursor, and GitHub Copilot. If your team is standardizing on spec-driven workflows, this is the community reference implementation. (MarkTechPost)

APIs & Pricing

  • DeepSeek V4 Pro: 75% discount extended through May 31 (May 2026) — In/out pricing at $0.44/$0.87 per MTok during promotion vs $1.74/$3.48 list. Alias deprecation for deepseek-chat and deepseek-reasoner is scheduled July 24, 2026 — start migrating to versioned endpoints. (DeepSeek API docs | The Next Web)

  • DALL-E 2 & 3 retire May 12 (tomorrow) — Final reminder. See Action Items. (OpenAI deprecations)

Security

  • CVE-2026-42208: LiteLLM pre-auth SQL injection — CISA KEVKnown Exploited VulnerabilitiesCISA's list of vulnerabilities with reliable evidence of active exploitation and a clear fix, used to set patching priority.CISA ↗, actively exploited (disclosed Apr 25; CISA KEV May 8) [Trending] — Unauthenticated attacker can send a crafted Authorization header to any LLM API route (e.g., POST /chat/completions) and inject arbitrary SQL into the authentication path via LiteLLM's error-handling logic. Target tables: litellm_credentials.credential_values and litellm_config — containing upstream provider keys. First exploitation observed April 26, 36 hours after GitHub advisory indexed; confirmed by Sysdig. CISA added to KEV catalog May 8 with a today (May 11) patch deadline for FCEB agencies. Affected: v1.81.16–v1.83.6. Fix: upgrade to v1.83.7+. (CISA KEV | The Hacker News | Sysdig | Bishop Fox)

Industry & Business

  • Anthropic secures all of SpaceX's Colossus 1 data center (May 6) [Infra] [Trending] — Announced at Code with Claude SF: Anthropic signed an exclusive deal for 300+ MW and 220,000+ NVIDIA GPUs at SpaceX's Memphis Colossus 1 facility, with capacity coming online within the month. Anthropic also expressed interest in partnering with SpaceX on orbital AI data centers — a notable signal about where long-horizon infrastructure bets are heading. The deal will directly increase rate limits for Claude Pro and Claude Max subscribers. Notably, this adds Anthropic-SpaceX to the list of surprising cross-company AI infrastructure alliances. (CNBC | Anthropic | Axios)

  • Sierra raises $950M at $15B valuation (May 4) [Agents] [Trending] — Bret Taylor's enterprise AI agent startup raised a Series E led by Tiger Global and GV, with Benchmark and Sequoia also participating. Sierra reached $150M ARR in 8 quarters, serving 40%+ of the Fortune 50. The company recently shipped "Ghostwriter," an agent-building agent that creates and deploys specialized agents from natural language descriptions. Taylor publicly forecast a "culling effect" in the enterprise agent market — useful signal on where that space is headed. (TechCrunch | CNBC)

  • ElevenLabs crosses $500M ARR, closes $500M Series D at $11B valuation (May 5) [Customer AI] [Trending] — Voice AI platform grew from $350M ARR at year-end 2025 to $500M ARR by early May 2026 — a ~43% lift in ~5 months, driven by enterprise voice agent deployments in customer support and sales. The Series D includes strategic investors BlackRock, NVIDIA, Salesforce, Wellington, and Deutsche Telekom. The ARR run rate and investor roster make ElevenLabs the benchmark for voice AI infrastructure pricing decisions. (TechCrunch | CNBC)

  • Coinbase cuts 14% of staff; restructures into AI-native "pods" (May 5) [Hiring] [Trending] — CEO Brian Armstrong announced ~700 layoffs explicitly citing AI acceleration, eliminating "pure manager" roles in favor of "player-coaches." The company is reorganizing into AI-native pods — some potentially staffed by a single engineer directing multiple agents. Coinbase is one of several companies (also Block, Snap, PayPal) explicitly restructuring org charts, not just headcount, around AI capabilities. For engineering leaders, this is the clearest public articulation of what "AI-native org design" looks like in practice. (CNBC | Fortune)

Policy & Safety

  • Connecticut AI Responsibility and Transparency Act (SB 5) passes; governor to sign (May 1) [Trending] — Passed the House 131–17 and Senate 32–4. Key provisions: (1) Generative AI platforms with 1M+ monthly users must embed machine-readable provenance data in all generated audio, image, and video. (2) Employers using automated hiring tools must disclose this to applicants and cannot use AI as a defense against discrimination claims. (3) Large AI developers must have internal reporting obligations and whistleblower protections. Governor Lamont — who opposed prior AI bills — has announced intent to sign. Connecticut joins California's Transparency in Frontier AI Act as major state-level AI compliance requirements for 2026. (CT Mirror | Freshfields | DLA Piper)

  • Trump administration reconsidering AI oversight after Mythos capabilities review (May 6) — The administration, which previously opposed AI safety regulation, is now reportedly exploring oversight mechanisms for advanced frontier models, driven by Anthropic's Mythos Preview autonomously discovering thousands of critical zero-daysAn attack using a flaw that was unknown before it was exploited.NIST ↗ across major OSes and browsers. The shift mirrors a pattern seen with nuclear and bio regulation: capability demonstrations shift political postures faster than policy arguments. (Fortune)

Paper Spotlight

  • Google TurboQuant (ICLR 2026): 6× KV cache compression with near-zero accuracy loss — Google Research's TurboQuant quantizes LLM key-value caches to ~3 bits using a two-step process: random orthogonal rotation (PolarQuant) followed by Lloyd-Max scalar quantization on the now-predictable distribution, plus a 1-bit residual correction (QJL). Result: 6× memory reduction vs FP16 at 3.5-bit, up to 8× attention speedup on H100 GPUs, with benchmark-verified accuracy parity down to ~3.5 bits. No retraining or fine-tuningTraining an already trained model further on extra data so it fits a specific task, domain or style.Anthropic ↗ required. Practically useful for long-context inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ (256K+ windows) where KV cache is the primary memory bottleneck. No official Google implementation yet; community vLLM and llama.cpp integrations are active. (Google Research blog | GitHub community impl)

Type to search · ↑↓ to move · enter to open