JadidJust-in AI Developments, Incidents & Deadlines
May 2026
SMTWTFS12345678910111213141516171819202122232425262728293031

AI news, Wednesday, May 13, 2026

10 stories

TLDR

  • Microsoft's agenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ AI scanner found 4 critical Windows RCEs (May 12) — A 100-agent system codenamed MDASH discovered 16 flaws shipped in today's Patch Tuesday, including a Netlogon and a DNS Client RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗ both at CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 9.8. Patch now.
  • Cloudflare cuts 1,100 jobs (20% of workforce) citing AI (May 7–13) — First mass layoff in company history; CEO Matthew Prince says internal AI usage is up 600% in three months. Stock dropped 23%.
  • Alibaba: AI/cloud revenue +38%, capex $38.7B, profit −84% (May 13) — Cloud Intelligence accelerated to 26% growth with AI products posting triple-digit gains for the 8th straight quarter, but the spending spree triggered Alibaba's first operating loss since 2021.
  • Google in talks with SpaceX for orbital data centers (May 12) — Project Suncatcher's first launches now look like a SpaceX-on-Falcon-or-Starship play; comes a week after Anthropic agreed to use the full Colossus 1 facility.
  • South Korea floats "AI citizen dividend," Kospi tumbles (May 12) — Presidential policy chief proposed redistributing AI windfall taxes; Kospi sank 5.1% intraday and AI chip stocks led a US selloff (Intel −6.8%, Micron −3.6%, CoreWeave −6.1%).

Action Items

Things your engineering team should look at or do this week.

  • Patch the May 2026 Patch Tuesday RCEs immediately — 120 flaws, 17 critical, no zero-daysAn attack using a flaw that was unknown before it was exploited.NIST ↗ but several pre-auth network RCEs at CVSS 9.8: Netlogon (CVE-2026-41089), Windows DNS (CVE-2026-41096), IKEEXT pre-auth double-free (CVE-2026-33824, hits RRAS VPN / DirectAccess / Always-On VPN). Domain controllers and VPN endpoints are the priority. (BleepingComputer | Tenable)
  • Pilot Cursor 3.3's /multitask parallel subagents on a real plan — May 7 release adds async subagent execution ("Build in Parallel"), a Vulnerability Scanner beta for scheduled CVECommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗/dependency checks, and a new in-IDE PR review flow. Worth a head-to-head against Claude Code's multi-agent on the same task. (Cursor changelog | InfoQ)
  • Preview your June 1 GitHub Copilot bill now — Copilot switches from request-based to usage-based billing June 1; preview-bill experience is already live in admin. Chat, CLI, cloud agent, Spaces, and Spark consume credits; tab completions and next-edit suggestions stay unlimited. Pull the preview, model multiplier table, and your top consumers before month-end. (GitHub Blog | Docs)
  • If you build on Microsoft Semantic Kernel or any tool-using agent, read the MDASH writeup — It's the most detailed public case of an AI system independently producing exploitable RCE chains in shipping software, and the methodology (debate-and-validate across ~100 specialists) is replicable internally. Pair it with last week's "prompts-become-shells" Semantic Kernel post to map your own tool-registry attack surface. (Microsoft Security Blog | Help Net Security)

Models & Tools

  • Cursor 3.3 (May 7) [Agents] [Security] — Cursor ships /multitask for async subagents that parallelize independent parts of a plan ("Build in Parallel"), a new PR Review tab (file tree, inline threads, quick-action pills) inside the editor, and a Security Review beta with always-on Security Reviewer + Vulnerability Scanner agents for scheduled codebase scans (Slack alerting included). Cursor is converging fast on the Claude Code feature surface for teams that prefer an IDE over the terminal. (Cursor changelog | Cursor security agents)

APIs & Pricing

  • GitHub Copilot moves to usage-based billing June 1 (effective Jun 1, 2026) [Pricing] — Plan prices stay the same (Pro $10, Pro+ $39, Business $19, Enterprise $39), but you now get a matching monthly AI Credits allotment ($0.01/credit) and pay overage by tokenA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗ consumption (input + output + cached) at API rates. Copilot Chat, CLI, cloud agent, Spaces, Spark, and third-party coding agents draw down credits; code completions and next-edit suggestions remain unlimited on paid plans. Annual-plan customers can stay on request-based multipliers for now. (GitHub Blog | GitHub Docs: Models & pricing)

Security

  • Microsoft MDASH agentic security system finds 16 Windows flaws, 4 critical RCEs (May 12) [Trending] [Agents] — Microsoft's Autonomous Code Security team disclosed MDASH, a multi-model harness that orchestrates 100+ specialized agents across frontier and distilled models to discover, debate, and validate exploitable bugs end-to-end. It found all 16 vulnerabilities patched in today's Patch Tuesday — four critical RCEs (including Netlogon and Windows DNS Client, both CVSS 9.8) and 12 important-rated EoP/DoS/infoleak/bypass bugs. MDASH scored 88.45% on the CyberGym agent benchmark (1,507 OSS-Fuzz tasks across 188 projects), now #1 on the leaderboard. Currently in limited private preview. Together with last week's Semantic Kernel RCE writeup (CVE-2026-25592 / CVE-2026-26030) this is the strongest public evidence yet that frontier-model-driven defensive vuln discovery is leaving the lab. (Microsoft Security Blog | Help Net Security | CSO Online)

  • May 2026 Patch Tuesday: 120 flaws, 17 critical, zero zero-days (May 13) — Other items worth attention beyond the AI-discovered Netlogon/DNS/IKEEXT RCEs: CVE-2026-42898 is a CVSS 9.9 code injection in Microsoft Dynamics 365 on-premises (auth required), and CVE-2026-41094 is an RCE in Microsoft's AI Data Formulator visualization tool — a reminder that Microsoft's own AI products are now part of the patch surface. (The Hacker News | BleepingComputer)

Industry & Business

  • Cloudflare cuts ~1,100 jobs (20% of workforce) in AI-driven restructuring (May 7) [Hiring] [Trending] — First mass layoff in Cloudflare's 16-year history, announced alongside a record Q1 (revenue +34% YoY). CEO Matthew Prince said internal AI usage is up 600% in three months and that AI-efficient employees are "so much more productive than we'd ever seen before"; he predicts Cloudflare will have more total employees again by 2027. Severance runs through year-end with accelerated equity vesting; stock dropped ~23%. Adds to the Coinbase + GM + Freshworks pattern: this is not a cost-cutting story, it's a role-mix story. (TechCrunch | CNBC | Cloudflare Blog)

  • Isomorphic Labs raises $2.1B Series B for AI drug design (May 12) — Alphabet's DeepMind drug-discovery spin-out, led by Demis Hassabis, raised $2.1B at an undisclosed valuation. Thrive Capital led; Google Ventures, Alphabet, MGX, Temasek, and CapitalG also in. Money funds the IsoDDE engine and pushes 17 active pipeline programs in oncology/immunology/cardio toward first clinical trials by end of 2026 (delayed from prior end-of-2025 target). One of the largest AI-bio rounds on record. (FierceBiotech | Isomorphic Labs)

  • Alibaba: AI/cloud revenue +38%, capex blows to $38.7B, Q1 profit −84% (May 13) — Cloud Intelligence Group accelerated to 26% reported revenue growth; AI products posted triple-digit growth for the 8th consecutive quarter. The cost: capex surged to $38.68B as Alibaba builds out AI infrastructure, dragging adjusted EBITA down 14% and pushing the group to its first operating loss since 2021 (≈$125M). Free cash flow swung to −$18.8B. CEO told investors return on AI investment is "extremely clear" — but the market disagrees: BABA is now the bellwether for "is hyperscaler AI capex sustainable?" alongside Microsoft/Meta. (CNBC | Bloomberg | Washington Post)

  • AI chip stocks lead a market-wide pullback (May 12) [Trending] — S&P 500 broke a record-setting run as AI-leveraged names fell hard: Intel −6.8% (still +200%+ YTD), Micron −3.6% (was +180% YTD), CoreWeave −6.1%. Trigger was the South Korea AI windfall-tax proposal (see Policy) plus a +3.4% Brent crude move on Iran headlines. Useful pulse check for anyone budgeting AI compute through 2026: the supply chain is still concentrated enough that one Asian policy comment can move every Nvidia adjacent name. (CommBank Newsroom)

AI in Production

  • Google in talks with SpaceX to launch Project Suncatcher orbital data centers (May 12) [Infra] — TechCrunch and WSJ report Google has been in active discussions with SpaceX about launch services for Suncatcher — Google's research program to network TPU-equipped, solar-powered satellites into an orbital AI cloud. Google is shopping launch providers more broadly, and the first prototype launch (with Planet Labs) is still targeted for 2027. Coming a week after Anthropic agreed to use the full SpaceX Colossus 1 facility and signaled interest in multi-GW space-based compute, "orbital compute" is rapidly graduating from press-release territory to capacity planning. (TechCrunch | Data Center Dynamics)

Policy & Safety

  • South Korea floats "AI citizen dividend" funded by tax on AI windfall (May 12) [Trending] — Presidential policy chief Kim Yong-beom proposed using "excess tax revenue" from the AI/semiconductor boom (Samsung + SK Hynix could pay >100T won in 2026 corporate taxes alone) to fund a citizen dividend, startup grants, rural basic income, artist funding, and pensions. The Kospi sank up to 5.1% before paring losses on clarification that the proposal targets existing tax revenue, not a new windfall levy. An official said the comments were Kim's "personal opinion" — but the immediate global AI-stock reaction makes this the first concrete case of a major economy publicly debating redistributing AI economic surplus. Worth tracking as a template other governments may copy. (Bloomberg | Japan Times)

Type to search · ↑↓ to move · enter to open