JadidJust-in AI Developments, Incidents & Deadlines
May 2026
SMTWTFS12345678910111213141516171819202122232425262728293031

AI news, Sunday, May 17, 2026

13 stories

TLDR

  • OpenAI merges ChatGPT + Codex under Greg Brockman (May 16) — A sweeping org restructure three days before Google I/O; Brockman now owns all product, with a "superapp" unifying chat, coding, and the Atlas browser on the roadmap.
  • GitHub Copilot switches to token-based billing June 1 (Apr 27) — AgenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ usage will cost more; plan prices stay the same but heavy Copilot Chat / cloud agent users will see the difference.
  • Semantic Kernel CVE-2026-25592 / CVE-2026-26030 (CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 9.9) (May 7) — Prompt injectionInput crafted to change an LLM's behavior or output in ways its builders didn't intend.OWASP ↗ in Semantic Kernel .NET SDK < 1.71.0 can escalate to host-level RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗. Patch immediately.
  • EU AI Act Omnibus deal agreed (May 7) — High-risk AI compliance deadlines pushed to Dec 2027/Aug 2028; "nudifier" app ban added.
  • Trump White House weighs AI model review EO (May 5–6) — Prompted by Anthropic's Mythos cyber-offense model; could require federal vetting before any new frontier model ships.

Action Items

Things your engineering team should look at or do this week.

  • Patch Semantic Kernel immediately — If your agents run Semantic Kernel .NET SDK < 1.71.0, upgrade to 1.71.0+ now. CVE-2026-25592 (CVSS 9.9) allows prompt injection to become host-level RCE with no additional exploit required. (Microsoft Security Blog)
  • Audit Copilot usage before June 1 — GitHub Copilot's switch from premium-request billing to AI Credits (token-based) goes live June 1. Copilot Chat, CLI, cloud agent, and Copilot Spaces all consume credits; completions do not. Heavy agentic users on Pro ($10/mo, 1,000 credits) will burn through allotments fast — model the cost before the cutover. (GitHub Blog | GitHub Docs)
  • Watch Google I/O Tuesday–Wednesday (May 19–20) — Gemini 4 model upgrades, new agentic API tooling, Android 17, and Project Astra updates are all expected. API strings, pricing, and model deprecations often follow within days of I/O. (Google I/O 2026)

Models & Tools

  • OpenAI desktop superapp: ChatGPT + Codex + Atlas merger (May 16) [Agents] — OpenAI announced co-founder Greg Brockman will permanently lead all product strategy, merging the ChatGPT, Codex, and developer API teams into a single org timed three days before Google I/O. The roadmap: Codex expands to general productivity tasks first, then ChatGPT and the Atlas AI browser fold in to form a unified desktop "superapp." Nick Turley moves to enterprise; Ashley Alexander (ex-Instagram VP) takes over ChatGPT. Framed explicitly around a prospective IPO. (TechTimes | Benzinga)

  • Google I/O 2026 preview: Gemini 4 + agentic dev tools (May 19–20, upcoming) [Agents] — Confirmed expected topics include Gemini 4 upgrades (rumored to rival GPT-5.5), Gemini in Chrome with auto-browse, Veo video updates, Android 17, and new agentic API kits in Python and TypeScript. Watch for model string and pricing changes within days of the keynote. (Android Authority | Google Developers Blog)

  • Lambda raises $1.5B+ Series E + Microsoft GPUGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ deal (May 2026) [Infra] — AI cloud provider Lambda secured over $1.5 billion in Series E funding and a large Microsoft contract giving Microsoft access to tens of thousands of GPUs. Lambda is targeting 1M+ NVIDIA GPU deployments and 3 GW of liquid-cooled capacity — part of the broader neocloud buildout absorbing GPU supply that hyperscalers can't deploy fast enough. (Data Center Dynamics)

  • NVIDIA + IREN: 5 GW global AI infrastructure deal (May 8) [Infra] — NVIDIA took a $2.1B stake in data center operator IREN in exchange for access to NVIDIA chips, software, and networking across a planned 5 GW global AI factory footprint. Signals NVIDIA's deepening vertical integration beyond chip sales into compute-as-a-service. (Digitimes)

APIs & Pricing

  • GitHub Copilot → token-based billing June 1 (Apr 27) [Pricing] — Starting June 1, all Copilot plans switch from premium-request billing to GitHub AI Credits (token-consumption based). Plan prices don't change, but heavy agentic users — Copilot Chat, cloud agent, CLI, Copilot Spaces — will consume credits; standard completions and Next Edit Suggestions remain free within plans. Copilot Pro gets 1,000 credits/mo, Pro+ 3,900, Business 1,900/user, Enterprise 3,900/user. Annual plan holders stay on current billing until renewal. (GitHub Blog | GitHub Changelog)

  • GPT-5.5 API price doubled + fine-tuningTraining an already trained model further on extra data so it fits a specific task, domain or style.Anthropic ↗ API deprecated (Apr 23 / May 2026) [Pricing] — GPT-5.5 launched at $5/$30 per million input/output tokensA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗ — double GPT-5.4 pricing; the Pro tier runs $30/$180. Fine-tuning is unsupported for GPT-5.5 and OpenAI has deprecated its fine-tuning API. Batch API brings GPT-5.5 to $2.50/$15 — i.e., equivalent to GPT-5.4 standard. Teams with fine-tuning workflows need to re-evaluate strategy. (OpenAI Pricing | explainx.ai)

Security

  • Semantic Kernel CVE-2026-25592 / CVE-2026-26030 (CVSS 9.9): prompt → RCE (May 7) — Microsoft disclosed two critical vulnerabilities in Semantic Kernel .NET SDK. CVE-2026-25592: filter strings in the Search Plugin (In-Memory Vector Store, default config) are interpolated into a Python eval() expression; a prompt injection vector is sufficient to reach os.system and achieve host-level RCE — no memory corruption, no malicious attachment needed. CVE-2026-26030 was a related eval-chain issue. Both were patched in 1.71.0. If you run any Semantic Kernel-based agent, update now. (Microsoft Security Blog)

  • MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗ supply chain: RCE vulnerabilities across AI ecosystem (May 2026) [Security] — OX Security published an advisory documenting RCE-class vulnerabilities in MCP (Model Context Protocol) tool registries, where malicious or compromised MCP servers can execute arbitrary code in the host environment of any AI agent that loads them. As MCP adoption accelerates for giving agents tool access, the supply chain risk is live and under-mitigated. Treat MCP server sources the same as npm packages — vet before installing. (OX Security)

  • Microsoft MDASH: agentic security system found 4 critical Windows RCE flaws (May 13) [Security] [Production] — Microsoft's own MDASH agentic AI security system autonomously identified four critical Windows RCE vulnerabilities during an internal red-team run, illustrating both the power (AI finding bugs) and the risk (AI agents operating with broad system access) of agentic security tooling. (Help Net Security)

Industry & Business

  • OpenAI acqui-hires Hiro Finance (May 2026) [Agents] — OpenAI quietly completed its seventh known 2026 acquisition with the acqui-hire of Hiro Finance, an AI personal finance startup. The pattern: OpenAI is systematically assembling vertical domain expertise — consumer finance, healthcare, coding, browsing — faster than any other frontier lab, suggesting a broad "superapp" attack surface beyond chat. (TechCrunch)

AI in Production

  • Amazon's "high blast radius" AI-coding incident pattern (Mar–May 2026) [Production] — Fortune and internal reports surfaced that Amazon held mandatory meetings in March over a recurring pattern of production incidents tied to AI-assisted coding tools. The concern: AI-generated code changes are being pushed at higher velocity without commensurate review rigor, leading to cascading failures with higher blast radii than pre-AI incidents. The signal for engineering leads: your deploy review process needs to scale with AI coding adoption, not assume human-speed review is still the bottleneck. (Fortune)

Policy & Safety

  • EU AI Act Omnibus: compliance deadlines extended, nudifier apps banned (May 7) [Policy] — The European Parliament and Council reached a provisional political agreement on the Digital Omnibus package, significantly amending the EU AI Act. Key changes: high-risk AI systems (Annex III) now have until Dec 2, 2027 to comply (Annex I regulated products: Aug 2, 2028); AI-generated content watermarking pushed to Dec 2, 2026; SME protections extended to small mid-caps. New ban: "nudifier" apps generating non-consensual intimate imagery prohibited from Dec 2, 2026. Formal adoption expected before Aug 2, 2026. (EU Council Press Release | White & Case)

  • Trump White House weighing executive order to vet new AI models (May 5–6) [Policy] — In a significant policy reversal, the Trump administration is drafting an executive order that would require government review of new frontier AI models before public release — a direct response to Anthropic's Mythos model, which the administration says can autonomously identify and exploit cybersecurity vulnerabilities. Anthropic remains on the Pentagon's restricted-vendor list, though Trump recently told CNBC they're "shaping up." The proposed working group would include tech executives and federal officials. Unprecedented for a pro-deregulation White House. (Fortune | Axios | CNBC)

Type to search · ↑↓ to move · enter to open