JadidJust-in AI Developments, Incidents & Deadlines
May 2026
SMTWTFS12345678910111213141516171819202122232425262728293031

AI news, Monday, May 18, 2026

14 stories

TLDR

  • NextEra to buy Dominion for $67B (May 18) — Largest U.S. utility merger framed explicitly around AI data center power demand; Dominion already has 51 GW of data center capacity under contract with Google, Amazon, Microsoft, and Meta.
  • Anthropic in talks to raise $30B at $900B+ valuation (May 12) — Would top OpenAI's $852B last mark; Dragoneer, Greenoaks, Sequoia, Altimeter co-leading. Annualized revenue reportedly $30B+ by April.
  • OpenAI ships ChatGPT Personal Finance + Plaid integration (May 15) — Pro users in the U.S. can now link bank, brokerage, and credit accounts to ChatGPT across 12,000+ institutions.
  • GitHub Copilot / VS Code CVE-2026-41109 (CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 8.8) (May 12) — Injection bypass lets crafted commands stream raw, unfiltered model output past safety classifiers and org-level filters. Patch this week.
  • Mustafa Suleyman: white-collar work fully automatable in 18 months (May 16) — Microsoft AI CEO names accounting, legal, marketing, and project management as most vulnerable; framing for vendor and re-skilling debates ahead of I/O week.

Action Items

Things your engineering team should look at or do this week.

  • Apply May Patch Tuesday + GitHub Copilot updates — CVE-2026-41109 (CVSS 8.8) in Copilot/VS Code allows attackers to bypass content filters and org safety policy by streaming raw model output into the editor; CVE-2026-45033 in Copilot CLI allows arbitrary command execution via a malicious nested bare git repo using core.fsmonitor. Microsoft's broader May Patch Tuesday fixed 120 vulnerabilities including 29 critical RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗ flaws — push the patches and audit any Copilot CLI workflows that traverse cloned/external repos. (CVE-2026-41109 advisory | CVE-2026-45033 advisory | Patch Tuesday summary)
  • Watch Google I/O keynote Tuesday May 19, 10am PT / 1pm ET — Expected: Gemini 4.0 (or 3.5) launch, "Gemini Omni" unified text/image/video pipeline, "Gemini Spark"/Remy persistent cross-app agent, Android XR glasses preview. Most API string and pricing changes are announced within hours of the keynote. (Android Authority preview | Gizmodo preview)
  • Re-baseline vendor concentration risk — With Anthropic targeting $900B and OpenAI at $852B, both labs are now sitting on the cash to push pricing, deprecation timelines, and exclusivity terms more aggressively. Worth pulling forward your H2 multi-provider abstraction work and confirming you still have a credible second source (Gemini, open-weightA model whose trained weights are published for anyone to download and run.NTIA ↗) for each critical model path. (Bloomberg / Yahoo Finance)

Models & Tools

  • OpenAI launches ChatGPT Personal Finance with Plaid (May 15) [Customer AI] — Preview for Pro users in the U.S. on web and iOS. Connects to 12,000+ institutions (Schwab, Fidelity, Chase, Robinhood, AmEx, Capital One) and renders a dashboard of portfolio, spending, subscriptions, and upcoming payments. Read-only — no full account numbers, no transactional access. Intuit integration "coming soon." Comes a month after OpenAI's acqui-hire of Hiro. (OpenAI announcement | TechCrunch)

  • Notion Developer Platform: Workers + External Agent API (May 13) [Agents] — Notion shipped a programmable surface that lets teams deploy custom workers, connect external agents, and run multi-step automation backed by database sync. Positions Notion as an agent-runtime host on top of its existing docs/DB, in direct competition with Microsoft Agent 365 for the enterprise document-workflow segment. (SD Times roundup)

  • Honeycomb adds agent-native observability (May 13) [Agents] [Production] — New Agent Timeline gives a single view across multi-agent, multi-trace workflows, and a rebuilt Canvas workspace targets debugging non-deterministic pipelines. Notable because most existing APM tooling still treats LLMLarge language modelA neural network trained on huge amounts of text that generates text, answers questions and summarizes.Anthropic ↗ calls as opaque RPCs. (SD Times roundup)

  • Claude Sonnet 4.8: still unconfirmed by Anthropic (rumored mid-May) — Despite repeated leak reporting since Claude Code's March source-map exposure, there is no official Anthropic announcement. Treat any tooling vendor blog claiming "Sonnet 4.8 launched" with suspicion — current production Sonnet remains 4.6 per Anthropic. (Anthropic release notes)

Security

  • GitHub Copilot / VS Code CVE-2026-41109 (CVSS 8.8): safety filter bypass (May 12) [Production] — Microsoft disclosed an injection vulnerability that lets an attacker craft commands which force Copilot to stream raw, unfiltered model output directly into the editor, bypassing the built-in safety classifier and organization-level policy filters. No authentication required ("unauthorized attacker"). Update Copilot and VS Code now; review any team policies that assume filter enforcement is hard-blocking. (Advisory writeup | Windows News)

  • GitHub Copilot CLI CVE-2026-45033: bare-repo RCE via core.fsmonitor (May 2026) [Security] — A malicious bare git repository nested inside a project directory can exploit git's automatic bare-repo discovery during directory traversal. By setting core.fsmonitor or other executable config keys, an attacker can run arbitrary commands when Copilot CLI performs git operations — no approval prompt. Anyone running Copilot CLI on machines that clone or open untrusted repositories should upgrade. (GitLab Advisory mirror)

  • Microsoft Patch Tuesday May 2026: 120 fixes, 29 critical RCEs (May 12) [Production] — Big patch month. Beyond the Copilot CVECommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗, the cumulative update fixed 29 critical remote-code-execution issues across Windows, Office, and Azure components. If your team rolls patches on a delayed cadence, the Copilot bypass and the RCE volume probably justify pulling the cycle forward. (Cybersecurity News summary)

Industry & Business

  • NextEra Energy to acquire Dominion for $67B (May 18) [Infra] — All-stock deal at a 0.8138 exchange ratio creates a ~$400B utility colossus serving ~10M customers across Florida, Virginia, the Carolinas. Stated rationale is AI: Dominion already powers Northern Virginia (the world's largest data center cluster) and has 51 GW of data center capacity under contract with Google, Amazon, Microsoft, Meta. NextEra plans 30+ new data center hubs. Closes in 12–18 months, subject to FERC, NRC, state PUCs, and HSR. (CNBC | Bloomberg)

  • Anthropic in talks to raise ~$30B at $900B+ valuation (May 12) — Dragoneer, Greenoaks, Sequoia, and Altimeter co-leading the round; reportedly closing as early as end of May. The implied mark surpasses OpenAI's $852B at last raise and tracks reports of annualized revenue climbing from ~$9B at end of 2025 to ~$30B+ by April 2026. Pricing pressure and aggressive enterprise terms follow rounds like these — worth modeling. (Bloomberg via Yahoo Finance | TFN)

  • Mustafa Suleyman: AI hits "human-level on most professional tasks" in 18 months (May 16) [Customer AI] — Microsoft AI CEO told the FT that accounting, legal, marketing, and project management are most exposed, predicting AI model creation will be "like creating a podcast or writing a blog." Notable less for the forecast itself (industry-standard hype curve) than for who's making it three days before Google I/O and amid Microsoft's own org restructuring around Copilot. (Fortune | Tom's Hardware)

  • Cognizant lifts buyback by $2B, signals AI-driven growth (May 18) — Board authorized a $2B repurchase increase, leaving ~$3.45B available; 2026 buyback target raised to $2B with the incremental $1B targeted to close in Q2. Framed as a confidence signal as the IT services major leans into AI services / agent deployment work. Worth watching as a leading indicator for IT-services-sector AI pull-through. (TipRanks)

AI in Production

  • Europe's energy costs threaten AI data center buildout (May 18) [Infra] — CNBC: industrial power prices in Europe last year were roughly 2× U.S. and 50% above China/India; data center capacity costs across Frankfurt, London, Amsterdam, Paris, and Dublin are set to rise 12% in 2026 (CBRE). Franklin Templeton flagged the obvious consequence: marginal new AI capex flows to the U.S. or China. Practical signal for European-headquartered teams: account for asymmetric infrastructure availability in your 2026–27 capacity planning. (CNBC)

  • Together AI multi-incident week (May 4–5) [Production] — Together AI logged two service-degradation incidents within 24 hours earlier in May, a reminder that GPU-cloud "second sources" don't yet have hyperscaler-grade SLOs. If you're using a neocloud as failover, make sure your health-check + traffic-shift logic actually triggers on partial degradation (not just hard 5xx). (IsDown incident page)

Benchmarks & Evals

  • SWE-benchA benchmark that tests whether a model can resolve real GitHub issues by editing code in popular Python repositories.Jimenez et al. 2023 ↗ Pro: Claude Mythos Preview leads at 77.8%, Opus 4.7 at 64.3%, GPT-5.5 at 58.6% (as of May 13) — SWE-bench Pro is significantly harder than Verified — top scores on the public split are ~23% vs. 70%+ on Verified — and the gap between Mythos and GPT-5.5 is wider here than on Verified (where GPT-5.5 leads at 88.7%). Useful nuance if your coding-agent evaluations rely on a single benchmark; Pro better stresses real-world repo complexity. (Scale SWE-bench Pro leaderboard)

Type to search · ↑↓ to move · enter to open