JadidJust-in AI Developments, Incidents & Deadlines
May 2026
SMTWTFS12345678910111213141516171819202122232425262728293031

AI news, Sunday, May 24, 2026

8 stories

TLDR

  • Pope Leo XIV's first encyclical — Magnifica humanitas on AI and human dignity — drops tomorrow, presented with Anthropic co-founder Chris Olah (releasing May 25; pre-release coverage May 22) — First papal encyclical on AI; Olah's presence at the Synod Hall launch is the most prominent Silicon Valley/Vatican alignment to date and is already controversial inside the Church.
  • GitHub confirms ~3,800 internal repos exfiltrated via trojanized Nx Console VS Code extension — CVE-2026-48027 (Disclosed May 19) — TeamPCP (Google: UNC6780) pushed a malicious build of the 2.2M-install extension that was live in the VS Code Marketplace for ~11 minutes; payload harvested Claude Code / 1Password / npm / AWS / GitHub creds. Grafana and OpenAI also hit.
  • Anthropic acquires Stainless — winds down hosted SDK + MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗ generator used by OpenAI, Google, Cloudflare (May 18) — Reported >$300M deal pulls Anthropic's own SDK pipeline in-house and removes a key infra supplier from competitors. Existing customers keep their SDKs but lose the hosted generator.
  • Laravel-Lang Composer packages hijacked across 700+ versions to drop a credential-stealer (May 22–23, ongoing) Security — Attacker rewrote tags across laravel-lang/lang, /http-statuses, /attributes, and /actions to point to a malicious fork; payload exfiltrates cloud keys, K8s/Vault secrets, CI/CD tokensA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗, SSH, browser data, password vaults, and crypto wallets. Packagist unlisted; lockfile review urgent.
  • Federal jury dismisses all of Elon Musk's claims against OpenAI/Sam Altman (May 18) Policy — Jury took <2h to find Musk's 2024 breach-of-charitable-trust suit time-barred (3-yr statute, OpenAI's for-profit pivot known by 2019). Closes the largest single legal overhang on OpenAI's IPO path; the $180B disgorgement claim is gone.

Action Items

Things your engineering team should look at or do this week.

  • Run a VS Code / IDE extension audit before Monday standup — The May 18 Nx Console compromise (and last week's broader TeamPCP wave) shows the editor-extension surface is now a viable supply-chain ingress. Three same-day moves: (1) inventory every VS Code, Cursor, Windsurf, and JetBrains extension across the org and pin to specific versions; (2) verify dev machines that ran Nx Console between 12:30–12:48 UTC on May 18 have rotated GitHub PATs, npm tokens, AWS keys, Claude Code OAuth, and 1Password sessions; (3) confirm your CI cannot blindly trust marketplace-fetched extensions. (GitHub CISO statement via TechTimes | The Hacker News | Nx postmortem)

  • Re-pin Composer/PHP dependencies and check CI lockfiles for Laravel-Lang versions — The May 22–23 Laravel-Lang attack rewrote tags via a fork-commit trick that GitHub permits by design; many CI pipelines that fetch latest minor versions on rebuild will pull the malicious commits even after Packagist took them down. Pin to known-good SHAs, not tags, and treat composer.lock review as a PR-gate item for the next two sprints. (Bleeping Computer | StepSecurity advisory | The Hacker News)

  • If you rely on Stainless-generated SDKs, plan the wind-down before Q3 — Anthropic confirmed it will sunset all hosted Stainless products including the SDK generator. Customers keep ownership of SDKs already generated and retain modification rights, but new spec-to-SDK regeneration through the hosted service is on a clock. Two artifacts: (a) export your latest generated SDKs and check them into your own monorepo; (b) decide whether to migrate to OpenAPI Generator, Speakeasy, Fern, or pull the generator in-house before Anthropic's deprecation timeline lands. (Anthropic announcement | TechCrunch)

Models & Tools

  • Anthropic acquires Stainless — SDK + MCP generator behind every official Claude library (May 18) Agents — Stainless (founded 2022 by ex-Stripe engineer Alex Rattray; backed by Sequoia and a16z) generates Anthropic's TypeScript/Python/Go/Java SDKs and powers SDKs at OpenAI, Google, and Cloudflare. Anthropic will fold the team into its API platform and shut hosted services including the SDK generator; The Information pegged the deal at >$300M. Read this as Anthropic taking a critical primitive in-house and eliminating a cross-lab dependency — and as a signal that auto-generated SDKs are now a strategic surface for the MCP/agent era. (Anthropic blog | TechCrunch | Winbuzzer)

  • Claude Mythos GA signals — claude-mythos-1-preview strings appear in production builds (Observed May 23) Security — Tags and UI strings referencing "Access to the Claude Mythos model in Claude Code and Claude Security" surfaced in Anthropic's product source over the weekend, alongside Enterprise SKU integration and model-picker entries. Anthropic has not confirmed a date; observers are pegging a late-June to early-July window. Implication for security teams: the disclosure firehose Anthropic flagged on Friday's Glasswing update gets much wider once Mythos lands in general Claude Code, not just behind the partner pool. (TestingCatalog | Pasquale Pillitteri analysis)

  • LlamaParse v2 — agenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ document extraction relaunches with four-tier pricing (Mid-May) Data — LlamaIndex shipped a major rewrite of its document-extraction service with a simplified Fast/Cost Effective/Agentic/Agentic Plus tier system and up to 50% cost reduction vs. v1, plus better handling of complex layouts and tables for RAGRetrieval-augmented generationFetching relevant documents at query time and giving them to the model, so its answer draws on them.Lewis et al. 2020 ↗ pipelines. Useful if you've been deferring a document-ingest spend review. (LlamaIndex blog)

Security

  • GitHub: 3,800 internal repos exfiltrated via Nx Console VS Code extension v18.95.0 — CVE-2026-48027 (Disclosed May 19) Trending Open Source — Compromised Nx core contributor pushed a malicious build of the 2.2M-install Nx Console extension to the VS Code Marketplace between 12:30 and ~12:48 UTC on May 18; payload silently ran a shell command that downloaded a stealer targeting 1Password, Claude Code, npm, GitHub, and AWS credentials. GitHub CISO Alexis Wales confirmed ~3,800 internal repos were exfiltrated; Grafana Labs and OpenAI repos were also impacted via the same upstream compromise (TanStack maintainer credentials leaked seven days earlier). TeamPCP (Google: UNC6780) claimed responsibility and listed the data above $50K on cybercrime forums. (GitHub-via-CyberScoop | Help Net Security | Hackread | Nx postmortem)

  • Laravel-Lang Composer supply chain attackAn attack that reaches its target through a supplier, product or service the target relies on.NIST ↗ — 700+ malicious tags, 233 hijacked versions (Tags pushed May 22–23) Production Open Source — Attacker (likely with org-level credentials or compromised release infra) rewrote tags across laravel-lang/lang, /http-statuses, /attributes, and /actions to point to commits in a malicious fork, abusing GitHub's permissive cross-fork tag policy. The injected composer autoloader hook fetches a second-stage stealer from flipboxstudio[.]info and pulls cloud keys, K8s and Vault secrets, CI/CD tokens, SSH material, env files, browser data, password manager vaults, crypto wallets, and messaging tokens. Packagist unlisted the affected packages; lockfile audits and SHA-pinned dependency rebuilds are the safe path. (Bleeping Computer | The Hacker News | Aikido analysis)

Industry & Business

  • Anthropic acquires Stainless — closes a key supplier to OpenAI, Google, and Cloudflare (May 18) Trending — See Models & Tools for the engineering implications. Strategically, the deal removes a shared dependency from competing AI labs and pulls the SDK/MCP generation pipeline directly into Anthropic's stack as Claude pushes harder on agent/connector deployment. The Information first reported the talks last week at a >$300M figure. (Anthropic blog | TechCrunch)

  • Musk v. Altman/OpenAI: jury dismisses all claims in under two hours (May 18) Policy Trending — A nine-member federal advisory jury in the Northern District of California found that Musk's 2024 breach-of-charitable-trust suit was time-barred under California's three-year statute, accepting the defense argument that the for-profit pivot was public knowledge by Microsoft's 2019 investment. Judge Yvonne Gonzalez Rogers dismissed the case. Musk had sought up to $180B in disgorgement to force OpenAI and Microsoft profits into the original nonprofit foundation. Single biggest legal cloud over OpenAI's confidentially-filed S-1 is now lifted. (NPR | CBC | TIME)

Policy & Safety

  • Pope Leo XIV's Magnifica humanitas — first encyclical on AI, released tomorrow with Anthropic's Chris Olah at the podium (Launches May 25; signed May 15; presentation details published May 22) Trending — The Vatican confirmed the encyclical will be unveiled at 11:30 Rome time Monday in the Synod Hall, with Cardinals Fernández (Doctrine of the Faith) and Czerny (Integral Human Development), theologians Anna Rowlands and Leocadie Lushombo, and Anthropic co-founder Christopher Olah as presenters. Title means "Magnificent Humanity"; focus is "the protection of the human person in the age of artificial intelligence." The Pope previewed the line "The challenge we currently face is not technological, but anthropological" on X on May 22. Olah's invitation is already drawing critical commentary — Tristan Harris flagged it as a "valid concern," and the timing follows Pope Leo's separate launch of a Vatican AI commission. Watch for whether the document moves any of the active EU/UK/US policy debates — even non-binding, papal encyclicals tend to enter legislative speeches within weeks. (Vatican News | Religion News | PBS NewsHour | Fortune on the AI commission)

Type to search · ↑↓ to move · enter to open