JadidJust-in AI Developments, Incidents & Deadlines
June 2026
SMTWTFS123456789101112131415161718192021222324252627282930

AI news, Friday, June 12, 2026

8 stories

TLDR

  • Microsoft 365 Copilot down 4 hours on June 11 — second outage in 11 days; auth token bug cascaded into retry storms across M365, Windows 11, and Edge globally; RCA expected June 14
  • Windsurf CVE-2026-30615 now public (Jun 2026) — zero-clickAn attack that compromises a device without the user clicking, opening or interacting with anything.F5 ↗ RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗ via prompt injectionInput crafted to change an LLM's behavior or output in ways its builders didn't intend.OWASP ↗ in Windsurf 1.9544.26; patch immediately
  • New York wraps AI-packed legislative session (Jun 12) — 7 bills to Gov. Hochul: nation-first hyperscale data center moratorium, companion chatbot ban for minors (unanimous 137-0/60-0), surveillance pricing ban, AI training data transparency
  • EU AI Act full applicability in 51 days (Aug 2) — high-risk AI system obligations, transparency rules, and Commission enforcement fines activate simultaneously
  • Project Glasswing expands to 150+ orgs in 15+ countries (Jun 2) — Anthropic extends Claude Mythos access to power, water, healthcare, and hardware sectors

Action Items

Things your engineering team should look at or do this week.

  • Patch Windsurf past version 1.9544.26 now — CVE-2026-30615 is publicly disclosed: malicious HTML content in 1.9544.26 can silently hijack your local MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗ config, register a malicious STDIO server, and execute arbitrary commands with zero user interaction required. This is the only AI IDE in testing where exploitation required no click, no approval prompt, no warning. Patch is available in versions above 1.9544.26. (NVD | GitHub Advisory | PolicyLayer)

  • Map your EU AI Act high-risk AI exposure — The August 2, 2026 deadline is 51 days away. High-risk AI system obligations, transparency rules, and Commission enforcement powers (fines up to 3% of worldwide annual turnover for GPAI compliance failures, up to 5% for systemic-risk violations) all activate at once. If your team ships AI into EU markets for hiring, credit scoring, critical infrastructure monitoring, or safety-critical systems, the compliance window is nearly closed. GPAI models placed on market before August 2, 2025 get a grace period to August 2027 — check if yours qualify. (EU AI Act Timeline | EU Digital Strategy)

  • Add Copilot health monitoring to your incident runbooks — Microsoft 365 Copilot has had two significant outages in 11 days (June 1: 5-hour routing failure; June 11: 4-hour auth token failure). If any workflows depend on Copilot features in production, set up health alerting via the M365 Service Health Dashboard and have a fallback plan ready before the RCA drops Monday. (GV Wire | Windows News)

Models & Tools

  • OpenCode (Jun 2026) Open Source — Jumps to #1 in LogRocket's June 2026 AI dev tool power rankings, the first major disruption since Cursor 3's rebuild. MIT-licensed, model-agnostic CLI coding agent supporting 75+ providers (Claude, GPT, Gemini, DeepSeek, local via Ollama); standout features: LSP integration that feeds compiler diagnostics back to the model, background subagents, and a Scout agent for external research. 160K+ GitHub stars, 7.5M monthly active developers. Trade-off: 78% slower than Claude Code on the same model, but produces more thorough output; no vision/audio support. (LogRocket)

  • Project Glasswing expansion (Jun 2) Security Agents — Anthropic extended Claude Mythos Preview access to ~150 additional organizations across 15+ countries, adding power, water, healthcare, communications, and hardware sectors not well represented in the initial cohort. New partners include Cloud Software Group. Pricing: $25/$125 per million input/output tokensA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗ via Claude API, Amazon Bedrock, Google Vertex AI, and Microsoft Foundry. (TechCrunch | Anthropic)

  • Google WebMCP origin trial launched (Chrome 149) Agents — Chrome 149 begins the experimental origin trial for WebMCP, a proposed W3C standard co-developed with Microsoft that lets websites expose callable JavaScript functions and HTML forms directly to browser AI agents — replacing brittle screenshot-and-guess navigation with a structured Tool Contract API (navigator.modelContext). Gemini in Chrome will support it first; Firefox committed Q3 2026, Safari expected Q4. (Chrome Dev Blog | eWeek | Search Engine Land)

Security

  • CVE-2026-30615: Windsurf zero-click RCE via prompt injection (Jun 2026) Trending — In Windsurf 1.9544.26, attacker-controlled HTML content containing injected prompts can bypass all guardrails: the AI silently modifies the local MCP configuration, registers a malicious STDIO server, and executes arbitrary commands — with no click, no approval dialog, and no user warning. The only AI IDE in testing with zero-interaction exploitability. Google, Microsoft, and Anthropic declined to issue CVEsCommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗ for their respective tools, arguing explicit user permission gates the relevant file modifications. Patch available in versions above 1.9544.26. (NVD | GitHub Advisory | OX Security MCP Advisory)

Industry & Business

  • New York wraps AI legislative session (Jun 12) Policy — The NY legislature ended its 2026 session sending 7 AI-related bills to Gov. Hochul (Dec 31 deadline to sign/veto). Headlines: a companion chatbot ban for minors passed unanimously (137-0 Assembly, 60-0 Senate); a 1-year moratorium on new hyperscale data center permits (>20 MW peak load) that would make New York the first state with such a freeze; an AI training data transparency act requiring dataset disclosure summaries; an AI content provenance/watermarking bill; and a surveillance pricing ban (prohibiting dynamic pricing driven by personal behavioral data, passed 100-42/39-21). Rhode Island separately passed a therapy chatbot ban the same week. (Transparency Coalition | Food & Water Watch)

AI in Production

  • Microsoft 365 Copilot — June 11 outage (Jun 11) Trending — A misconfigured authentication token issuance update took down Copilot across M365 (Word, Excel, Outlook), Windows 11, and Edge for ~4 hours, peaking at 12,000+ simultaneous DownDetector reports. Root cause: the auth bug triggered retry storms, requiring a config rollback and full traffic rerouting to restore service. RCA expected June 14. This is the second major outage in 11 days — after June 1's 5-hour event caused by an Azure OpenAI routing layer certificate mismatch. The pattern: Copilot has been pushed into daily workflow infrastructure faster than its reliability guarantees can support. (GV Wire | Windows News)

Policy & Safety

  • EU AI Act: T-51 days to full applicability (Aug 2, 2026) — August 2 is the date when high-risk AI system obligations, AI transparency rules, and the Commission's enforcement powers (including fines) all activate simultaneously. After this date the Commission can levy fines of up to 3% of worldwide annual turnover for standard GPAI compliance failures and up to 5% for systemic-risk model violations. Developers shipping into EU markets in hiring, credit, biometrics, critical infrastructure, or law enforcement AI categories face the most immediate exposure. (EU Digital Strategy | EU AI Act Timeline)

Benchmarks & Evals

  • CVPR 2026 best papers announced (Jun 9) — From 4,089 accepted papers (16,092 submissions), best paper honors went to D4RT (Google DeepMind, University College London, University of Oxford): a single network that reconstructs the geometry and motion of dynamic 4D scenes from video, advancing physically grounded world simulation relevant to robotics, autonomous vehicles, and AR/VR. (Newswise)

Type to search · ↑↓ to move · enter to open