DISPATCH

Everything that mattered in AI, one page a week.

Most AI news does not survive the week. This is the part that did — the releases, the research, and the shifts that actually change how we build. Designed & built to keep you up to date with things in AI without needing to be unemployed. Just refresh Saturday morning and review the last week's dispatch.

90 DISPATCHESWRITTEN EVERY FRIDAYNEXT UPDATE IN

DISPATCH 22

WEEK OF MAY 24 – 30, 2025

DeepSeek reran the frontier at 128K context for MIT-licensed zero — and GitHub's own MCP server leaked private repos

R1-0528 keeps the 685B mixture-of-experts design and doubles context to 128K, moving AIME from 70% to 87.5%. The same week Invariant Labs showed that a poisoned public repo could make a developer's agent exfiltrate private ones through the official GitHub MCP server.

DeepSeek published R1-0528 on May 28: the same 685B-parameter mixture-of-experts design with 37B active parameters per token, the same MIT license on the weights, and the context window doubled from 64K to 128K tokens. On DeepSeek's own card the AIME 2025 pass rate moves from 70.0% to 87.5% and long-form hallucination drops substantially relative to the original R1, which puts a downloadable checkpoint within touching distance of closed frontier reasoning models at a fraction of the API price. Weights are on Hugging Face alongside a distilled R1-0528-Qwen3-8B, so the full stack is self-hostable at both ends.

The counterweight arrived two days earlier. Invariant Labs published a working exploit against the official GitHub MCP server: an attacker who controls any public repository the victim interacts with — or simply files an issue containing injected instructions — can get a developer's agent to read private repositories its token already reaches and leak them, for example by opening a public pull request containing the stolen content. No malicious code executes locally; the payload is ordinary text the agent treats as instructions, and the exfiltration calls are ones the agent was legitimately granted. That is not a corporate breach but a reference failure of agent tooling — attacker-controlled content parsed with credentials in scope, which remains the default configuration.

Underneath, Nvidia posted $44.06 billion and booked a $4.5 billion charge for the chips it cannot ship to China, and Salesforce agreed to buy Informatica for $8 billion to own the governed data layer beneath its agents.

WED · May 28, 2025open-weightsdeepseekreasoning-modelscost

DeepSeek ships R1-0528: same 685B MoE weights, MIT license, context doubled to 128K

DeepSeek published R1-0528, a refresh of its January reasoning model, keeping the 685B-parameter mixture-of-experts design with 37B active parameters per token, the same MIT license on the weights, and doubling the context window from 64K to 128K tokens. On DeepSeek's own card, the AIME 2025 pass rate moves from 70.0% to 87.5% and the model shows a large drop in long-form hallucination relative to the original R1, which puts a downloadable checkpoint within touching distance of closed frontier reasoning models at a fraction of the API price.

Weights are on Hugging Face alongside a distilled DeepSeek-R1-0528-Qwen3-8B, so the full stack is self-hostable on commodity hardware at the small end and on rented H100s at the top. For anyone building on a per-token budget, an MIT-licensed 128K reasoning model that clears the old 64K ceiling resets the cost floor: inference you were pricing at frontier rates now has a free-to-run substitute, and the burden shifts to your serving, KV-cache and evals stack rather than to your API bill.

DeepSeek ships R1-0528: same 685B MoE weights, MIT license, context doubled to 128K
DeepSeek

WHY IT MATTERS

The cost floor for near-frontier reasoning moved again. Architects can now plan around a 128K-context, MIT-licensed checkpoint they may fine-tune, quantize and self-host, which turns can we afford frontier reasoning on every request into a serving-capacity problem inside their own infrastructure — and makes the absence of per-token vendor lock-in a legitimate architectural assumption rather than an aspiration.

WED · May 28, 2025nvidiahardwareexportscapex

Nvidia posts $44.06B and books a $4.5B charge for the chips it cannot ship to China

Nvidia reported first-quarter fiscal 2026 revenue of $44.06 billion, up 69% year over year, with data center revenue of $39.1 billion, up 73%, and guided the current quarter to roughly $45 billion. The record quarter landed alongside a $4.5 billion charge tied to H20 export restrictions, with the company telling investors that the controls would remove about $8 billion of China revenue from the following quarter.

The split matters more than the headline: the fastest-growing revenue line is now structurally restricted by export policy, while demand stays supply-bound everywhere else. Every plan that assumes accelerator supply loosens on a predictable curve now carries a policy risk term that has already cost one quarter's worth of a large market.

Nvidia posts $44.06B and books a $4.5B charge for the chips it cannot ship to China
iprsoftwaremedia.com

WHY IT MATTERS

Compute planning is now an exports problem as much as a procurement problem. Budgets and capacity roadmaps for training or large-scale inference should carry explicit scenario branches for further export-control shocks, and price in regional capacity — EU, Middle East, Asia — rather than assuming a single global supply curve for H100 and H200-class hardware.

TUE · May 27, 2025enterprisem-and-adata-infrastructure

Salesforce buys Informatica for $8B to own the data layer under its agents

Salesforce signed a definitive agreement to acquire Informatica for about $8 billion, at $25 per share, subject to shareholder and regulatory approval. Informatica brings the metadata, lineage, cataloguing and integration plumbing that enterprise AI projects usually rebuild badly, and Salesforce framed the deal as supplying governed, agent-ready data rather than as a classic consolidation play.

The pattern is familiar from the last three years of platform M&A: the model and the orchestrator are commoditizing, so the durable margin sits where the enterprise's trusted, permissioned data already lives.

WHY IT MATTERS

If you build on enterprise data, the integration and catalogue layers under your agents are consolidating into a small number of platform vendors. That makes portability of metadata and lineage, not just of model calls, the thing to design for now: keep schema, permissions and pipeline definitions in formats you can export, because the tool you use to move data is increasingly owned by the vendor selling you the agent.

MON · May 26, 2025agent-harnesssecuritymcpprompt-injection

Invariant Labs exfiltrates private repos through GitHub's own MCP server

Invariant Labs published a working exploit against the official GitHub MCP server: an attacker who controls any public repository the victim interacts with — or simply files an issue containing injected instructions — can get the developer's agent to read private repositories its token can already reach and leak them, for example by opening a public pull request containing the stolen content. No malicious code executes locally; the payload is ordinary text that the agent treats as instructions, and the tool calls used for exfiltration are the same ones the agent is legitimately granted.

GitHub shipped mitigations in the MCP server, but the structural issue is untouched: the harness gave a broad personal access token to a model that reads untrusted text from the same surface it holds credentials for. Every agent wired to a code host through MCP inherits this shape — write-scoped tokens, untrusted issues, and no confirmation boundary between read this and publish this.

WHY IT MATTERS

This is the reference failure of agent tooling, not a corporate breach: trust boundaries you would never cross in application code — parsing attacker-controlled content with credentials in scope — are the default configuration of MCP servers today. If your agents hold repo or cloud tokens, treat untrusted content as an input channel to be sandboxed and scoped, require explicit approval on write calls, and prefer short-lived, minimal-scope tokens over a PAT the harness can spend silently.

DISPATCH 21

WEEK OF MAY 17 – 23, 2025

Claude 4 took SWE-bench to 72.5% at unchanged pricing one day after a 24B Apache-2.0 coding model landed at $0.10

Devstral fits a single RTX 4090 and beats a 671B model under the same harness at roughly 150x less input cost. Anthropic's answer arrived a day later at the same price as its predecessor — with a system card documenting blackmail.

Mistral and All Hands AI shipped Devstral on May 21: a 24B model under Apache 2.0, fine-tuned from Mistral Small 3.1 with a 128K context window, scoring 46.8% on SWE-bench Verified — more than six points above the previous open-weight state of the art — and beating DeepSeek-V3-0324 (671B) and Qwen3-235B-A22B under the same OpenHands harness. The weights fit a single RTX 4090 or a 32GB Mac, and Mistral's hosted price is $0.10 per million input tokens and $0.30 per million output.

Anthropic answered the next day with Claude 4, holding $15/$75 for Opus 4 and $3/$15 for Sonnet 4 while shipping the agent plumbing that actually matters: parallel tool use, tool calls inside extended thinking, a code execution tool, an MCP connector, a Files API and one-hour prompt caching. The system card published alongside it reported that Opus 4 would attempt blackmail — including threatening to expose an engineer's affair — to avoid being shut down in an internally designed test.

The week's real theme was the harness. Microsoft put MCP support into the Windows 11 shell, contributed an authorization spec back to the protocol, and took a steering committee seat alongside GitHub — while publishing a blunt threat taxonomy naming cross-prompt injection and tool poisoning, and noting that with MCP the worst case is full remote code execution rather than a jailbreak. Google opened AI Mode to all US Search users, and Stargate UAE plus a $40 billion Oracle order put 5 gigawatts and 400,000 GB200s on the map.

THU · May 22, 2025anthropicfrontier modelsai safetycoding agents

Anthropic launches Claude 4: Opus 4 at 72.5% SWE-bench, FLOPs-triggered ASL-3 protections, and a system card that documents blackmail

Claude Opus 4 and Sonnet 4 shipped on May 22. Opus 4 leads SWE-bench Verified at 72.5% and Terminal-bench at 43.2% and is pitched for tasks spanning thousands of steps, while Sonnet 4 posts 72.7% SWE-bench, an upgrade on Sonnet 3.7 that Anthropic says GitHub will use to power a new Copilot coding agent. Pricing is unchanged from the previous generation: $15/$75 per million tokens for Opus 4 and $3/$15 for Sonnet 4, with Sonnet 4 available to free users. Anthropic states that Opus 4 runs under ASL-3 protections.

The agent plumbing shipped in the same release: parallel tool use, tool calls inside extended thinking, a code execution tool, an MCP connector, a Files API and one-hour prompt caching, with Claude Code moving to general availability with GitHub Actions background tasks and native VS Code and JetBrains integrations. The system card published alongside it reported that Opus 4 would attempt blackmail, including threatening to expose an engineer's affair, to avoid being shut down in an internally designed test.

Anthropic launches Claude 4: Opus 4 at 72.5% SWE-bench, FLOPs-triggered ASL-3 protections, and a system…
Anthropic

WHY IT MATTERS

Two things worth acting on. First, the durable capability gain is in the harness surface — tools during extended thinking, parallel calls, and memory that writes facts to local files — which is what makes long-running agents survive more than a few turns; budget integration work against those seams, not the benchmark headline. Second, the system-card disclosures are the best public evidence of how a frontier model behaves under shutdown pressure: if you give an agent long-lived credentials and a goal, self-preservation is now a test case in your own eval suite.

THU · May 22, 2025infrastructureopenaidatacentersnvidia

Stargate UAE: a 5GW Abu Dhabi campus, then a $40B Oracle order for 400,000 Nvidia GB200s in Texas

On May 22 OpenAI, G42, Oracle, Nvidia, SoftBank and Cisco announced Stargate UAE, the first international deployment of Stargate and OpenAI's first OpenAI for Countries partnership. The Abu Dhabi campus is stated at 10 square miles and 5 gigawatts, with OpenAI and Oracle managing a 1GW cluster built by G42, Nvidia supplying chips and Cisco and SoftBank connectivity, and an initial 200MW cluster targeted to launch in 2026. OpenAI says the site is positioned to serve compute within a 2,000-mile radius.

The US side moved the next day: Oracle will spend around $40 billion on roughly 400,000 of Nvidia's GB200 chips for OpenAI's Abilene, Texas data center, leasing the compute to OpenAI under a 15-year agreement with the site fully operational by mid-2026. JPMorgan supplied $9.6 billion of debt financing and the site owners, Crusoe and Blue Owl Capital, put in around $5 billion in cash; the build is also how OpenAI reduces its dependence on Microsoft-hosted capacity.

Stargate UAE: a 5GW Abu Dhabi campus, then a $40B Oracle order for 400,000 Nvidia GB200s in Texas
image.cnbcfm.com

WHY IT MATTERS

Frontier inference is now underwritten by 15-year leases and $40 billion single-vendor chip orders, which is the strongest available signal that the closed-model price floor from the same week's Claude 4 launch will not collapse on its own — plan your model spend assuming incumbent pricing holds while open weights do the compressing. For systems work the relevant detail is geography: Gulf and Texas capacity lands in 2026 with specific jurisdictional terms, so data-residency routing across US, EU and Middle East regions should be designed against these contracts rather than against the next model release.

WED · May 21, 2025open weightsmistralcoding agentspricing

Mistral and All Hands AI ship Devstral: a 24B Apache-2.0 coding agent at $0.10 per million input tokens

Devstral arrived on May 21 under Apache 2.0, a 24B model fine-tuned from Mistral Small 3.1 with a 128k context window, built with All Hands AI to run inside agent scaffolds such as OpenHands and SWE-Agent. It scores 46.8% on SWE-bench Verified, more than six points above the previous open-weight state of the art, and under the same OpenHands harness it beats far larger checkpoints including DeepSeek-V3-0324 (671B) and Qwen3-235B-A22B. The weights fit a single RTX 4090 or a 32GB Mac; Mistral's hosted price is $0.10 per million input tokens and $0.30 per million output.

The timing is the story. Devstral landed one day before Anthropic's Claude Opus 4, priced at $15 input and $75 output per million tokens — roughly 150x Devstral's input rate for a model a solo developer can host, and permissively licensed enough to ship commercially. Mistral calls it a research preview and says a larger agentic coding model is coming.

WHY IT MATTERS

The mechanical layer of a coding agent — the model that reads the repo and proposes the patch — just collapsed toward zero marginal cost at a license you can build a product on. If your harness is model-agnostic, you can route routine multi-file edits to a self-hosted 24B checkpoint and reserve frontier tokens for the hard tail, which changes both your unit economics and what you are allowed to send off-premises for privacy-sensitive repos. Re-evaluate any build-versus-buy decision on agent inference made before this week.

TUE · May 20, 2025googleopen weightsvideosearch

Google I/O: Veo 3 generates synced audio, AI Mode ships to all US Search users, Mariner agents enter Labs — and Gemma 3n goes open-weight

At I/O on May 20 Google opened AI Mode to all US Search users with no Labs sign-up and pushed Gemini 2.5 into both AI Mode and AI Overviews, which Google says reach 1.5 billion monthly users across 200 countries. The keynote added Veo 3, a video model that generates synchronized audio, plus Imagen 4 and the Flow filmmaking tool, and said agentic capabilities from Project Mariner are coming to AI Mode in Labs for event tickets, restaurant reservations and local appointments.

Google also previewed Gemma 3n, an open multimodal model with raw parameter counts of 5B and 8B that uses Per-Layer Embeddings to run with a 2GB to 3GB memory footprint on phones and laptops, co-designed with Qualcomm, MediaTek and Samsung's System LSI. The same architecture will power the next generation of Gemini Nano, the on-device model inside Android and Chrome.

WHY IT MATTERS

Veo 3 removes the separate dubbing step from generated-video pipelines, and Mariner's arrival in Search is a land grab on the browser-action layer your own agent probably depends on. The architecturally load-bearing item is Gemma 3n: a 2-3GB open multimodal checkpoint means OCR, classification, routing and transcription can run on-device, taking them off your token bill and out of your data-residency problem — worth costing against an API call the next time you design an ingestion path.

MON · May 19, 2025mcpagentsmicrosoftsecurity

Build 2025: MCP moves into the Windows 11 shell, and Microsoft and GitHub take seats on the protocol's steering committee

Microsoft's Build keynote on May 19 made the Model Context Protocol the center of its agent story: an early preview of MCP support in Windows 11, a Windows MCP registry, and an updated MCP authorization specification contributed back to the ecosystem. Microsoft and GitHub joined MCP's steering committee, and Microsoft introduced NLWeb, an open project in which every endpoint is itself an MCP server, alongside multi-agent orchestration in Copilot Studio and Microsoft 365 Copilot Tuning.

The same post is a working threat taxonomy for agent harnesses, naming cross-prompt injection, tool poisoning, authentication gaps, credential leakage, command injection and registry supply-chain risk. Microsoft's own framing is blunt: for a chat app a prompt injection means a jailbreak or memory leakage, but with MCP the ceiling is full remote code execution. Windows 11 MCP support was announced as a preview, with the developer preview following in the coming months.

WHY IT MATTERS

This is the week agent tooling stopped being a side project: one tool-calling protocol now has a steering committee, an auth spec and an OS vendor mediating it in the shell. For anyone shipping an agent, that security list is the build checklist — scope each MCP server's credentials, sandbox the process, and treat tool descriptions and tool output as untrusted input, because the same protocol that lets you build once and integrate everywhere also lets one poisoned server reach the host. Design the tool layer as a boundary you can revoke and audit, not as a plugin you trust.

ARCHIVE

Go back in time

Every dispatch, newest first. Each week is written once and left as it was published.