Daily Tech Trends Digest

White House pulls AI model-sharing executive order at the last minute (May 21): Hours before a scheduled signing ceremony, President Trump postponed an order that would have required frontier AI labs to submit advanced models for up to 90 days of federal security review before public release, following last-minute pressure from Elon Musk, Mark Zuckerberg, and former AI/crypto czar David Sacks. The retreat is the clearest signal yet that the administration is choosing AI development speed over oversight, leaving the US without any formal pre-release AI oversight framework even as the EU AI Act's high-risk provisions enter their first year of enforcement. ^[1][2]

Spotify and Universal Music Group announce the first large-scale licensed AI music framework (May 21): A landmark consent-credit-compensation deal lets Spotify Premium subscribers generate licensed AI covers and remixes of UMG artists and songwriters who opt in, with revenue shared across all parties. No pricing or launch date was disclosed, but both companies described the agreement as a turning point in how the music industry engages with generative AI — the first major structured AI licensing deal at this catalogue scale. ^[3][4]

TanStack npm supply-chain attack breaches 3,800 GitHub internal repositories (active since May 11, confirmed May 21–22): Attackers (attributed to the TeamPCP threat group) published 84 malicious @tanstack/* npm packages via GitHub Actions cache poisoning on May 11, leading to a poisoned Nx Console VSCode extension (18.95.0) with 2.2 million installs; at least one GitHub engineer ran the extension, leaking credentials that gave attackers access to 3,800 internal GitHub repos. Grafana Labs was also affected. It is one of the largest developer-toolchain breaches on record, and arrives three days after Socket (which blocks this exact attack class) reached a $1B valuation. ^[5][6][7]

Google AI search breaks on the word "disregard" (May 22): Google's new AI-powered search returns "Understood. I have disregarded your previous prompt. How can I help you today?" when users search the standalone word "disregard" — the system misinterpreting a dictionary query as a prompt injection attack. The bug also affects "ignore" and "dismiss." Google acknowledged it and is working on a fix. The incident highlights a new class of production failures where AI safety training collides with legitimate user queries. ^[8][9]

Anthropic in late talks for $30B raise at ~$900B valuation — expected to close by end of May (Bloomberg, May 12 — still open as of today): First reported 11 days ago but still unconfirmed closed, the round would be the largest private-company financing in history and would value Anthropic above roughly 95% of S&P 500 constituents by market cap. Google has committed up to $40B and Amazon up to $25B in separate prior arrangements; a $900B close would represent approximately 2.6× those terms. ^[10][11]