🎯 Top 3 Things to Know
1. ByteDance is weighing AI capital spending of up to $70 billion in 2026, more than double last year's $25 billion. Bloomberg reported the figure on May 27 and several Asia-Pacific outlets corroborated it over the weekend. Roughly $14 billion is earmarked for NVIDIA chips, with a separate ASIC deal taking shape with Qualcomm. The friction is concrete: serving long-running agentic workloads across TikTok, Doubao, and the internal coding stack has outrun rented capacity, and the unit economics of background agents do not tolerate spot. Worth watching whether the spend lands at the high end of the range (still under quarterly review), whether Alibaba and Tencent revise their own numbers upward in response, and how aggressively the Qualcomm ASIC track compresses ByteDance's Nvidia dependency. Bloomberg
2. Google's Gemini Spark went live for US Google AI Ultra subscribers on May 29, the first major lab's "personal agent" to leave preview. Spark runs on dedicated cloud VMs, sits on Gemini 3.5 Flash and the Antigravity 2.0 harness, and operates on schedules and triggers rather than prompts. It drafts mail, monitors the inbox, tracks deadlines, and acts across Gmail, Calendar, Docs, Chrome, and third-party apps via MCP. Google's structural advantage is the email and calendar context it already holds, which is the missing layer every prior personal-agent attempt stumbled on. The number to watch is week-four retention against the recently reduced $100-per-month Ultra tier, and how often Spark gets paused after executing the wrong action while the user is away. 9to5Google
3. A new paper argues that prompt injection in agents is not a defense problem to patch, but an impossibility result. "AI Agents May Always Fall for Prompt Injections," by Abdelnabi and Bagdasarian (UMass CICS), reframes injection through Contextual Integrity, a privacy theory of information flow. For any norm a defender chooses, an attacker can construct a plausible context under which a blocked flow looks legitimate, and any defender who tightens norms enough to stop it will also block flows the task itself requires. Data-instruction separation, the current default, is therefore a partial mitigation rather than a fix. Worth stress-testing existing agents against attacks framed inside their own task context, and tracking how defenses evolve toward graceful failure rather than perfect blocking. arXiv
🚀 Frontier Models & Features
- Quiet weekend on net-new model launches. Gemini 3.5 Pro remains slated for June per Google's I/O roadmap. Anthropic's Dynamic Workflows in Claude Code research preview is rolling to Enterprise, Team, and Max plans this week. Anthropic
🔬 Research Worth Reading
AI Agents May Always Fall for Prompt Injections (Abdelnabi, Bagdasarian / UMass CICS). arXiv
- TL;DR: Recast prompt injection as a Contextual Integrity violation. The question is not whether instructions and data can be cleanly separated (they cannot) but whether a given information flow conforms to the contextual norms of the task.
- Stat: The paper derives an informal impossibility result: for any norm a defender picks, there exists an attacker context under which a blocked flow appears legitimate, or the norm blocks a flow the legitimate task requires.
- Apply it: When red-teaming an agent's injection resistance, generate attacks framed in the agent's own task context, not synthetic "ignore previous instructions" strings, and stop treating data-instruction separation as a final defense.
Predictive Maps of Multi-Agent Reasoning: A Successor-Representation Spectrum for LLM Communication Topologies (Parks, Alharthi / University of Arizona). arXiv
- TL;DR: Borrow the successor representation from reinforcement learning to score the communication graph between agents (chain, star, mesh) before running anything, mapping specific spectral properties to specific failure modes.
- Stat: The diagnostic predicts consensus collapse, information bottlenecks, and redundancy failures from the topology alone, without executing the full agent loop.
- Apply it: Before adding agents to a multi-agent stack, compute the topology spectrum and choose the graph shape based on the failure mode you can least afford, rather than defaulting to a star or a chain by habit.
🏢 Enterprise in the Wild
- Salesforce Agentforce Operations integration with Salesforce Flows entered beta this month, with PwC publicly committed to deploying it across contact-center, onboarding, and compliance work. Salesforce's claimed envelope is a 50–70% cut in process cycle times and an 80% drop in manual data entry. Independent before-after numbers from PwC-led deployments have not yet been published. Salesforce
- Gemini Spark rolling out to US Ultra subscribers seeds the first sizeable cohort of Google-account holders running 24/7 background agents over their own mail and calendar. Adoption signal: whether subscribers leave Spark on by week four or quietly disable it.
🛠️ Tooling & Ecosystem
- Anthropic's self-hosted sandboxes for Claude Managed Agents, announced at Code with Claude London on May 19–20, are now in public beta. Tool execution runs on infrastructure the customer configures (Cloudflare, Daytona, Modal, or Vercel) while the orchestration loop stays at Anthropic. The split changes where data-residency and egress controls live in production agent deployments. InfoQ
- MCP spec 2025-11-25 (the authorization-mandatory release) is being rolled into SDK updates by major maintainers. OAuth 2.1 with PKCE S256, RFC 9728 Protected Resource Metadata, and RFC 8707 Resource Indicators are now required at the protocol level.
⚖️ Policy & Regulation
- The US and China announced on May 14 in Beijing that they will jointly establish an AI safety protocol focused on keeping frontier models out of non-state-actor hands, per Treasury Secretary Bessent. No published text yet. The structure resembles export-control frameworks more than a behavioral standard. CNBC
- China's TC260 published "Ethics-Safety Guidelines for AI Applications 1.0," and CAC, NDRC, and MIIT released agent implementation rules in May. Agents are defined as systems with autonomous perception, memory, decision, and execution, and require pre-launch safety assessments plus continuous human oversight in high-risk scenarios. IAPP
📌 Watch List
- Personal AI agents in the wild: Spark vs. Claude Managed Agents vs. ChatGPT Pro tasks
- Contextual integrity as the frame for prompt injection defenses
- ByteDance's $70B range and whether Alibaba and Tencent revise capex upward
- China's agent-specific oversight rules vs. the EU AI Act's GPAI obligations
- Week-four retention curves for always-on consumer agents