The AI Upload Weekly Digest

Salesforce has announced plans to acquire Fin, a customer service automation platform, for approximately $3.6 billion. The deal is expected to close in the fourth quarter of Salesforce's fiscal year 2027. Salesforce intends to integrate Fin's technology into its Agentforce suite of AI agent development services, with a focus on delivering pre-packaged customer service automation workflows.

Fin, originally founded in 2011 as Intercom Inc. and rebranded in March 2026, serves roughly 12,000 organizations including Anthropic and Autodesk, and reports resolving more than 2 million support incidents per week. The platform allows companies to train AI models on their own knowledge bases, build customizable automation workflows using natural language inputs, and track performance through a built-in analytics dashboard. Some features rely on Apex, a proprietary AI model Fin debuted in February.

For legal professionals tracking enterprise AI adoption, the acquisition signals continued consolidation in the AI-powered customer service space and raises questions about data governance, vendor lock-in, and how large platform integrations reshape enterprise AI contracting.

Leaked financial documents obtained by independent journalist Ed Zitron and reviewed by the Financial Times reveal that OpenAI's revenues, while growing rapidly, remain far outpaced by its expenditures. The company reported revenue of $3.7 billion in 2024 rising to $13.07 billion in 2025, with monthly revenues approaching $2 billion by year's end. Despite this growth, research and development expenses alone exceeded total revenues in both years, climbing from $7.81 billion in 2024 to $19.18 billion in 2025, including $10.59 billion paid to Microsoft.

The disclosures come as OpenAI files SEC paperwork ahead of an anticipated IPO, making the financial picture newly relevant to potential investors and legal observers tracking the company's corporate restructuring. For legal professionals and law students following AI industry developments, the scale of the losses and the concentration of costs within a single vendor relationship raise questions that are likely to feature prominently in the company's upcoming public filings.

SpaceX's valuation surged to as high as $2.9 trillion on Tuesday before settling back down, briefly surpassing Amazon to become the fifth-most valuable company in the world. The spike followed news that SpaceX is acquiring AI coding company Cursor for $60 billion in company shares, with the deal expected to close in the third quarter. The announcement, combined with the launch of options trading on SpaceX shares, drove intense market activity, with traders swapping more than 300 million shares in a single day.

The valuation jump is notable given SpaceX's financials: the company posted a $4.9 billion loss on $18.7 billion in revenue last year. Investor enthusiasm appears driven by SpaceX's stated ambitions in AI, supported by non-binding compute leasing deals with Anthropic and Google. The company raised nearly $86 billion in its IPO last Friday, debuting at roughly $1.7 trillion. With only about 4% of total shares available for public trading, analysts had anticipated significant price volatility, and Tuesday's trading confirmed those expectations.

A quiet but urgent conversation has taken hold in corporate boardrooms: how to manage the soaring cost of AI token usage. According to a WIRED review of transcripts from data provider AlphaStreet, roughly 300 companies raised questions or concerns about AI tokens during earnings calls in April or May 2026, compared to just 93 companies that mentioned the term during the same period a year ago. Royal Bank of Canada reported a 500 percent surge in token usage over six months; Cisco's CEO described internal usage as "pretty, pretty crazy"; and Box's CEO called token budgeting one of the most "heated" topics in the company.

Not all organizations are pulling back. Clothing brand Baseball Lifestyle 101 instructed about 50 senior managers to spend roughly 20 percent of their monthly salary on AI tokens, with costs expected to exceed $100,000 per month by year's end. Meanwhile, communications software company 8x8 reports it has saved approximately $5 million annually by canceling software subscriptions replaced by Anthropic's Claude, while keeping its Claude bill well below that figure. To manage rising costs, 8x8 is now weighing whether to require employees to justify use of pricier AI models before access is granted, reflecting a broader industry shift toward deliberate "tokenomics" strategies.

A Derbyshire police officer has been placed under criminal investigation for allegedly using artificial intelligence to fabricate evidential material across multiple cases, in what is believed to be the first such case in the United Kingdom. The officer has been removed from frontline duties pending the outcome of the investigation, though no arrests have been made. Derbyshire police confirmed they are working closely with the Crown Prosecution Service, which has begun engaging with defense teams and courts in potentially affected cases.

The incident raises serious concerns about AI integrity in criminal proceedings and follows a warning from the National Police Chiefs' Council's Police AI centre, which had previously instructed several forces to halt AI use in preparing court statements due to reliability concerns. For legal professionals, the case underscores the evidentiary and procedural risks that can arise when AI-generated content enters the justice system unchecked.

A German court has found Google directly liable for false statements made by its AI Overviews feature, granting a temporary injunction after two Munich-based publishers were wrongly linked to scams and dubious business practices. The Regional Court of Munich concluded that AI Overviews constitutes Google's own content rather than aggregated third-party material, because the tool generates "independent, new and substantive" statements that sometimes go beyond what any cited source actually says. The court rejected Google's safe harbour defenses under both German search engine precedent and the EU's Digital Services Act.

The ruling carries significant implications for AI liability broadly. Because Google alone controls the algorithms producing AI Overviews, the court held it bears full responsibility for the output. The court also dismissed Google's argument that users could simply verify the cited links themselves, noting that AI Overviews presents confident, self-contained answers that give readers little reason to cross-check sources. The decision suggests other large language model providers, including OpenAI and Anthropic, could face comparable exposure if their systems generate factually incorrect characterizations of third parties.

Microsoft is facing pressure on two fronts stemming from its AI ambitions. The City of St. Clair Shores Police and Fire Retirement System has filed a class action lawsuit in Seattle federal court against Microsoft and CEO Satya Nadella, alleging that executives made materially false and misleading statements about Copilot adoption. The complaint points to Microsoft's own earnings disclosures, which revealed that only 15 million of 450 million Microsoft 365 users had converted to paid Copilot subscriptions. Following Microsoft's fiscal Q2 results announcement on January 28, the company's share price dropped more than $48, or roughly ten percent. Microsoft has stated it believes the claims are without merit and intends to defend itself vigorously.

Separately, GitHub is reportedly exploring a multi-cloud strategy that may include AWS resources to address reliability and scalability problems driven by a surge in AI-assisted and agentic development workflows. GitHub acknowledged that infrastructure limits have been tested, and confirmed it is both accelerating migration to Azure and evaluating additional cloud providers. The situation is notable given that Microsoft, GitHub's parent company since 2018, operates its own competing cloud platform.

The music industry convened in New York this week for Indie Week amid four overlapping disputes that could reshape how recorded music generates revenue. The National Music Publishers' Association announced its first industry-wide AI licensing deals with Udio and Klay, while Spotify unveiled a partnership with Universal Music Group allowing Premium subscribers to remix and cover songs using AI, with a revenue-sharing model for participating artists. Payment mechanics for songwriters under these deals have not been disclosed.

Streaming fraud has moved from concern to criminal prosecution. Michael Smith of North Carolina pleaded guilty to wire fraud after using AI to generate hundreds of thousands of songs and bots to stream them billions of times, collecting more than $8 million in royalties from major platforms before being caught. Apple Music reportedly flagged roughly two billion fraudulent streams on its platform in 2025 alone.

Publishers are also pushing back against performing rights organizations over transparency and governance, with Kobalt CEO Laurent Hubert stating that 30 percent of the company's PRO-related income cannot be audited. Separately, negotiations over statutory mechanical royalty rates beyond the current 2027 deadline have yet to produce any publicly disclosed agreement between the NMPA and the Digital Media Association.

Qualcomm is making a significant push into post-smartphone computing, announcing two new offerings aimed at AI wearables and mixed-reality devices. The first, Snapdragon Reality Elite, is a chip platform for mixed-reality glasses delivering up to 160% improvement in neural processing unit performance over its predecessor and capable of running a 3-billion-parameter language model at 45 tokens per second. The second, the Scalable Turnkey AI-Ready Toolkit (START), bundles hardware modules, a software stack, and a white-label program to help manufacturers bring smart glasses and other wearable form factors to market more quickly.

CEO Cristiano Amon told CNBC that Qualcomm is currently working with partners on over 40 AI wearable device designs spanning earbuds, pins, jewelry, and watches, reflecting a broad bet that the next major computing platform will be something worn rather than carried. Eyewear manufacturers Inspecs and O'Neill are among the first partners in the START white-label program, while XREAL and Play for Dream are early adopters of the Snapdragon Reality Elite platform. Legal professionals tracking AI hardware development and its implications for data collection, agent-based computing, and competition with established players like Apple and Samsung will want to follow this space closely.

Apple debuted a revamped Siri alongside iOS and macOS 27 at WWDC last week, positioning it as a major leap in on-device AI. After testing developer betas released June 8, one writer found the update introduced genuine improvements, including conversational follow-up capability and improved on-device file search, but at a notable cost to existing functionality.

The most significant complaint centers on Spotlight, Apple's built-in search and app launcher. What was previously a swipe-and-tap web search now requires multiple additional steps, as the new Siri-first interface intercepts queries and surfaces AI-selected links before allowing access to traditional search results. The experience is compared to Google's AI Overviews. The personnel connection is direct: Apple's new VP of AI, Amar Subramanya, spent 16 years at Google including a role leading Gemini engineering, and Apple has confirmed a partnership with Google in building its foundation models.

Apple has not confirmed whether the Spotlight changes are intentional. The software remains in developer beta, with public release expected this fall.

Researchers at Varonis Threat Labs disclosed a critical vulnerability in Microsoft 365 Copilot Enterprise Search that could have allowed an attacker to steal emails, calendar data, SharePoint files, and live MFA codes with a single click on a legitimate microsoft.com link. Tracked as CVE-2026-42824, the flaw chains three bugs into what Varonis calls SearchLeak: a parameter-to-prompt injection, a sanitizer race condition that fires a malicious image request before guardrails can block it, and a Content Security Policy bypass that routes stolen data out through Bing's own infrastructure. Because the attack link pointed to a real Microsoft domain, standard URL filtering and anti-phishing tools would not have flagged it.

Microsoft mitigated the vulnerability on its backend, requiring no action from tenant administrators. Varonis presented a proof-of-concept and has not observed active exploitation in the wild. Because Copilot Enterprise inherits the signed-in user's full Microsoft Graph access, the potential exposure included time-sensitive one-time passwords and account-reset links still valid at the moment of the click. Legal professionals handling sensitive client communications, financial data, or confidential filings stored in Microsoft 365 environments should take note, as this is the second time Varonis has demonstrated this attack pattern against Copilot products.

Google filed suit in Manhattan federal court against a Chinese cybercrime network accused of weaponizing its Gemini AI to conduct large-scale SMS phishing attacks against Americans. The network operates a phishing-as-a-service platform called Outsider, which allowed criminals to generate fraudulent websites using AI-generated code and blast fake text messages impersonating banks, brokerages, and mobile carriers. Licenses were available for as little as $88 per week through a Telegram bot.

The FBI estimates Outsider is linked to approximately 3.87 million stolen credit cards and $1.9 billion in losses since July 2023. Between November 2025 and April 2026, investigators identified over 9,000 fake websites and 1.59 million fraudulent URLs connected to the service. As part of a coordinated takedown called Operation Ghost Hook, law enforcement seized domains, confiscated roughly $100,000 in cryptocurrency, and disrupted thousands of phishing domains.

Google is partnering with AT&T, T-Mobile, and Verizon to block Outsider messages from reaching users. The FBI noted that criminals are increasingly using AI to make fraud more convincing and harder to detect, a concern that will resonate with legal professionals navigating emerging liability questions around AI misuse.

OpenAI has banned a set of China-linked accounts that used ChatGPT to generate social media content targeting U.S. policy debates over tariffs and AI data centers. The company identified two distinct operations: one called "Data Center Bandwagon," which produced comments and comics portraying data centers as driving up electricity costs for American families, and another called "Tech and Tariffs," which generated political cartoons critical of Trump's trade policies and U.S. ambitions for global tech dominance.

OpenAI's principal investigator Ben Nimmo emphasized that these campaigns did not manufacture controversy but rather sought to amplify divisions that already existed in American public discourse. The company acknowledged that neither campaign gained significant online traction. Still, OpenAI flagged this as the first known instance of a China-linked operation using its models to interfere specifically in the AI data center debate.

For legal professionals and researchers tracking AI governance and disinformation, the episode raises concrete questions about platform liability, foreign interference, and how AI-generated content may increasingly be weaponized around domestic policy flashpoints.

On June 12, 2026, U.S. Commerce Secretary Howard Lutnick signed an export control order blocking all non-American nationals from accessing two Anthropic models: Claude Fable 5, which had launched three days earlier, and Claude Mythos 5, a restricted model with cybersecurity capabilities that had drawn government scrutiny. The stated trigger was a researcher-identified method to bypass Mythos 5's safety guardrails, which were designed to prevent attacks on banks, critical infrastructure, and government systems. Anthropic complied within hours. Users outside the United States, including across India, lost access immediately.

Writing in the Times of India, IIT Kharagpur alumni member Pravin Kaushal argues the shutdown is less notable for its drama than for its ordinariness. No diplomatic incident accompanied it. A letter was signed, a company complied, and professional workflows were disrupted worldwide. Kaushal notes that Google's Gemini, OpenAI's GPT models, Meta's open source offerings, and Microsoft's Copilot all rest on American corporate and legal infrastructure, making them subject in principle to the same export control architecture. For legal professionals and institutions that have integrated these tools into daily practice, the episode raises concrete questions about continuity of access and the risks of dependence on foreign AI infrastructure.

AI-generated deepfakes have moved from novelty to standard practice in American political advertising, with candidates and outside groups across the country using fabricated imagery to attack opponents. Recent examples include a Trump-aligned group depicting Texas Democratic Senate nominee James Talarico in a dress singing altered lyrics, a "throuple" ad falsely showing Rep. Thomas Massie dining with Reps. Ilhan Omar and Alexandria Ocasio-Cortez, and a fully AI-generated Georgia gubernatorial ad showing a Republican primary opponent inflating a hot air balloon with his breath. The practice spans both parties and multiple states, including Texas, Kentucky, Georgia, New York, and Maryland.

Currently, no federal law requires campaigns to disclose when AI is used in political advertising, and voluntary disclosure remains inconsistent. Democrats have indicated they would pursue mandatory disclosure requirements if they regain congressional control after November. For legal professionals and election law scholars, the rapid normalization of fabricated political content raises pressing questions about disclosure standards, defamation exposure, and the adequacy of existing campaign finance and advertising regulations to address synthetic media.

The Trump administration's decision to restrict Anthropic's most advanced AI models under export controls was triggered not by a sophisticated jailbreak, but by the three-word prompt "fix this code," according to Katie Moussouris, founder of Luta Security and the only outside expert who reviewed the third-party research underlying the ban. The government's directive, citing national security concerns, suspended foreign national access to Anthropic's Fable 5 and Mythos 5 models, prompting Anthropic to disable both for all customers. Moussouris, who helped negotiate the Wassenaar Arrangement's cybersecurity exemptions, argues that no guardrail was bypassed and that the models were performing standard defensive security work.

More than 100 cybersecurity leaders have signed an open letter urging the administration to reverse the restrictions. Moussouris contends the ban harms defenders far more than attackers, since advanced AI models from China and other countries will soon reach comparable capabilities regardless, and open-weight systems fall outside US export control reach entirely. Legal and security professionals tracking AI governance and export compliance will want to read her full analysis.

Pokémon Go players who opted in to scan real-world locations between 2021 and 2025 may not have anticipated their contributions ending up in military technology. Niantic Spatial, a spin-off from the company that created the augmented reality game, used those voluntary location scans to train AI models capable of recognizing and interpreting physical spaces. The company has since partnered with Vantor, a spatial detection software firm whose drone navigation tools are used by some militaries, to help autonomous systems orient themselves in environments where GPS signals are unavailable, jammed, or spoofed.

Both companies say the raw game scans were not directly transferred to Vantor, but that they informed Niantic's underlying AI models. Vantor announced a separate deal with the US Army worth up to $217 million in February. Privacy advocates and researchers are raising alarms: Digital Rights Watch's Tom Sulston called the use of civilian data for military ends troubling, noting that most users do not read terms of service documents. A University of Sydney researcher warned the case is likely just the beginning of a broader pattern of consumer app data finding its way into unintended applications.

Amazon announced it has reached 75% of its 2030 goal to replenish more water into communities than its data centers consume, and claims its facilities are seven times more water-efficient than the industry average. The disclosure follows a similar water-focused announcement from Google the prior week, signaling a coordinated effort by major tech companies to respond to growing public backlash over the environmental footprint of AI infrastructure. Notably, Amazon's "industry average" benchmark is derived from an academic study converted using a Department of Energy methodology, rather than a directly reported industry figure.

The pushback is substantial. According to Gallup polling released in May, roughly 70% of Americans oppose data center construction in their communities, with water use for cooling cited as the top concern. Amazon's chief sustainability officer acknowledged the company is planning continued growth while arguing that efficiency gains and transparency can address community concerns. Whether per-unit efficiency improvements will offset rising total water consumption as AI demand surges remains an open question that industry observers are watching closely.