Alibaba Ships End-to-End AI Shopping, OpenAI Lands in Your Spreadsheets, and the Week Agents Got Real Jobs

Alibaba just turned 4 billion products into an AI shopping channel

Alibaba integrated its Qwen AI app with Taobao and Tmall this week, giving the model access to over 4 billion items and Alipay-native checkout. According to a Reuters report, this is the largest agentic commerce deployment yet from a Chinese platform.

The Qwen app can now browse inventory, compare options, and complete purchases—end to end—inside the chat interface. It is not a product-recommendation widget bolted onto search. It is a shopping agent that reads your intent, scans the catalog, and hands you a checkout link.

Agentic commerce has been mostly theory and pilot programs until now. Alibaba just made it operational at platform scale. The bet is that enough shoppers will trust an AI to pick a rice cooker or a sweater without clicking through ten comparison tabs. If that works, every e-commerce site will copy it by July.

OpenAI ships a spreadsheet sidebar that actually understands your formulas

ChatGPT for Excel and Google Sheets launched this week for Business, Enterprise, Edu, and K-12 accounts, plus all consumer tiers (Free, Go, Pro, Plus). It runs in a sidebar inside your spreadsheet—no copy-paste, no separate window—and can read, build, and explain multi-tab files with formulas, cell references, and embedded assumptions.

The interface speaks spreadsheet natively. You can ask it to rewrite a pivot table, trace a circular reference, or explain why column D is returning #VALUE! errors. It does not hallucinate cell addresses the way a generic LLM does when you paste a formula into a chat box.

OpenAI is positioning this as a copilot for analysts, finance teams, and anyone who lives in Excel but does not want to learn Power Query. The feature went live globally on May 10. If your org has a Business or Enterprise plan, it is already in the sidebar menu.

Six AI coding agents got hacked in one security sweep

OX Security found arbitrary command execution vulnerabilities in six live AI coding platforms this week and estimates that 200,000 MCP servers are currently exposed. MCP (Model Context Protocol) is the communication layer that lets AI agents interact with external tools, APIs, and filesystems. If it is misconfigured, an attacker can inject commands and run them with the agent's privileges.

The six platforms were not named in the brief, but OX confirmed exploits on production instances. Guardrail Technologies separately launched a product called Traffic Light for Code & AI™ to audit and verify AI-generated code and the humans writing the prompts that produce it. The pitch is that you need to secure both the output and the input when an agent has shell access.

This is the infrastructure tax of agentic workflows. Once your AI can git push, npm install, and curl arbitrary endpoints, every misconfigured server becomes a remote execution playground. The tooling to lock that down is still catching up.

Someone ported a 2-bit DeepSeek model to a single DGX Spark box

A developer posted a one-shot installer for DeepSeek-V4-Flash running on a single NVIDIA DGX Spark via vLLM. The model uses a 2-bit hybrid quantization recipe originally designed for Apple MLX on 128 GB unified memory, now adapted for CUDA.

The install script pulls the checkpoint from Hugging Face and spins up an OpenAI-compatible API endpoint at localhost:8000. You curl it like any other completions API. The entire setup fits in one GPU box and produces coherent multi-token output.

This matters because DeepSeek-V4 is a 671-billion-parameter mixture-of-experts model. Fitting it on a single node at reasonable speed used to require multi-GPU orchestration or exotic memory tricks. Now you can run it locally with a bash one-liner. The MLX→CUDA port shows how quickly quantization techniques cross ecosystems once someone decides it is worth the effort.

Spotify's AI DJ now speaks four more languages

Spotify expanded its AI DJ feature to French, German, Italian, and Brazilian Portuguese this week. The DJ was already live in English; now it can narrate playlists and explain song picks in four additional languages with localized voice, pacing, and cultural references.

The feature uses a generative voice model trained on radio DJ cadence. It does not just translate text-to-speech. It tries to sound like a human picking the next track and explaining why you might like it. Expanding to Romance languages and Brazilian Portuguese brings the feature to several hundred million more Spotify users.

AI DJ is one of the few generative audio features that shipped, stuck, and actually got localized. Most voice projects stay in English pilot mode forever. Spotify is treating this like a real product.