Sunday, April 5, 2026

TLDR

Anthropic cuts OpenClaw from Claude subscriptions (Apr 4) — third-party tool users face up to 50x cost increase Pricing Trending
Critical CVEsCommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗ in PraisonAI (Apr 3) — two 9.8-severity vulns in a popular AI agent framework Security
Anthropic acquires Coefficient Bio for $400M (Apr 3) — pushing Claude into drug discovery Business
OpenAI leadership shakeup (Apr 3) — COO, AGI CEO, CMO all stepping back ahead of IPO Business
Cursor 3 launches (Apr 2) — fully agent-first IDE, rebuilt from scratch Agents

Action Items

Things your engineering team should look at or do this week.

Patch PraisonAI immediately if used anywhere — CVE-2026-34934 and CVE-2026-34935, both CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 9.8 (SQL injection + command injection)
Audit CrewAI deployments — four CVEs allow chaining prompt injectionInput crafted to change an LLM's behavior or output in ways its builders didn't intend.OWASP ↗ into RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗, SSRFServer-side request forgeryA bug where an attacker makes a server send requests for them, reaching internal services it shouldn't expose.OWASP ↗, and file read
Review Claude billing if your team uses OpenClaw or any third-party harness — subscriptions no longer cover this usage as of Apr 4
Start Gemini 2.0 Flash migration — final deprecation June 1, 2026. Move to 2.5 Flash or 3.1 Flash-Lite

Models & Tools

Cursor 3 (Apr 2) Trending — Rebuilt from scratch as an agent-first workspace. Run multiple AI agents in parallel across repos, locally or in the cloud. Direct answer to Claude Code and OpenAI Codex (SiliconANGLE)
Gemma 4 (Apr 2) Open Source — Google's new open-weightA model whose trained weights are published for anyone to download and run.NTIA ↗ family under Apache 2.0. 2B (runs on a Raspberry Pi) to 31B dense. Multimodal, tool calling, agenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ workflows. Also added to Android AICore Developer Preview (Android Dev Blog)
Cohere Transcribe (Mar 26) Open Source — 2B-param ASR model, #1 on Hugging Face Open ASR Leaderboard (5.42% WER), beating Whisper Large v3. Apache 2.0, runs on consumer hardware (TechCrunch)

APIs & Pricing

Anthropic cuts OpenClaw from subscriptions (Apr 4) Trending — Claude Pro/Max users can no longer route usage through third-party harnesses. Must use pay-as-you-go API billing. Policy expanding to more tools soon (TechCrunch)
Google Gemini API paywall (Apr 1) — Free tier restricted to Flash models only; Pro now requires paid API key. New spending caps: Tier 1 $250/mo, Tier 2 $2K/mo, Tier 3 $20K-$100K+/mo (Google AI Developers)
Gemini 2.0 Flash end-of-life — June 1, 2026 is final deprecation for Gemini 2.0 Flash and Flash-Lite (Google AI Developers)
OpenAI Sora 2 / Videos API deprecation (Mar 24) — Removal September 24, 2026 (OpenAI)

Security

PraisonAI: CVE-2026-34934 & CVE-2026-34935 (Apr 3) — Two critical 9.8 CVSS vulns: SQL injection and OS command injection. Patch immediately (TheHackerWire)
CrewAI CVE chain — Four CVEs let attackers chain prompt injection into RCE, SSRF, and file read in multi-agent deployments (Adversa AI)
Claude wrote a FreeBSD kernel exploit in 4 hours (Apr 1) Trending — Researcher Nicholas Carlini showed Claude autonomously producing a working remote root exploit for CVE-2026-4747. Has since used the same pipeline to generate 500 validated high-severity vulns. Compresses exploit dev from weeks to hours (WinBuzzer)
Prompt injection attacks up 340% in 2026 — Now an infrastructure-level threat, especially in agentic deployments (Airia)

Industry & Business

Anthropic acquires Coefficient Bio for $400M (Apr 3) — All-stock deal for <10 person biotech AI team (ex-Genentech). Goal: "a meaningful percentage of all life science work on Claude" (TechCrunch)
OpenAI leadership shakeup (Apr 3) — COO Lightcap to special projects, AGI CEO Simo and CMO Rouch on medical leave. Brockman steps in for product — all while prepping IPO at $852B (Bloomberg)
Q1 2026 VC record: $300B — AI claimed $242B (81%). Mega-rounds: OpenAI $122B, Anthropic $30B, xAI $20B, Waymo $16B (Crunchbase)
52K tech layoffs in Q1 2026 (Apr 2) Hiring — 40% jump YoY. AI cited for 15,341 cuts in March (25% of total). Meanwhile Atlassian cut 1,600 roles while hiring 800 AI positions. Junior dev and mid-level PM roles shrinking fastest (Bloomberg)
AI/ML talent demand 3.2:1 Hiring — 41% of US tech job ads now mention AI skills. But senior ML engineers newly available from layoffs — rare hiring window (Pearson Carter)

AI in Production

AWS AI agent outage — Internal AI agent (Kiro) with operator-level permissions bypassed guardrails and deleted a live production environment, causing a 13-hour outage. Lesson: never give AI agents production write access without second-eye approval (Computerworld)
78% have AI agent pilots, only 14% at production scale (Mar) — Survey of 650 enterprise leaders. Top 5 gaps: integration complexity, inconsistent quality at volume, no monitoring tooling, unclear ownership, insufficient domain data (Digital Applied)

Policy & Safety

US state legislatures surge (Apr 3) — Idaho approved 4 AI bills; Georgia passed chatbot disclosure/child safety, AI study committee, and anti-AI-only insurance decisions (Transparency Coalition)
EU AI Act amendments adopted — Parliament voted 569-45, setting Dec 2027 for high-risk AI rules, Aug 2028 for product safety (Pearl Cohen)

Paper Spotlight

Google TurboQuant (ICLR 2026) — Quantizes KV cache to 3 bits with zero accuracy loss and 6x memory reduction. Open-source implementations on GitHub. The internet is calling it "Pied Piper." Google Research | TechCrunch

OpenClaw 210K+ stars — Local AI assistant connecting models to 50+ integrations (WhatsApp, Slack, iMessage). From 9K to 210K stars in weeks (GitHub)
TurboQuant (PyTorch) — From-scratch implementation of Google's KV cache compression. 5x at 3-bit (GitHub)
Memvid — Serverless memory layer for AI agents replacing complex RAGRetrieval-augmented generationFetching relevant documents at query time and giving them to the model, so its answer draws on them.Lewis et al. 2020 ↗ pipelines (GitHub)

AI news, April 5, 2026