JadidJust-in AI Developments, Incidents & Deadlines
April 2026
SMTWTFS1234567891011121321415161718192021222324252627282930

AI news, Thursday, April 9, 2026

19 stories

TLDR

  • Meta Muse Spark launched (Apr 8) — first model under Alexandr Wang's Meta Superintelligence Labs, competitive but not SOTA, especially in coding
  • Anthropic Claude Managed Agents (Apr 8) — cloud-hosted agents with built-in sandboxing, memory, and permissions at $0.08/session hour, now in public beta
  • Meta + CoreWeave sign $21B expanded compute deal (Apr 9) — Meta's total CoreWeave commitment now $35B through 2032
  • GLM-5.1 hits #1 on SWE-BenchA benchmark that tests whether a model can resolve real GitHub issues by editing code in popular Python repositories.Jimenez et al. 2023 ↗ Pro (Apr 7) — open-source under MIT, 58.4% vs GPT-5.4's 57.7%; supports 8-hour autonomous task runs
  • Flowise CVE-2025-59528 (CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 10.0) actively exploited — 12K–15K instances still exposed; patch has existed since Sept 2025

Action Items

Things your engineering team should look at or do this week.

  • Patch Flowise immediately — CVE-2025-59528 (CVSS 10.0) is under active exploitation enabling RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗ on ~12K+ exposed instances; upgrade to v3.0.6+ now (BleepingComputer)
  • Patch PraisonAI if used — CVE-2026-39891 (CVSS 8.8), template injection allowing RCE, published Apr 8; upgrade to v4.5.115+ (TheHackerWire)
  • Migrate off Gemini 2.0 Flash / Flash-Lite before June 1 — both models are deprecated June 1; move to Gemini 2.5 Flash or Gemini 3.1 Flash-Lite (FindSkill.ai)
  • Have a Claude API fallback ready — Anthropic suffered back-to-back outages Apr 6–8 (10-hr cascading failure + repeat incidents); Claude-dependent workflows need a resilience plan (WebProNews)

Models & Tools

  • Meta Muse Spark (Apr 8) [Trending] — Meta's first major LLMLarge language modelA neural network trained on huge amounts of text that generates text, answers questions and summarizes.Anthropic ↗ under Alexandr Wang (chief AI officer at Meta Superintelligence Labs), trained over 9 months on a "ground-up overhaul." Accepts text, voice, and image inputs; text-only output. Closes the gap with OpenAI/Anthropic on multimodal understanding and health tasks, but Meta acknowledges a coding gap. Currently US-only; rolling out to WhatsApp, Instagram, Facebook, Messenger, and AI glasses. (TechCrunch | Meta Blog)

  • Anthropic Claude Managed Agents (Apr 8) [Agents] — Public beta service that abstracts agent infrastructure: sandboxed code execution, auth, checkpointing, scoped permissions, and persistent sessions. Define agents in natural language or YAML and run them on Anthropic's platform. Costs $0.08/session hour on top of standard API pricing. Access via managed-agents-2026-04-01 header; early adopters include Notion, Rakuten, and Asana. (SiliconAngle | The New Stack)

  • GLM-5.1 (Apr 7) [Open Source] [Trending] — Z.ai (Zhipu AI) shipped open-weightsA model whose trained weights are published for anyone to download and run.NTIA ↗ GLM-5.1 under MIT license; scores 58.4% on SWE-Bench Pro, beating GPT-5.4 (57.7%) and Claude Opus 4.6 (57.3%). Built on a 754B-parameter MoEMixture of expertsA model made of many sub-networks, called experts, where a learned router sends each input to only a few of them.Shazeer et al. 2017 ↗ architecture with 40B active params, 200K context windowHow much text a model can see and use at once while writing a reply.Anthropic ↗, and 131K max output. Headline feature: autonomous 8-hour task execution — demonstrated by building a complete Linux desktop environment from scratch. (VentureBeat | GitHub)

  • Google Gemma 4 (Apr 2) [Open Source] — Four-variant multimodal model family (E2B, E4B, 26B MoE, 31B Dense) released under Apache 2.0, handling text, image, and audio natively. Edge variants (E2B/E4B) run fully offline on consumer hardware. 256K context window; supports 140+ languages. Positioned as a capable on-device alternative to hosted APIs. (Google Blog | Dataconomy)

  • Google NotebookLM + Gemini Integration (Apr 9) [Trending] — NotebookLM is now directly accessible within Gemini, letting users manage notebooks, add past Gemini chats as sources, and keep multiple research projects organized across a unified interface. (9to5Mac)

  • NVIDIA National Robotics Week / Physical AI (Apr 7–11) [Robotics/IoT] — NVIDIA released new Cosmos and GR00T open models for robot learning and reasoning, plus Isaac Lab-Arena for robot evaluation and OSMO edge-to-cloud orchestration. Partners including Boston Dynamics, Caterpillar, Franka Robotics, and NEURA Robotics are debuting next-gen robots built on NVIDIA tech. Jensen Huang: "The ChatGPT moment for robotics is here." (NVIDIA Newsroom)

APIs & Pricing

  • Gemini 2.0 Flash / Flash-Lite: June 1 deprecation deadline (enforcement started Apr 1) — Google's April billing changes enforced mandatory spend caps and removed Pro model access for free-tier users. June 1 marks final deprecation of Gemini 2.0 Flash and Flash-Lite; migrate to Gemini 2.5 Flash or 3.1 Flash-Lite to avoid service disruption. (FindSkill.ai | LaoZhang Blog)

  • Broad LLM price war underway (Mar–Apr) — Starting in March, providers triggered a price compression wave; costs for comparable capability dropped 40–70% vs February. GPT-4.1 now at $2/$8 per 1M tokensA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗ vs GPT-4 at $30/$60. Good time to re-evaluate vendor spend. (PE Collective)

Security

  • Flowise CVE-2025-59528 — CVSS 10.0, actively exploited (Apr 2026) [Trending] — Critical RCE in Flowise's CustomMCP node: attacker sends a single crafted API request that executes arbitrary JavaScript via Node.js's Function() constructor with no auth required. First in-the-wild exploitation detected in April 2026; 12,000–15,000 instances still publicly exposed. Patch (v3.0.6) has been available since September 2025. If you run Flowise, treat this as urgent. (BleepingComputer | TheHackerNews)

  • PraisonAI CVE-2026-39891 — CVSS 8.8, template injection RCE (Apr 8) — create_agent_centric_tools() passes unescaped user input from agent.start() into a template renderer, allowing arbitrary template expression execution. Fixed in PraisonAI v4.5.115+. Two additional critical PraisonAI CVEsCommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗ also published this week (CVE-2026-39890 YAML deserializationAn app turning untrusted serialized data back into objects, which can let an attacker tamper with logic or run code.OWASP ↗ RCE; CVE-2026-39888 sandbox escapeBreaking out of a sandbox, the restricted environment that limits what untrusted code can reach.NIST ↗). (TheHackerWire | GitLab Advisory)

  • Prompt injectionInput crafted to change an LLM's behavior or output in ways its builders didn't intend.OWASP ↗ enters daily government AI use (Apr 9) — Help Net Security reports GenAI is now embedded in routine government workflows, raising indirect prompt injection risk: hidden malicious instructions in retrieved docs, emails, or web pages silently reroute AI actions. CIS identifies this as a top enterprise AI threat vector. (Help Net Security)

Industry & Business

  • Meta + CoreWeave expand deal to $21B (Apr 9) [Infra] — CoreWeave announced a new $21B agreement with Meta (2027–2032), adding to a prior $14.2B commitment, bringing the total to $35B. CoreWeave will provide compute from Rubin-equipped data centers. CoreWeave also raising $3B in fresh debt. Reduces Microsoft's share of CoreWeave revenue from 62% to under 35%. (Bloomberg | CoreWeave IR)

  • Amazon AWS AI revenue hits $15B run rate (Apr 9) [Infra] — AWS's AI revenue surpassed a $15B annual run rate in Q1 2026. The company's chips business (Graviton + Trainium) now runs at $20B/year, double the figure from earlier this year. Clearest hyperscaler signal yet that AI capex is converting to revenue. (CNBC)

  • Eclipse raises $1.3B for AI infra + robotics (Apr 7) — Cerebras backer Eclipse closed a $1.3B fund targeting physical AI infrastructure, manufacturing, and defense. Part of a broader Q1 2026 boom: $300B raised globally in the quarter (87%+ AI-related), the highest ever recorded by Crunchbase. (Bloomberg | Crunchbase)

  • ~80K tech jobs cut in Q1 2026; ~50% AI-attributed [Hiring] — TechRadar/Tom's Hardware report 78–80K tech layoffs in Q1, majority in the US. Oracle announced significant layoffs (est. up to 30K) in April. Paradox: 41% of US tech job ads now require AI skills (7× increase in 2 years), and AI/ML postings grew 163% YoY. Companies are cutting roles while simultaneously struggling to hire AI-skilled engineers. (TechRadar | Tom's Hardware)

AI in Production

  • Anthropic Claude: 3-day back-to-back outage cluster (Apr 6–8) [Trending] — Claude suffered a ~10-hour cascading failure on Apr 6 triggered by a load-balancing config update that created a GPUGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ request queue feedback loop. Repeat incidents on Apr 7 (3K+ Downdetector reports, peaked at 11:32am ET) and Apr 8 (intermittent login + voice/code-gen failures). Post-mortem published but lacked concrete remediation commitments. Takeaway: Claude Code and enterprise integrations are now at a scale where these incidents have real downstream impact — have a fallback LLM provider configured. (WebProNews | AI Daily)

Policy & Safety

  • Colorado AI Act effective June 30, 2026 — Colorado's law places affirmative obligations on AI developers and deployers to prevent algorithmic discrimination, including risk assessments and transparency disclosures. This is the most comprehensive US state AI law going live this year; legal teams should begin compliance review now. (Wilson Sonsini)

  • Trump EO 14365 framework targets state AI laws (Mar 20) — A seven-part implementation framework for Executive Order 14365 was published, recommending Congress preempt state AI regulations that impose "undue burdens." The DOJ's AI Litigation Task Force is actively challenging conflicting state laws. Creates a split-track regulatory environment: federal minimalism vs. state-level specificity. (Law and the Workplace)

Benchmarks & Evals

  • SWE-Bench Pro vs. Verified — contamination warning (Apr 2026) — The best Verified score is ~93.9% (Claude Mythos Preview per BenchLM.ai), but SWE-Bench Pro scores tell a very different story: top performers cluster at 57–58%, with GLM-5.1 narrowly leading at 58.4%. SWE-Bench Pro's 1,865 multi-language tasks are uncontaminated vs. Verified's 500 Python-only tasks. When evaluating models for real coding work, weight Pro scores heavily. (BenchLM.ai | Morph LLM)

Type to search · ↑↓ to move · enter to open