AI news, Monday, April 13, 2026
TLDR
- Stanford AI Index 2026 drops today — China has erased the US lead; AI adoption faster than PC or internet; model transparency plummeting Trending
- Microsoft 365 E7 goes GA May 1 — $99/user/mo bundle with Copilot + Agent 365 for governing AI agents at scale Agents
- Semantic Kernel RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗: CVE-2026-26030 (CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 9.8) — vector store queries exploitable for remote code execution; patch to v1.39.4 Security
- Vibe coding CVEsCommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗ surging — 35 CVEs in March alone attributed to AI-generated code; 20% of AI code references nonexistent packages Security
- NVIDIA open-sources Newton 1.0 physics engine — GA during National Robotics Week alongside Isaac GR00T and Cosmos models Robotics/IoT
Action Items
Things your engineering team should look at or do this week.
- Patch Microsoft Semantic Kernel Python SDK to v1.39.4+ — CVE-2026-26030 (CVSS 9.8) allows RCE through InMemoryVectorStore filter expressions. If you use Semantic Kernel for RAGRetrieval-augmented generationFetching relevant documents at query time and giving them to the model, so its answer draws on them.Lewis et al. 2020 ↗, this is critical (NVD)
- Audit AI-generated code for slopsquatting — 20% of AI-generated code references nonexistent packages. Attackers are registering hallucinated package names as malicious. Check your dependency lists (CSA Labs)
- Migrate off Claude 3 Haiku before Apr 19 — 6 days left. Switch to
claude-haiku-4-5 - Review Microsoft 365 E7 if on E5+Copilot — GA May 1 at $99/user/mo saves ~$18/user vs buying separately. Includes Agent 365 for agent governance (Microsoft)
Models & Tools
- Qwen 3.6-Plus (Apr 2) Open Source — Alibaba's new flagship: 1M-token context, hybrid linear attention + sparse MoEMixture of expertsA model made of many sub-networks, called experts, where a learned router sends each input to only a few of them.Shazeer et al. 2017 ↗ architecture, agenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ coding competitive with Claude Opus 4.5. Available on Model Studio and Qwen Chat (Caixin)
- Microsoft 365 E7 + Agent 365 (GA May 1) Agents Customer AI — $99/user/mo bundle: E5 + Copilot + Entra Suite + Agent 365. Agent 365 ($15/user) is the control plane to observe, govern, manage, and secure AI agents across the enterprise (Microsoft)
- NVIDIA Newton 1.0, Isaac GR00T, Cosmos (Apr 7-12) Robotics/IoT Open Source — National Robotics Week releases: Newton 1.0 open-source physics engine (GA), Isaac GR00T models for robot natural-language instruction following, Cosmos world models for synthetic training data generation (NVIDIA Blog)
- Augment Code Intent (public beta) Agents — Standalone macOS workspace for multi-agent code orchestration. A coordinator breaks tasks into specs, delegates to parallel implementor agents, then a verifier checks results (Augment Code)
APIs & Pricing
- Anthropic Opus pricing dropped 67% — Context windowHow much text a model can see and use at once while writing a reply.Anthropic ↗ expanded to 1M tokensA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗. Industry-wide API costs down 40-70% across major providers (AI Empire Media)
- Claude 3 Haiku retires April 19 — 6 days.
claude-3-haiku-20240307stops working. Migrate toclaude-haiku-4-5(Anthropic)
Security
- Microsoft Semantic Kernel CVE-2026-26030 (CVSS 9.8) Data — RCE via InMemoryVectorStore filter expressions in Python SDK. Vector store queries — the backbone of RAG context retrieval — are exploitable. Patch: upgrade to python-1.39.4+ (Windows News)
- Vibe coding CVE surge (Apr 10) Trending — CSA/Georgia Tech tracked 35 CVEs in March 2026 directly attributed to AI coding tools (up from 6 in Jan). 45% of AI-generated code has OWASP Top 10 vulns. 20% references nonexistent packages → "slopsquatting" attacks (CSA Labs)
- CVE program under strain at RSAC 2026 — AI-driven code production causing 224% increase in GitHub vulnerability reports in 3 months. Board members warn funding and "human glue" holding the 26-year-old system together are both fragile (Cybersecurity Dive)
Industry & Business
- Stanford AI Index 2026 (today) Trending — Key findings: China has erased the US lead in model performance. AI adoption faster than PC or internet (53% population in 3 years). Foundation model transparency scores dropped from 58 to 40 — 80 of 95 top models launched without disclosing dataset sizes. US private AI investment: $285.9B vs China's $12.4B (Stanford HAI)
- PwC AI Performance Study (today) — 75% of AI's economic gains captured by top 20% of companies. Leaders are 2.6x more likely to use AI for business model reinvention, not just efficiency (PwC)
- Baidu launches Embodied Intelligence Data Supermarket (Apr 11) Robotics/IoT — Collaboration with Chinese robotics firms to standardize training data for humanoid and industrial robots (ChinaPulse)
- Plus One Robotics hits 2B picks (Apr 9) Robotics/IoT — Milestone for AI-powered warehouse automation fleet across global parcel induction and depalletization (RoboticsTomorrow)
AI in Production
- OpenAI hits $25B ARR, enterprise at 40% (Apr ~10) — OpenAI Frontier helping Oracle, State Farm, and Uber deploy agents company-wide. Consumer-enterprise parity expected by EOY (OpenAI)
Policy & Safety
- 600+ state AI bills in 2026 (Apr 13) — Nebraska passed Conversational AI Safety Act (minors); Maryland passed AI pricing bill; Maine prohibited unlicensed AI therapy. DOJ's AI Litigation Task Force challenging state laws on interstate commerce grounds (Troutman Privacy)