JadidJust-in AI Developments, Incidents & Deadlines
April 2026
SMTWTFS1234567891011121321415161718192021222324252627282930

AI news, Monday, April 13, 2026

24 stories

TLDR

  • Flowise RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗ under active exploitation (Apr 7) — CVE-2025-59528 (CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 10.0) hitting 12,000+ exposed instances; patch to v3.1.1 now
  • GLM-5.1 tops SWE-BenchA benchmark that tests whether a model can resolve real GitHub issues by editing code in popular Python repositories.Jimenez et al. 2023 ↗ Pro as open-source (Apr 7) — Z.ai's MIT-licensed model scores 58.4, beating GPT-5.4 and Claude Opus 4.6
  • Claude 3 Haiku retires April 19 — migrate to Haiku 4.5 before the cutoff or API calls will break
  • Meta debuts Muse Spark, plans open-source Avocado & Mango models (Apr 6–8) — first models under Alexandr Wang; open-source versions coming
  • Q1 2026 venture funding hit $300B — AI accounted for $242B (80%), with OpenAI's $122B round the largest ever

Action Items

  • Patch Flowise immediately if used — CVE-2025-59528 (CVSS 10.0, active exploitation). Upgrade to v3.1.1+ (BleepingComputer)
  • Migrate off Claude 3 Haiku before April 19 — claude-3-haiku-20240307 and claude-3-haiku prefix calls will stop working. Switch to claude-haiku-4-5 (Anthropic Docs)
  • Plan Gemini 2.0 Flash migration before June 1 — Gemini 2.0 Flash and Flash-Lite hit final deprecation. Move to Gemini 2.5 Flash or 3.1 Flash-Lite (Google AI Blog)
  • Evaluate GLM-5.1 for coding workloads — MIT-licensed, tops SWE-Bench Pro at 58.4, self-hostable (HuggingFace)

Models & Tools

  • GLM-5.1 (Apr 7) Open Source — Z.ai's 744B MoEMixture of expertsA model made of many sub-networks, called experts, where a learned router sends each input to only a few of them.Shazeer et al. 2017 ↗ model (40B active params) scores 58.4 on SWE-Bench Pro, first open-source model to top all closed-source competitors. MIT license, 200K context, can run autonomous coding loops for up to 8 hours. (TechBriefly)

  • Meta Muse Spark (Apr 8) — First model under new AI lead Alexandr Wang. Meta says it "significantly narrows the performance gap" with frontier models from OpenAI and Anthropic. Open-source versions of upcoming Avocado (LLMLarge language modelA neural network trained on huge amounts of text that generates text, answers questions and summarizes.Anthropic ↗) and Mango (multimedia) models planned. (Axios)

  • Google Gemma 4 (Apr 2) Open Source — Family of on-device multimodal models (text, image, audio) under Apache 2.0. Four sizes from E2B to 31B Dense. New AICore Developer Preview on Android and Python CLI for local experimentation. (Google Blog)

  • Augment Code Intent (public beta) Agents — Standalone macOS workspace for multi-agent code orchestration. A coordinator agent breaks tasks into living specs, delegates to parallel implementor agents, then a verifier checks results. Windows waitlisted. (Augment Code)

  • NVIDIA Isaac GR00T & Cosmos (Apr week) Robotics/IoT — New open models for robot natural-language instruction following and synthetic data generation for training at scale. (NVIDIA Blog)

APIs & Pricing

  • Anthropic: Claude 3 Haiku retirement (Apr 19) — All claude-3-haiku-* API calls stop working. Migrate to claude-haiku-4-5. (Anthropic)

  • Google: Gemini free tier restricted (Apr 1) Pricing — Free tier now limited to Flash models only; Pro requires paid API key. New mandatory spending caps: Tier 1 $250/mo, Tier 2 $2K/mo, Tier 3 $20K–$100K+/mo. Gemini 2.0 Flash final deprecation June 1. (Google AI)

  • OpenAI: Sora 2 / Videos API deprecation (announced Mar 24) — Sora 2 model aliases and Videos API will be removed September 24, 2026. (OpenAI)

Security

  • Flowise CVE-2025-59528 (Apr 7, active exploitation) Trending — CVSS 10.0 RCE via CustomMCP node. User input passed directly to JavaScript Function() constructor with full Node.js privileges. 12,000–15,000 instances exposed. Patch: upgrade to v3.1.1+. (The Hacker News)

  • GitHub Copilot prompt injectionInput crafted to change an LLM's behavior or output in ways its builders didn't intend.OWASP ↗ via PRs (CVE-2025-53773, CVSS 9.6) — Hidden prompt injection in pull request descriptions enabled RCE through GitHub Copilot. Verify your Copilot version is patched. (Security Affairs)

  • Prompt injection surges 340% in 2026 — OWASP LLM Security Project classified prompt injection as the single highest-severity vulnerability category for deployed LLMs in its March 2026 report. EchoLeak zero-clickAn attack that compromises a device without the user clicking, opening or interacting with anything.F5 ↗ attack on M365 Copilot demonstrated silent data exfiltration. (Help Net Security)

Industry & Business

  • Q1 2026 venture funding: $300B (Apr) Trending — All-time high. AI accounted for $242B (80%). Four of the five largest rounds ever: OpenAI ($122B), Anthropic ($30B), xAI ($20B), Waymo ($16B). OpenAI now at $852B post-money valuation. (Crunchbase)

  • Eclipse Ventures raises $1.3B for physical AI (Apr 7) — Two new funds targeting robotics, AI infrastructure, manufacturing, and defense. Portfolio includes Cerebras, Wayve, and Bedrock Robotics. (TechCrunch)

  • Tech layoffs: 78,500 in Q1, ~48% AI-attributed Hiring — Major cuts at Oracle (20–30K), Amazon (16K), Dell (~11K). Meanwhile, AI/ML job postings up 163% YoY. Senior ML engineers newly available but window is closing by Q3. (Tom's Hardware)

  • PwC AI Performance Study (Apr 13) — 75% of AI's economic gains captured by top 20% of companies. Leaders are 2.6x more likely to use AI for business model reinvention, not just efficiency. (PwC)

AI in Production

  • Anthropic Claude outages (Apr 6–8) Production — 10-hour outage on Apr 6 from cascading inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ infrastructure failure triggered by a load-balancing config update. Follow-on incidents on Apr 7 and Apr 8. Post-mortem highlights the gap between model capability and infrastructure resilience. (WebProNews)

  • Neuro-symbolic AI cuts energy 100x (Apr 5) — Researchers demonstrated a neuro-symbolic approach combining neural networks with symbolic reasoning that reduces AI energy consumption by up to 100x while improving accuracy. Relevant for teams exploring inference cost optimization. (ScienceDaily)

Policy & Safety

  • U.S. state AI bills: 600+ introduced (Apr 13) Policy — Nebraska passed a Conversational AI Safety Act regulating minors' interaction with AI. Maryland passed an AI pricing bill. Maine prohibited unlicensed AI therapy services. (Troutman Privacy)

  • California Executive Order N-5-26 (Mar 30) — New AI procurement standards for state contractors and expanded responsible AI use in government operations. (DLA Piper)

  • Colorado AI Act effective June 30, 2026 — Requires "reasonable care" to avoid algorithmic discrimination for high-risk AI deployers. Start compliance planning now. (Wilson Sonsini)

Benchmarks & Evals

  • SWE-Bench Pro (Apr 7) — GLM-5.1 (58.4) > GPT-5.4 (57.7) > Claude Opus 4.6 (57.3). First open-source model at #1. (Scale AI)
  • SWE-Bench Verified (Apr 10) — Claude Mythos Preview leads at 93.9%, followed by GPT-5.3 Codex (85%) and Claude Opus 4.5 (80.9%). (BenchLM)
  • openclaw/openclaw 247K+ stars — Personal AI assistant running locally with 50+ integrations (WhatsApp, Slack, iMessage, etc.). Latest: v2026.4.11 with memory-wiki improvements. (GitHub)
  • zai-org/GLM-5.1 — MIT-licensed 744B MoE model topping SWE-Bench Pro. Weights on HuggingFace. (GitHub)

Type to search · ↑↓ to move · enter to open