JadidJust-in AI Developments, Incidents & Deadlines
April 2026
SMTWTFS1234567891011121321415161718192021222324252627282930

AI news, Thursday, April 16, 2026

14 stories

TLDR

  • Anthropic outage (Apr 15) — Claude.ai, API, Claude Code, and Cowork all degraded for ~3 hours; 20K+ users affected; now resolved
  • Copilot Studio ShareLeak (CVE-2026-21520) — Microsoft patched this Jan 15, but VentureBeat reports data exfiltrated anyway in post-patch testing; Salesforce Agentforce also vulnerable to similar form-based prompt injectionInput crafted to change an LLM's behavior or output in ways its builders didn't intend.OWASP ↗
  • OpenAI acquires Hiro Finance (Apr 13-14) — 6th acquisition of 2026; signals ChatGPT financial planning features; Hiro product shutting down Apr 20
  • Kimi Code K2.6 (Apr 13) — Moonshot AI's coding agent hits Sonnet 4.6-level benchmark scores at substantially lower cost; available to all subscribers
  • Anthropic vs. DoD: D.C. Circuit rules against Anthropic (Apr 8) — Appellate court refuses to block the Pentagon's supply chain risk designation, creating a legal split with the California preliminary injunction

Action Items

Things your engineering team should look at or do this week.

  • Audit Copilot Studio deployments for ShareLeak exposure — Even with the Jan 15 patch applied, VentureBeat's post-patch testing showed data exfiltration still occurred. If your Copilot Studio agents accept input from public-facing SharePoint forms or comment fields, treat those as untrusted inputs and add output filtering. Check Tenable's advisory for mitigations. (VentureBeat | Tenable)
  • Add Claude API fallback routing — Yesterday's 3-hour Claude outage (login failures, 500s on API, Cowork down) is a reminder to build graceful degradation into any production workflows that rely on Anthropic endpoints. Consider a secondary provider or queue-based retry logic. (CNBC)
  • Evaluate Kimi Code K2.6 if you're on a coding agent budget — Moonshot AI's latest terminal coding agent scores at ~89/100 on dev benchmarks (up from 83), approaching Sonnet 4.6 quality. Worth a short trial if your team is cost-sensitive on agenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ coding tasks. (BuildFastWithAI)

Models & Tools

  • Kimi Code K2.6-code-preview (Apr 13) Agents — Moonshot AI's terminal coding agent received a meaningful upgrade: deeper chain-of-thought reasoning, stronger multi-step agent planning, and more reliable tool-calling execution. Developer benchmarks place it at ~Sonnet 4.6-level performance. Available immediately to all Kimi Code subscribers. (BuildFastWithAI | DataLearner)

  • Gemma 4 family (Apr 2) Open Source — Google DeepMind's Apache 2.0 family of on-device models (2B, 4B, 26B MoEMixture of expertsA model made of many sub-networks, called experts, where a learned router sends each input to only a few of them.Shazeer et al. 2017 ↗, 31B Dense) with up to 256K context, native vision/audio, and 140+ languages. The 31B Dense ranks #3 globally on Arena AI among all open models; the 26B MoE fits on consumer hardware while beating models 20× its size on several benchmarks. The updated Gemma 3 commercial license (Apr 11) also removed the previous user-count restriction. (Google AI Blog | Google Cloud)

  • Google Agent Development Kit (ADK) for Python (Apr, trending) Agents Open Source — google/adk-python is the fastest-growing new framework on GitHub this month (8,200+ stars). It provides a structured foundation for building multi-agent systems with built-in MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗ and A2AAgent2AgentAn open protocol, started by Google and now under the Linux Foundation, that lets agents from different vendors work together.A2A Protocol ↗ support, and integrates with both Gemini and third-party models. (GitHub)

Security

  • CVE-2026-21520 / "ShareLeak" — Copilot Studio data exfiltration (Jan 15 patch / Apr 14 disclosure) Agents — Capsule Security's post-patch research shows that even after Microsoft's January fix, a crafted payload in a public SharePoint form field can still override Copilot Studio's system instructions and direct the agent to exfiltrate SharePoint Lists data via Outlook. VentureBeat reports a similar vector in Salesforce Agentforce via comment fields. The fundamental issue — no input sanitization between form fields and the model's context — hasn't been fully closed. CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 7.5. (VentureBeat | CSO Online | NVD)

  • Capsule Security emerges from stealth (Apr 15) Agents — Israeli startup raised $7M seed to build real-time runtime controls for AI agents — think WAF-style policy enforcement at the agent execution layer, not just at input. Timing is notable given the same-day ShareLeak coverage; the two stories together reflect a growing market for AI agent security primitives. (Help Net Security | Security Boulevard)

Industry & Business

  • OpenAI acquires Hiro Finance (Apr 13-14) — OpenAI's 6th acquisition of 2026; Hiro is an AI-powered personal finance assistant that acts as a "personal CFO," integrating credit cards and savings accounts. The deal is framed as an acqui-hire of a financial reasoning team; Hiro's product shuts down April 20. Signals that ChatGPT financial planning features are on the roadmap. (TechCrunch | SiliconAngle)

  • D.C. Circuit denies Anthropic's emergency stay on DoD blacklisting (Apr 8) Policy — A three-judge appellate panel sided with the Pentagon, refusing to block the "supply chain risk" designation that restricts Anthropic from defense contracts. The ruling creates a legal split: a California federal court's March 26 preliminary injunction (covering civilian agency contracts) remains in place, while the D.C. Circuit ruling allows the defense-sector ban to stand. For engineering teams at defense contractors or government integrators, this creates near-term procurement uncertainty around Claude and Anthropic APIs. (CNBC | Tech Brew)

  • Q1 2026 VC: $300B raised, AI = 80% (Q1 2026 summary) Infra — Crunchbase reports a record-breaking $300B in global venture investment in Q1, with AI accounting for $242B (80%). The four largest VC rounds in history all closed in Q1: OpenAI ($122B), Anthropic ($30B), xAI ($20B), and Waymo ($16B). Foundational AI startup funding doubled all of 2025 in a single quarter. (Crunchbase)

AI in Production

  • Anthropic multi-service outage (Apr 15) — Elevated errors hit Claude.ai, the Anthropic API, Claude Code, and Cowork simultaneously starting ~10:53 AM ET. At peak, 20,000+ users reported failures (login loops, 500 errors, usage limit glitches). Anthropic confirmed the incident on its status page; full resolution came around 1:42 PM ET (~3 hrs). The API recovered before the web product; logged-in Claude Code users could continue working, but new logins were broken throughout. Root cause not yet disclosed publicly. (CNBC | Newsweek | Status Page)

Policy & Safety

  • U.S. AI Exports Program: 90-day window open (Apr 1) Infra — The Department of Commerce opened a 90-day submission window for companies to form approved consortia under the American AI Exports Program. Approved groups get expedited export license reviews and prioritized access to federal AI procurement credit. Relevant if your org is exploring government contracts or selling AI infrastructure internationally. (Eversheds-Sutherland)

  • TRUMP AMERICA AI Act: federal preemption bill advancing (Mar-Apr) — Senator Blackburn's proposed legislation would create a unified federal AI framework and preempt "unduly burdensome" state AI laws — directly challenging Colorado's Act (effective June 30) and California's CCPA amendments. Key developer-facing provisions: AI-generated content labeling requirements, child safety guardrails, and new copyright liability rules. Opposition from both tech industry and governors (DeSantis, Newsom) is significant. Still in discussion draft stage. (Jones Walker | National Law Review)

  • google/adk-python — 8,200+ stars this month; multi-agent framework with native MCP/A2A support; see Models & Tools section above. (GitHub)
  • openai/codex-cli — 5,800+ stars; terminal-native coding agent from OpenAI. (GitHub)
  • block/goose — 4,900+ stars; open-source local coding agent from Block with strong MCP integration, positioned as a self-hostable alternative to Claude Code. (GitHub)

Type to search · ↑↓ to move · enter to open