JadidJust-in AI Developments, Incidents & Deadlines
April 2026
SMTWTFS1234567891011121321415161718192021222324252627282930

AI news, Thursday, April 23, 2026

13 stories

TLDR

  • Google Cloud Next 2026 (Day 2 today) (Apr 22–23) — Google unveiled TPUTensor Processing UnitGoogle's custom chip built to speed up machine learning, especially large matrix operations.Google Cloud ↗ 8t/8i chips, Gemini Enterprise Agent Platform, Workspace Intelligence, AgenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ Defense with Wiz, and a $750M partner fund; 75% of all new code at Google is now AI-generated.
  • Vast Data raises $1B at $30B valuation (Apr 22) — Nvidia-backed AI-storage startup triples its 2023 valuation; now $500M+ ARR and cash-flow positive.
  • CVE-2026-5760 SGLang (CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 9.8) — RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗ via malicious GGUF model file (Apr 20) — Unsandboxed Jinja2 rendering in the /v1/rerank endpoint; any team loading models from Hugging Face into SGLang should patch immediately.
  • Grok multi-day capacity outage (Apr 21–ongoing) — Both free and SuperGrok subscribers locked out for 48+ hours after a feature drop triggered demand surge; still degraded as of April 23.
  • Gemini 3.1 Flash TTS GA (Apr 15) — Google's most controllable text-to-speech model yet; native multi-speaker, 70+ languages, SynthID-watermarked; Elo 1,211 on Artificial Analysis TTS leaderboard.

Action Items

Things your engineering team should look at or do this week.

  • Patch SGLang if you use the /v1/rerank endpoint — CVE-2026-5760 (CVSS 9.8) lets an attacker execute arbitrary code by loading a GGUF model file with a malicious Jinja2 chat_template; the fix is switching from jinja2.Environment() to ImmutableSandboxedEnvironment. Also audit any model files pulled from Hugging Face or third-party registries. (The Hacker News | CERT/CC disclosure)

  • Apply Microsoft's April 2026 Patch Tuesday — 167 CVEsCommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗ including a SharePoint spoofing zero-dayAn attack using a flaw that was unknown before it was exploited.NIST ↗ actively exploited in the wild (CVE being tracked) and a Defender local privilege-escalation (CVE-2026-33825) with public PoCProof of conceptPublic exploit code that shows a vulnerability can actually be triggered.FIRST ↗. Eight critical RCE flaws are also in scope. Prioritize SharePoint and Defender. (BleepingComputer | Rapid7)

  • Evaluate Google's TPU 8i if you run inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ workloads on GCP — The new inference-optimized chip (announced Apr 22) delivers 80% better performance/dollar over Ironwood for inference, with 3× more on-chip SRAM and a new Boardfly topology connecting 1,152 TPUs in a single pod. Worth benchmarking against your current Nvidia A100/H100 or Ironwood spend. (Google Cloud Blog | TechCrunch)

Models & Tools

  • Google TPU 8t + 8i (Apr 22) Infra Trending — Google's 8th-gen TPUs ship as two purpose-built variants: TPU 8t (training, scales to 9,600 chips + 2PB shared HBM in a single superpod, designed by Broadcom, competing with NVIDIA Vera Rubin) and TPU 8i (inference, 1,152-chip Boardfly pods, 3× on-chip SRAM, designed by MediaTek, 80% better perf/$ over Ironwood). Both announced live at Google Cloud Next today. (Google Blog | Bloomberg)

  • Gemini Enterprise Agent Platform (Apr 22) Agents Trending — Google's renamed/evolved successor to Vertex AI, announced at Cloud Next; features Agent Studio (low-code visual builder), agent governance tooling, and deep integration with BigQuery, Workspace, and Google Security Operations. Gemini Enterprise saw 40% quarter-over-quarter paid MAU growth in Q1. (Google Cloud Blog | TechResearch Online)

  • Workspace Intelligence + Virtual Teammate (Apr 22) Customer AI Agents — Google announced "Workspace Intelligence," a cross-app semantic context layer for Docs, Gmail, Slides, and Meet, plus a new Virtual Teammate feature that lets you invite a Gemini-powered agent into Docs, Meet, and Chat as a persistent participant with memory of past work. (Google Workspace Blog | 9to5Google)

  • Gemini 3.1 Flash TTS (Apr 15) Customer AI Agents — Google's most controllable TTS model: native multi-speaker dialogue, 70+ languages, granular style/pace/pitch control via natural language "audio tags," SynthID watermarking baked in, ~$0.50/1M chars. Available via Gemini API, AI Studio, and Vertex. Elo 1,211 on the Artificial Analysis TTS leaderboard — top of the industry chart. (Google Blog | SiliconANGLE)

  • Qwen 3.6–35B-A3B (Apr 17) Open Source — Alibaba's latest MoEMixture of expertsA model made of many sub-networks, called experts, where a learned router sends each input to only a few of them.Shazeer et al. 2017 ↗: 35B total parameters but only 3B active per forward pass, yet scores 73.4% on SWE-BenchA benchmark that tests whether a model can resolve real GitHub issues by editing code in popular Python repositories.Jimenez et al. 2023 ↗ Verified — competitive with many much larger models. Worth testing as a cost-efficient coding-agent backbone if you're self-hosting. (Fazm AI)

Security

  • CVE-2026-5760 — SGLang RCE via malicious GGUF (CVSS 9.8) (Apr 20) Security Open Source — Disclosed by Stuart Beck via CERT/CC: SGLang's /v1/rerank endpoint renders Jinja2 chat_template fields from model files using an unsandboxed jinja2.Environment(), enabling arbitrary code execution on the serving host. Attack vector: upload a poisoned GGUF file to Hugging Face, wait for victim to load it. Mitigation: switch to ImmutableSandboxedEnvironment; patch is available. Same class as CVE-2024-34359 (Llama Drama). (The Hacker News | Vulert)

  • Microsoft Patch Tuesday April 2026 — 167 CVEs, 2 zero-days (Apr 14) Security — Two zero-days patched: a SharePoint Server spoofing flaw being actively exploited in the wild (improper input validation, allows network-based spoofing without auth) and CVE-2026-33825 (Microsoft Defender local privilege escalationGaining higher permissions than you were given, such as going from a normal user to admin or root.MITRE ATT&CK ↗ to SYSTEM, publicly disclosed). Eight other Critical RCE bugs also addressed. Apply now if you haven't. (BleepingComputer | Krebs on Security)

  • Google Agentic Defense + Wiz at Cloud Next (Apr 22) Security Agents — Google unveiled a combined security platform pairing Google Threat Intelligence + Security Operations with Wiz's Cloud and AI Security Platform; includes new agentic SOC tools: Triage & Investigation Agent (cut alert review from 30 min → 60 sec, processed 5M+ alerts), Threat Hunting Agent, and Detection Engineering Agent. Wiz's AI Application Protection Platform (AI-APP) extends this to runtime protection across multicloud. (Google Cloud Blog | SiliconANGLE)

Industry & Business

  • Vast Data raises $1B at $30B valuation (Apr 22) Infra Trending — Nvidia-backed AI storage startup (Series F led by Drive Capital + Access Industries) more than tripled its 2023 $9.1B valuation. Vast's platform keeps GPUsGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ fed during training and inference by managing high-throughput data access; $4B+ cumulative bookings, $500M+ committed ARR, cash-flow positive. Matches the Wiz record for largest Israeli tech funding round ever. (Bloomberg | CNBC)

  • Google Cloud commits $750M partner fund for agentic AI (Apr 22) Agents Infra — Largest single partner-fund commitment from any hyperscaler; targeted at 120K-member partner ecosystem (Accenture, Deloitte, Capgemini, TCS, etc.) to fund agentic AI prototyping, deployment, and embedded Google FDE support alongside SIs. The subtext: the cloud-infrastructure race has shifted to who can bankroll the deployment layer. (The Next Web | Google Cloud Press)

AI in Production

  • Grok multi-day capacity outage (Apr 21–Apr 23, ongoing) Production — xAI's Grok chatbot has been degraded for 48+ hours following a major feature update (custom templates + video extensions) that triggered a demand surge beyond xAI's current capacity; 813 user-reported incidents in 24 hours. Both free and SuperGrok subscribers are being hit with "high demand" errors across web, iOS/Android, and X integrations in the US, UK, and Germany. A cautionary example of feature launches compressing against infrastructure limits. (IBTimes | PiunikaWeb)

Policy & Safety

  • EU AI Act: August 2 generative AI transparency deadline approaching; industry requests 6→12 month extension (Apr 2026) Policy — Most of the remaining EU AI Act provisions go live August 2, 2026, including Article 50(2) transparency obligations (labeling AI-generated content). A coalition of 15 industry associations led by EuroISPA has formally requested the EU extend the generative-AI labeling grace period from 6 to 12 months. No extension approved yet; compliance Code of Practice still expected Q2 2026. Teams shipping to EU users should be assessing AI-content watermarking and disclosure flows now. (Kennedy's Law | Legal Wire)

Paper Spotlight

  • "Image Generators are Generalist Vision Learners" (Apr 22) Open Source — Google DeepMind paper showing that diffusion-model image generators, when repurposed as backbone vision encoders, achieve state-of-the-art or near-SOTA on standard vision benchmarks without task-specific training. Implication: generative models may be underutilized as perception systems for robotics and multimodal agents. (Google DeepMind)

Type to search · ↑↓ to move · enter to open