JadidJust-in AI Developments, Incidents & Deadlines
April 2026
SMTWTFS1234567891011121321415161718192021222324252627282930

AI news, Friday, April 24, 2026

11 stories

TLDR

  • DeepSeek V4 launches today (Apr 24) — Open-weightsA model whose trained weights are published for anyone to download and run.NTIA ↗ 1.6T-parameter MoEMixture of expertsA model made of many sub-networks, called experts, where a learned router sends each input to only a few of them.Shazeer et al. 2017 ↗ with 1M-token context; Flash at $0.14/$0.28 and Pro at $1.74/$3.48 per M tokensA small unit of data, such as part of a word, that AI models read and generate. Many AI services price by tokens in and out.NVIDIA ↗; claims top open-model scores on math and coding benchmarks.
  • OpenAI ships GPT-5.5 (Apr 23) — First fully retrained base model since GPT-4.5; stronger agenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ coding; API price doubles to $5/$30 per M tokens vs. GPT-5.4's $2.50/$15.
  • Meta lays off 8,000 (10% of workforce) (Apr 23) — Effective May 20; to offset $115B+ AI infra capex planned for 2026.
  • Vercel supply chain breach (Apr 20) — Attacker pivoted via compromised third-party AI tool to access customer environment variables; rotate your env vars now.
  • Datadog: 5% of AI requests fail in production, 60% from capacity limits (Apr 21) — "State of AI Engineering 2026" report; 69% of companies now run 3+ models in production.

Action Items

Things your engineering team should look at or do this week.

  • Evaluate DeepSeek V4-Pro for cost-sensitive workloads — Open weights are live on Hugging Face; API is running at $1.74/$3.48 per M tokens (Pro) and $0.14/$0.28 (Flash). Claims top open-model performance on math/coding. With GPT-5.5 doubling to $5/$30, the cost differential for Pro-tier inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ is now ~3×. Worth a benchmark run before your next API contract renewal. (DeepSeek API Docs | CNBC)

  • Rotate Vercel environment variables — Supply chain attackAn attack that reaches its target through a supplier, product or service the target relies on.NIST ↗ via Context.ai gave an attacker ~2 months of dwell time inside Vercel; they enumerated and decrypted non-sensitive env vars across a subset of customers. Treat any non-"sensitive"-flagged API keys, DB credentials, tokens, and signing keys as potentially exposed. (Vercel KB | TechCrunch)

  • Audit CI pipelines using AI coding agents for prompt injectionInput crafted to change an LLM's behavior or output in ways its builders didn't intend.OWASP ↗ — Researchers showed a single malicious GitHub PR title or issue comment causes Claude Code Actions, Gemini CLI Action, and GitHub Copilot Agent to exfiltrate CI secrets as "security findings" (CVSSCommon Vulnerability Scoring SystemA standard 0 to 10 severity score: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10 critical.FIRST ↗ 9.4). If you run AI agents in GitHub Actions that read PR/issue metadata, treat that input as untrusted and add sanitization or sandboxing. (SecurityWeek | The Register)

Models & Tools

  • DeepSeek V4 Flash + Pro (preview) (Apr 24) Open Source Trending — The long-anticipated V4 series drops today with open weights on Hugging Face and live API access. V4-Pro: 1.6T total parameters, 49B active per token, 1M-token context. V4-Flash: 284B total, 13B active. Novel "Hybrid Attention Architecture" improves long-context recall. DeepSeek claims V4-Pro tops all open-source rivals on math and coding benchmarks, trailing only Gemini 3.1-Pro on world knowledge. (CNBC | Bloomberg | Simon Willison)

  • OpenAI GPT-5.5 (Apr 23) Trending — The first fully retrained base model since GPT-4.5; all prior 5.x releases were post-training iterations on the same base. Architecture, pretraining corpus, and agent-oriented objectives all reworked. Stronger agentic coding, computer use, and research; 1M context windowHow much text a model can see and use at once while writing a reply.Anthropic ↗. "Does much more with less guidance" — Greg Brockman. Rolling out to ChatGPT Plus/Pro/Business/Enterprise; API access staged via Codex path while full Responses/Chat Completions rollout completes. (OpenAI | TechCrunch)

APIs & Pricing

  • OpenAI GPT-5.5 API: $5/$30 per M tokens — double GPT-5.4's price (Apr 23) Trending — GPT-5.5 input/output pricing doubles GPT-5.4's $2.50/$15. Batch pricing at 50%; priority at 2.5× standard. DeepSeek V4-Pro launching the same day at $1.74/$3.48 makes the gap hard to ignore for throughput-heavy workloads. API is accessible now through the Codex sign-in path; full rollout to Responses and Chat Completions APIs to follow. (OpenAI pricing | The Decoder)

Security

  • Vercel supply chain breach via Context.ai (Apr 20) Production — Attacker compromised an employee at Context.ai (an AI tool Vercel used internally), then used that access to take over the employee's Vercel Google Workspace account via OAuth — gaining ~2 months of dwell time to enumerate and decrypt non-sensitive customer environment variables. Data reportedly listed on BreachForums for $2M. Rotate any non-sensitive Vercel env vars (API keys, tokens, DB creds, signing keys) immediately. (TechCrunch | BleepingComputer | Trend Micro)

  • "Comment and Control" — prompt injection hits Claude Code, Gemini CLI, and GitHub Copilot simultaneously (Apr 15) Agents — Johns Hopkins researchers showed that a malicious instruction in a GitHub PR title or issue comment hijacks all three agents into exfiltrating CI secrets (API keys posted as "security findings" or action logs). Anthropic rated CVSS 9.4 Critical; Google paid a $1,337 bounty; GitHub paid $500. No formal CVEsCommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗ issued. Any CI pipeline running AI coding agents that read PR/issue metadata should treat that content as untrusted. (SecurityWeek | VentureBeat)

  • CVE-2026-21520 — Microsoft Copilot Studio indirect prompt injection, data exfiltrated post-patch (Apr 19) Agents — Attacker injects a fake system-role instruction via a public SharePoint comment field; Copilot Studio concatenates it unsanitized, queries connected SharePoint Lists, and sends customer data to an attacker email via Outlook. The notable detail: Microsoft patched the injection vector, but the data exfiltration still completed — illustrating that patching one link in an agentic chain may not stop the full attack path. (VentureBeat)

Industry & Business

  • Meta lays off 8,000 (10% of workforce), effective May 20 (Apr 23) Hiring Trending — Zuckerberg framed the cuts as offsetting the company's $115B+ 2026 AI infrastructure capex; an additional ~6,000 roles will go unfilled. Snap announced ~1,000 layoffs the same day, citing AI generating 65%+ of its new code. Q1 2026 context: ~95,878 tech workers laid off YTD globally, with ~48% of those cuts attributed to AI efficiency. (CNN | Axios)

  • Cognition AI (Devin) in funding talks at $25B valuation (Apr 23) Agents — Cognition is reportedly in early discussions to raise hundreds of millions at ~$25B, more than double its September 2025 valuation of $10.2B. Round is not finalized. (Bloomberg | SiliconANGLE)

  • DeepSeek raising at $20B+ as Tencent and Alibaba circle the deal (Apr 22–24) Open Source Trending — Simultaneous with the V4 launch, DeepSeek is conducting its first-ever external funding round. Tencent (proposing up to 20% stake) and Alibaba are in early talks; target valuation is $20B+, up from an initial $10B floor. No deal closed yet. (Bloomberg | The Information)

AI in Production

  • Datadog "State of AI Engineering 2026": capacity limits, not model quality, are breaking production AI (Apr 21) Infra — Analysis of thousands of production LLMLarge language modelA neural network trained on huge amounts of text that generates text, answers questions and summarizes.Anthropic ↗ deployments: ~5% of AI requests fail; 60% of those failures trace to capacity limits rather than model errors. 69% of organizations now run 3+ models alongside complex agent workflows. Root causes include fragmented pipelines, excessive retries, and inefficient routing — not intelligence gaps. Median token consumption doubled YoY; heavy users saw 4×. (GlobeNewswire | Datadog via StockTitan)

Policy & Safety

  • GUARDRAILS Act introduced to block federal preemption of state AI laws (Apr 2026) Policy — House Democrats (Reps. Beyer, Matsui, Lieu, Jacobs, McClain Delaney + Sen. Schatz) introduced the GUARDRAILS Act, which would repeal the Trump administration's EO establishing a national AI framework and explicitly bar federal preemption of state AI laws — directly countering the White House's March 2026 National Policy Framework. Meanwhile, Colorado's AI Act takes effect June 30, 2026, requiring AI risk management programs and impact assessments; California's CPPA automated decision-making rules follow in January 2027. Teams shipping to US consumers should now be tracking state-level compliance timelines. (Beyer.house.gov | Alston & Bird AI Quarterly)

Type to search · ↑↓ to move · enter to open