JadidJust-in AI Developments, Incidents & Deadlines
April 2026
SMTWTFS1234567891011121321415161718192021222324252627282930

AI news, Wednesday, April 29, 2026

11 stories

TLDR

  • Spring AI hit with 5 CVEsCommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗ (Apr 27) — Vector store SQL/JSONPath injection and cross-tenant memory exfiltration; patch to 1.0.6 / 1.1.5 now
  • OpenAI models land on AWS Bedrock (Apr 28) — One day after Microsoft exclusivity ends, GPT-5.x and Codex agent go live in Bedrock preview (GA in weeks)
  • Musk v. Altman trial opens (Apr 28–29) — Nine-person jury seated; Musk on the stand seeking $130B in damages and OpenAI's return to nonprofit status
  • Big Tech AI earnings tonight (Apr 29) — Alphabet, Microsoft, Amazon, Meta all report after close; $600–645B in AI capex under scrutiny
  • White House plans Anthropic Mythos access for federal agencies (Apr 29) — Axios scoop: OMB drafting guidance to let agencies bypass Anthropic's supply-chain risk flag

Action Items

Things your engineering team should look at or do this week.

  • Patch Spring AI immediately — Five CVEs were disclosed April 27 in Spring AI 1.0.x and 1.1.x: SQL injection in CosmosDB vector stores (CVE-2026-22730), JSONPath injection in FilterExpressionConverter (CVE-2026-22729), SpEL injection via filter expression keys (CVE-2026-22738), and cross-tenant memory exfiltration via conversation IDs (CVE-2026-40966). If you pass user-supplied values into filter expressions or document IDs, treat this as urgent. Fixed in 1.0.6 and 1.1.5. (HeroDevs | spring.io)

  • Evaluate OpenAI on Bedrock for multi-cloud workloads — GPT-5.x models and the jointly-built Codex agent service are now in preview on AWS Bedrock. If your team already runs on AWS, this eliminates a cross-cloud API hop. Worth testing latency and pricing vs. the Azure-hosted path before GA lands. (CNBC | GeekWire)

  • Watch tonight's Big Tech earnings for capex guidance — All four hyperscalers report after market close. Their capex trajectories and cloud AI revenue signals will shape GPUGraphics processing unitA highly parallel processor that does the large matrix math behind training and running models.NVIDIA ↗ availability, inferenceRunning a trained model on new input to get an output, as opposed to training it.NVIDIA ↗ pricing, and API roadmaps for H2 2026. (Bloomberg)

Models & Tools

  • Hugging Face ml-intern (Apr 25) Open Source Agents — Hugging Face released ml-intern, an open-source autonomous ML engineering agent that handles the full development lifecycle: writing training code, running experiments, evaluating results, and iterating — with minimal human oversight. Designed for both research and production ML contexts. (AIToolly)

APIs & Pricing

  • OpenAI models now available on AWS Bedrock (Apr 28) Infra — One day after Microsoft and OpenAI restructured their partnership — Microsoft retains a nonexclusive license through 2032; OpenAI is no longer Azure-exclusive — AWS launched OpenAI's models on Amazon Bedrock alongside a jointly-built Codex agent service. Preview access is live now; general availability expected within weeks. Microsoft remains OpenAI's "primary cloud partner." (CNBC | GeekWire | Axios)

Security

  • Spring AI — 5 CVEs in vector stores and memory layers (Apr 27) Data — The Spring security team disclosed five vulnerabilities in Spring AI 1.0.x and 1.1.x. Two high-severity CVEs cover JSONPath injection in FilterExpressionConverter (CVE-2026-22729) and SpEL injection via user-supplied filter keys (CVE-2026-22738); a critical CVE covers SQL injection in CosmosDB vector stores (CVE-2026-22730); and CVE-2026-40966 enables cross-tenant memory exfiltration via conversation IDs. The underlying issue — user input flowing into query languages without sanitization — is the vector-store equivalent of 2000s-era SQL injection, appearing fresh in RAGRetrieval-augmented generationFetching relevant documents at query time and giving them to the model, so its answer draws on them.Lewis et al. 2020 ↗ stacks. Fixed in 1.0.6 and 1.1.5. (HeroDevs | spring.io | SecurityOnline)

Industry & Business

  • Musk v. Altman trial: opening arguments and first testimony (Apr 28–29) Trending — A nine-person jury was seated in Oakland federal court April 27; Musk took the stand April 28. His two surviving claims — unjust enrichment and breach of charitable trust — seek $130B in damages and demand removal of Altman and Brockman from OpenAI's board. OpenAI's defense: "We are here because Mr. Musk didn't get his way." Satya Nadella, Altman, and Brockman are all expected to testify over the three-week trial. Outcome could set governance precedent for AI labs. (CNBC | CNN | NPR)

  • Big Tech earnings: $600–645B in AI capex comes to account (Apr 29) — Alphabet, Microsoft, Amazon, and Meta all report Q1 2026 earnings after market close today. The critical question: is revenue growing fast enough to justify the spend? Key metrics to watch: AWS AI run-rate (crossed $15B annualized in Q4 2025), Google Cloud growth (48% in Q4 2025), and Meta's AI-generated ad revenue ($10B annualized run-rate). Apple reports Thursday. (Bloomberg | Yahoo Finance)

  • Cognition AI (Devin) in talks to raise at $25B valuation (Apr 23) Agents — Bloomberg reports Cognition is in early-stage talks to raise hundreds of millions at a $25B valuation, more than doubling its $10.2B mark set months ago. Devin's ARR surged from $1M in Sep 2024 to $73M by Jun 2025; customers include Goldman Sachs, Citi, Palantir, and Nubank. Context: Devin's published SWE-benchA benchmark that tests whether a model can resolve real GitHub issues by editing code in popular Python repositories.Jimenez et al. 2023 ↗ task success rate remains around 15%, a valuation-versus-benchmark gap worth tracking. (Bloomberg | SiliconAngle)

  • Avoca AI raises $125M+ at $1B valuation for service-economy voice agents (Apr 27) Customer AI Agents — Avoca deploys AI voice and chat agents across HVAC, plumbing, automotive, and other service businesses — handling inbound calls, booking jobs, and coaching CSRs. It raised $125M+ across three rounds (Kleiner Perkins led Series A; Meritech and General Catalyst led Series B) and says it's on track to book $1 billion in jobs in 2026, a real production signal for vertical AI agents. (Fortune | PR Newswire)

  • Salesforce hires 1,000 new grads while others cut (Apr 27) Hiring — CEO Marc Benioff is making a public bet against the AI-kills-entry-level-jobs narrative: Salesforce is hiring 1,000 graduates and interns to build AI systems, directly contrasting with the Meta/Microsoft/Snap layoff wave (~81K cuts collectively) that explicitly cited AI over the same period. (Fortune)

AI in Production

  • U.S. AI data center build-out: ~7GW of 12GW canceled or delayed (Apr 2026) Infra — Nearly half of U.S. AI data center capacity announced for 2026 has been canceled or pushed out. Root causes: transformer and switchgear shortages with multi-year lead times, power grid permitting cycles up to 5 years in some regions, tariff impacts on components, and growing local opposition. If your team is modeling GPU availability or cloud capacity for H2 2026 and beyond, the physical infrastructure is materially behind the announced schedule. (Medium / Hari Raj Rajendran)

Policy & Safety

  • White House moves to give federal agencies access to Anthropic Mythos (Apr 29) Trending — In an Axios scoop published today, OMB chief Gregory Barbaccia emailed Cabinet departments that OMB is setting up protections to let agencies onboard Mythos despite Anthropic's supply-chain risk designation. The NSA is already using it; Treasury has requested access; Anthropic has briefed NIST and CISACybersecurity and Infrastructure Security AgencyThe U.S. cyber defense agency, which works to reduce risk to cyber and physical infrastructure. It runs KEV.CISA ↗. Mythos (released Apr 7 under controlled access) excels at identifying software security flaws. White House workshops this week are informing a potential executive action on broader government AI adoption. (Axios | Bloomberg | CSO Online)

Paper Spotlight

  • "The Reasoning Trap: How Enhancing LLMLarge language modelA neural network trained on huge amounts of text that generates text, answers questions and summarizes.Anthropic ↗ Reasoning Amplifies Tool Hallucination" (ICLR 2026, Apr 2026) — Presented at ICLR 2026 in Rio de Janeiro this week, this paper finds that RL-based reasoning training increases tool-hallucination rates in lockstep with task performance gains. The same training that makes models stronger at complex multi-step tasks makes them more likely to hallucinate tool calls. Key implication for agenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ system builders: stronger base models don't reduce the need for robust tool-call validation — they may increase it. (Asanify coverage)

Type to search · ↑↓ to move · enter to open