JadidJust-in AI Developments, Incidents & Deadlines
April 2026
SMTWTFS1234567891011121321415161718192021222324252627282930

AI news, Thursday, April 30, 2026

10 stories

TLDR

  • Big Tech Q1 earnings in: $665B AI capex committed (Apr 29) — All four hyperscalers beat estimates; Google Cloud +63% wins the session; Meta down 5% after flagging flat Q2 + 8,000 jobs cut May 20; Azure missed growth on capacity constraints, not demand
  • EU AI Act Omnibus trilogue failed (Apr 28) — Talks broke after 12 hours; the August 2, 2026 high-risk system compliance deadline remains legally in force with no extensions
  • Google signs classified Pentagon AI deal (Apr 28) — Gemini granted to DoD for "any lawful government purpose" on classified networks; ~600 Google employees protested
  • "IDEsaster" + MCPModel Context ProtocolAn open standard that lets AI apps connect to data sources, tools and workflows through one common interface.MCP ↗ architectural flaw (Apr 2026) — 24 CVEsCommon Vulnerabilities and ExposuresA public catalog that gives each known security vulnerability a unique ID, a short description and at least one reference.NIST ↗ across Cursor, Windsurf, VS Code, Claude Code, and Gemini CLI; separate OX Security disclosure puts 150M+ MCP downloads at RCERemote code executionA flaw that lets an attacker run malicious code on a target's computers or network.Cloudflare ↗ risk
  • Musk v. Altman trial Day 4 (Apr 30) — Cross-examination wrapping up; Greg Brockman placed on 48-hour notice to testify

Action Items

Things your engineering team should look at or do this week.

  • Plan for EU AI Act August 2 high-risk deadline — assume no extensions — The Omnibus trilogue collapsed April 28 without a deal on proposed deadline deferrals to 2027–28. A follow-up session is ~May 13, too late to affect August. If your team ships AI into EU hiring, credit, safety, or infrastructure systems, the original August 2, 2026 compliance date is in force now. (IAPP | The Next Web)

  • Audit AI IDE setups and MCP config files for CVEs and exposed secrets — "IDEsaster" disclosures have assigned 24 CVEs to AI IDEs including Cursor (CVE-2026-26268: arbitrary code execution via malicious repo clone), Windsurf (CVE-2026-30615: zero-clickAn attack that compromises a device without the user clicking, opening or interacting with anything.F5 ↗ RCE, the only IDE requiring no user interaction), VS Code, Claude Code, and Gemini CLI. Separately, OX Security's MCP architectural flaw exposes 7,000+ servers and 150M+ downloads to RCE. GitGuardian's 2026 report found 2,100 confirmed valid credentials in public GitHub MCP config files — check yours. (VentureBeat | OX Security | The Hacker News)

  • Migrate off Gemini 2.0 Flash before June 1 — Google is deprecating Gemini 2.0 Flash and Gemini 2.0 Flash-Lite on June 1, 2026. Migration targets: Gemini 2.5 Flash or Gemini 3.1 Flash-Lite. (Google AI for Developers)

APIs & Pricing

  • Gemini 2.0 Flash / Flash-Lite — June 1 deprecation deadline (Apr 2026) Infra — Google's June 1, 2026 cutoff for Gemini 2.0 Flash and Flash-Lite is now five weeks out. Note that since April 1, Gemini Pro models are behind a paywall for free-tier users and new API accounts default to prepaid billing; spending caps apply by tier ($250/month for Tier 1, up to $100K+ for Tier 3). (Google AI for Developers | AI Pricing Guru)

Security

  • "IDEsaster" — 24 CVEs across AI coding IDEs (Apr 2026, ongoing) Agents — A rolling disclosure campaign targeting AI-integrated development environments has assigned 24 CVE identifiers across Cursor, Windsurf, VS Code, Claude Code, and Gemini CLI. The shared root cause: every tested AI IDE is vulnerable to prompt injectionInput crafted to change an LLM's behavior or output in ways its builders didn't intend.OWASP ↗ enabling remote code execution and secrets exfiltration. Windsurf's CVE-2026-30615 is the worst — zero user interaction required. Cursor's CVE-2026-26268 triggers via a malicious git repo clone. An ongoing supply-chain campaign dubbed SANDWORM_MODE has also been distributing 19 malicious npm packages that silently install rogue MCP servers into Claude Code, Cursor, and Windsurf. (VentureBeat | Cloud Security Newsletter | Security Boulevard)

  • MCP architectural RCE flaw — 150M+ downloads, Anthropic declines to patch (Apr 16) Trending — OX Security disclosed that Anthropic's official MCP SDKs (Python, TypeScript, Java, Rust) contain an architectural design decision enabling arbitrary command execution — not a bug that can be silently patched, but a protocol-level choice. Over 150M total downloads, 7,000+ publicly reachable servers, and 14 CVEs already assigned; affected products include LiteLLM, LangFlow, Flowise, DocsGPT, and GPT Researcher. Anthropic's disclosure response: "expected behavior." Still unresolved at the protocol level and trending in security circles two weeks later. (OX Security | The Register | SecurityWeek)

Industry & Business

  • Big Tech Q1 2026 earnings: all four beat, $665B capex committed, split on cloud (Apr 29) Infra Trending — All four hyperscalers topped Q1 estimates but moved in opposite directions after hours. Alphabet +6%: Google Cloud grew 63% YoY to $20B, the first quarter enterprise AI was Google Cloud's primary growth driver; 2026 capex raised to $180–190B. Microsoft −2.4%: AI business at $37B ARR (+123% YoY), but Azure growth missed on data center capacity constraints, not demand; $190B 2026 capex. Amazon −3.7%: Q1 revenue $181.5B, EPS $2.78 vs. $1.63 estimate; AWS cloud share intact. Meta −5%: Revenue $56.3B beat, but guided flat Q2 revenue while raising capex to $125–145B; confirmed 8,000 jobs (10% of workforce) cut May 20 in a structural AI-driven reorganization. Combined 2026 AI capex from the four: ~$665B, up ~75% vs. 2025. (CNBC/Alphabet | Bloomberg | Fortune)

  • Rogo AI raises $160M Series D for agenticDescribes AI systems where a model uses tools and decides its own steps instead of following a fixed script.Anthropic ↗ investment banking platform (Apr 29) Agents Customer AI — Kleiner Perkins led the round (Sequoia, Thrive, J.P. Morgan Growth Equity also participated), bringing Rogo's total funding past $300M. Rogo's agent Felix automates high-finance workflows — pitch books, CIMs, data room diligence — for 35,000 professionals at Rothschild, Jefferies, Lazard, Moelis, and Nomura. A concrete production signal for regulated-sector vertical AI agents going beyond demo. (PR Newswire | SiliconANGLE)

  • Google signs classified Pentagon AI deal (Apr 28) Policy — Google granted the DoD unfettered Gemini access for "any lawful government purpose," including classified networks. The deal followed similar agreements with OpenAI and xAI; it came two months after the Pentagon dropped Anthropic, which had refused to allow autonomous weapons use without stronger safeguards. Google's agreement includes non-binding language discouraging domestic mass surveillance and autonomous weapons — but the Pentagon chief noted it's "never a good thing" to rely on one model. ~600 Google employees sent a protest letter to Pichai. (TechCrunch | Bloomberg | CNBC)

  • Q1 2026: 80,000 tech workers laid off, ~50% attributed to AI (Apr 2026) Hiring — Tom's Hardware's Q1 tracker found 78,557 tech layoffs, with 47.9% of those cuts directly attributed to AI productivity gains. Largest single event: Oracle 30,000 (late March). Paradox: AI/ML job postings grew 163% YoY and Anthropic, OpenAI, Cloudflare, and Stripe are hiring aggressively. For teams hunting AI engineering talent right now, the surplus is real. (Tom's Hardware)

  • Musk v. Altman trial Day 4: cross-exam closes, Brockman on 48-hour notice (Apr 30) Trending — Musk's cross-examination by OpenAI attorney William Savitt is wrapping up today after two days of clashes; Musk accused Savitt of asking questions "designed to trick" him and declared he was "a fool" to donate $38M, which he says funded an $800B for-profit company. Greg Brockman was placed on 48-hour notice and could be called as soon as Friday. (CNBC | Axios)

AI in Production

  • Azure growth miss: capacity-constrained, not demand-constrained (Apr 29) Infra — Microsoft's Azure AI service missed growth expectations this quarter not because enterprise demand slowed, but because data center capacity can't keep pace with order intake. Microsoft CFO guidance: Q4 capex will exceed $40B, with $190B for the full year. This is a concrete signal that the U.S. data center build-out bottleneck (transformers, power permitting) is already hitting cloud delivery timelines for AI services — worth accounting for in any H2 2026 infrastructure planning. (The Next Web | Microsoft Source)

Policy & Safety

  • EU AI Act: August 2 high-risk deadline stands after trilogue collapses (Apr 28) Trending — A 12-hour Strasbourg trilogue on the AI Act Omnibus ended April 28 without agreement. The sticking point: how AI in Annex I regulated products (medical devices, machinery, vehicles) relates to existing sectoral safety law. The package would have deferred the August 2, 2026 high-risk obligations to 2027–28 and narrowed scope — none of that passed. A follow-up is scheduled for ~May 13, but passing in time to affect August is unlikely. If you ship AI into EU hiring, credit scoring, critical infrastructure, or safety systems: plan against August 2 now. (IAPP | The Next Web | Modulos)

Type to search · ↑↓ to move · enter to open