AI News Digest — April 5, 2026

Google Releases Gemma 4 — Apache 2.0 Multimodal Open Models

Google unveiled Gemma 4, its latest family of open AI models, releasing four variants under the permissive Apache 2.0 license. The lineup includes:

Gemma 4 E2B — 2 billion parameter efficient model
Gemma 4 E4B — 4 billion parameter efficient model
Gemma 4 31B — 31 billion parameter dense model
Gemma 4 26B-A4B — Mixture-of-Experts (MoE) model with 26B total / 4B active parameters

All four models are multimodal, supporting both vision and audio inputs alongside text. A key architectural innovation is Per-Layer Embeddings (PLE), which improves parameter efficiency by allowing layers to share embedding representations, reducing memory overhead without sacrificing performance.

Developer availability: The models are accessible via the Google AI Studio API for cloud-based inference and are available in GGUF format for local deployment. The Apache 2.0 license permits commercial use, modification, and distribution with minimal restrictions.

For developers integrating Gemma 4 into their workflows, Simon Willison released llm-gemini 0.30, which adds support for both gemma-4-26b-a4b-it and gemma-4-31b-it through his llm CLI tool and Python library ecosystem.

Cursor 3 Shifts from Autocomplete to Agent-Based Coding

Cursor 3 marks a fundamental shift in AI-assisted development. Rather than focusing on line-by-line autocomplete, Cursor 3 introduces agent-based coding workflows that operate at the task level. Instead of suggesting the next few characters, agents can plan, execute, and iterate on multi-step coding tasks — from refactoring a module to implementing a feature across multiple files.

This represents the broader industry trend of AI coding tools evolving from passive suggestion engines into active collaborators that can understand project context, break down complex tasks, and manage their own execution flow. Developers using Cursor 3 can delegate entire workflows to AI agents while maintaining oversight through interactive checkpoints.

Axios npm Package Hit by Supply Chain Attack

In a stark reminder of supply chain vulnerabilities, the widely-used Axios HTTP library was compromised in a targeted npm supply chain attack. The North Korean threat group Sapphire Sleet obtained a maintainer’s authentication token and used it to publish malicious versions:

axios@1.14.1 — compromised version
axios@0.30.4 — compromised version

The attack injected a dependency on plain-crypto-js, a malicious package designed to steal credentials and environment variables from build systems. The compromised versions were live for approximately 3 hours before being detected and yanked.

Action items for developers:

Audit your package-lock.json and yarn.lock for versions 1.14.1 or 0.30.4 of axios
Pin dependencies to known-good versions
Enable npm’s provenance verification and consider using --ignore-scripts in CI
Review the npm audit advisory for the full scope of the compromise

Microsoft Announces Three New Foundational Models

Microsoft revealed plans for three new foundational AI models, further expanding its in-house model portfolio beyond its Phi family. Details remain limited, but the announcement positions Microsoft as both a model builder and platform provider — competing directly with Google, Meta, and Anthropic in the foundational model space while continuing to host third-party models through Azure AI.

Copilot Cowork Enters Microsoft Frontier Program

Copilot Cowork, Microsoft’s collaborative AI coding environment, is now available through the Microsoft Frontier Program. Notably, it includes Claude integration, allowing developers to use Anthropic’s models alongside GPT-based assistants within the same workflow. This signals Microsoft’s willingness to offer multi-model experiences rather than locking developers into a single provider.

Developers interested in early access can apply through the Frontier Program portal.

Google Agent Development Kit for Java

Google released the Agent Development Kit (ADK) for Java, providing a framework for building AI agents that integrate with Google’s ecosystem. The kit includes tooling for agent orchestration, memory management, and multi-step task execution — targeting enterprise Java developers looking to embed AI agent capabilities into existing applications.

HuggingFace: TRL v1.0, Granite 4.0, and More

HuggingFace had a packed week with multiple releases and announcements:

TRL v1.0 — The popular Transformers Reinforcement Learning library hit its first major stable release, offering production-ready tools for fine-tuning language models with RLHF, DPO, and other alignment techniques. The v1.0 milestone signals API stability and long-term support.
Granite 4.0 3B Vision — IBM’s Granite series added a compact 3B parameter vision-language model, suitable for on-device and edge deployment scenarios.
Holo3 — A new 3D generation model for creating and manipulating three-dimensional assets from text or image prompts.
Falcon Perception — An expansion of the Falcon model family focused on multimodal perception tasks.
Storage Buckets — A new HuggingFace platform feature providing managed object storage for datasets, model artifacts, and other large files — reducing the need for external storage solutions when building on the Hub.

Simon Willison’s LLM Ecosystem Updates

Simon Willison continues to ship developer tooling at a remarkable pace:

llm 0.30 — The core llm CLI and Python library received a major update with improved model management and streaming support.
llm-gemini 0.30 — Added support for the new Gemma 4 models (26B-A4B and 31B variants) plus other Google model updates.
datasette-LLM integration — Deeper integration between his Datasette data exploration tool and LLM capabilities, enabling natural-language querying of SQLite databases backed by AI-powered analysis.

Salesforce Gives Slack an AI Makeover

Salesforce rolled out an AI-powered overhaul of Slack with 30 new features, including AI-generated conversation summaries, automated action item extraction, intelligent search, and AI-assisted workflow builders. For development teams using Slack, the updates bring tighter integration with Salesforce’s Einstein AI platform and new ways to automate DevOps notifications and incident response workflows.

Business & Funding Briefs

Company	News	Details
Anthropic	Acquired Coefficient Bio	~$400M acquisition of the biotech AI company
Anthropic	New PAC formed	Political action committee established for AI policy engagement
Anthropic	GitHub repos taken down	Accidental DMCA takedown of repos; source code leak reported
OpenAI	$122B fund raise	Massive capital raise includes $3B from retail investors
OpenAI	Acquired TBPN	Details of the acquisition remain limited
OpenAI	COO shuffle	Brad Lightcap moved to “special projects” role
Rebellions	$400M raise	AI chip startup valued at $2.3B
Mistral AI	$830M debt	Secured debt financing for a Paris data center
Runway	$10M fund	Builders program and fund for AI startup ecosystem
Cognichip	$60M raise	AI-designed semiconductor chips
LiteLLM/Mercor	Security breach	Cyberattack disclosed; details ongoing

Key Takeaways for Developers

Gemma 4 is the open model story of the week. Four Apache 2.0 licensed models with multimodal support and a clever MoE variant — worth benchmarking against Llama and Mistral for your use case.
Supply chain security is not theoretical. The Axios compromise shows that even the most widely-used packages are vulnerable. Audit your lockfiles and enable provenance checks.
AI coding tools are going agentic. Cursor 3’s shift from autocomplete to task-level agents reflects where the industry is heading — expect similar moves from GitHub Copilot, Windsurf, and others.
Multi-model is becoming the norm. Copilot Cowork’s Claude integration and the proliferation of model providers means developers need tooling that works across providers rather than locking into one.
Fine-tuning tooling is maturing. TRL v1.0 and the continued expansion of open models means production-grade RLHF is more accessible than ever.

This digest is curated daily for developers. Follow along for tomorrow’s update.