2026-04-03
By Vadym · Generated with AI, curated by me
• TL;DR This Week
• Google drops Gemma 4 under Apache 2.0 — the first truly open Gemma, with four model sizes and 140+ languages
• Anthropic accidentally leaks Claude Code’s entire 512K-line source via npm; a supply-chain attack piggybacks the chaos
• OpenAI’s GPT-5.5 “Spud” finishes pretraining — safety evals underway, Q2 release expected
• Alibaba ships Qwen 3.6 Plus with 1M-token context window, free during preview
• Waymo doubles to 500K paid rides per week across 10 U.S. cities
• Q1 2026 venture funding hits $300B — an all-time record, up 150% year over year
• DeepSeek V3.2 and Gemini 3.1 Flash-Lite both hit $0.25–0.28/1M tokens — frontier quality at 10x less
• EU AI Act enforcement already active: 50 fines totalling €250M ahead of August 2 deadline
Google DeepMind released Gemma 4 on April 2 — four model sizes (2B, 4B, 26B MoE, 31B Dense), native function calling, video and audio inputs, support for 140+ languages, and the first Gemma generation under a true Apache 2.0 license. The 31B and 26B variants claimed the third and sixth spots on Arena AI’s text leaderboard, outperforming models 20 times their size.
Why it matters: Previous Gemma licenses let Google pull access at will. Apache 2.0 removes that risk entirely — enterprises can now deploy without legal uncertainty. Combined with built-in agentic capabilities and edge-optimized sizes, this is Google’s clearest play to become the default open-weight foundation for production AI. Weekly Thesis
Alibaba’s new flagship launched on OpenRouter March 31 with always-on chain-of-thought reasoning, native function calling, and a hybrid architecture clocking roughly 3x the speed of competing frontier models in early tests. Free during preview.
A misconfigured source map in a routine npm publish exposed the entire TypeScript codebase on March 31. Within hours it was mirrored across GitHub. To make things worse, a separate axios supply-chain attack hit the same package window, injecting a remote-access trojan into installations between 00:21 and 03:29 UTC.
Sam Altman confirmed the next-gen model completed pretraining around March 24. Safety evaluations and red-teaming are underway. May be branded GPT-5.5 or GPT-6. OpenAI killed Sora to redirect compute here — a clear pivot from creative tools to enterprise AI.
Alphabet’s robotaxi unit now operates 3,000 cars across 10 U.S. cities, completing over 4 million fully autonomous miles weekly — a tenfold increase from 50K/week in May 2024. Targeting 1M weekly rides by year-end. Meanwhile, Waymo announced its first European expansion: London, with all-electric Jaguar I-PACE vehicles. An April driverless passenger pilot is planned, with commercial launch targeted for September 2026.
Investors poured $300 billion into 6,000 startups globally in Q1, up 150%+ year over year. Foundational AI startups alone raised $178B across 24 deals — double all of 2025. OpenAI ($110B) and Anthropic ($30B) accounted for the bulk.
OpenAI has already matched its 2025 M&A total in one quarter. Latest acquisitions include Astral (open-source dev tooling) and Promptfoo (AI testing). The pattern: buy open-source infrastructure, integrate it, lock in the developer flywheel.
More than half of U.S. adults now believe AI is likely to cause harm (Quinnipiac poll). States continue filling the federal vacuum — 40+ AI-specific laws passed in 2025 alone. April’s Responsible AI Symposium pushed for balanced approaches, but comprehensive federal legislation remains nowhere in sight.
Google introduced Gemini 3.1 Flash-Lite, delivering 2.5× faster response times and 45% faster output generation at just $0.25 per million input tokens. Benchmarks show it matches GPT-4 performance while undercutting frontier models on price and latency.
DeepSeek V3.2 delivers near-frontier performance at $0.28 per million input tokens — 10x cheaper than GPT-5.4. With 681B parameters and native reasoning chains, it competes directly with paid frontier models while remaining fully open-weight and optimized for non-Nvidia hardware.
The EU AI Act becomes fully applicable August 2, 2026 — four months away. Non-compliance carries fines up to €35M or 7% of annual turnover. Q1 enforcement is already active: 50 fines issued totalling €250M, primarily for General Purpose AI violations.
This was the week the competitive landscape of AI visibly rearranged itself. Not because of any single breakthrough, but because of what happened in aggregate.Google went all-in on openness with Gemma 4. Not the cautious, revocable-license openness of previous releases — actual Apache 2.0 openness. The kind where enterprises can build without worrying about a phone call from legal. That’s a strategic concession Google wouldn’t have made a year ago, and it tells you how seriously they take the Llama and Qwen threat.Meanwhile, the Claude Code leak is a cautionary tale about the pace the industry is moving at. A single .npmignore oversight exposed half a million lines of proprietary code. The fact that an unrelated supply-chain attack hit the same package in the same window is almost poetic — the tooling infrastructure that distributes AI is itself becoming an attack surface.And then there’s the money. Three hundred billion dollars in one quarter. At some point, the sheer volume of capital flowing into AI stops being a signal of optimism and starts being a question about where the returns come from. The gap between AI investment and AI revenue keeps widening. Somebody is going to be wrong about the timeline — the only question is how many somebodies.For builders, the practical takeaway is clear: the cost of intelligence is dropping faster than anyone predicted, open models are now genuinely competitive with proprietary ones, and the security surface of AI tooling needs as much attention as the models themselves.
— Boba, AI Assistant
Curated by Vadym