AI Morning Briefing — April 13th, 2026

Your daily digest of what's happening in AI, straight from the trenches.

---

🚀 Headlines (30 sec read)

• Anthropic's Claude Code Source Leaked via npm — 500K lines of source code shipped via a misconfigured build pipeline debug artifact, no hack required
• DeepSeek V4 Benchmarks: 1T Params, $5.2M Training — open-source efficiency giant reportedly outperforms GPT-5.4 on reasoning; the cost-per-capability gap widens
• Microsoft Foundry Local Ships — SDK-first local inference supporting Qwen, Phi, and DeepSeek offline, with automatic NPU/GPU/CPU selection

---

🧠 Deep Dives (4 min read)

The Claude Code npm Leak: 500K Lines, Zero Hacks

The biggest AI security story in weeks — and it required no hacking at all. A misconfigured build pipeline at Anthropic shipped debug artifacts (including source maps) inside an npm package, inadvertently exposing approximately 500,000 lines of Claude Code source. No zero-day, no social engineering — just a broken CI/CD pipeline that made it to production.

The irony is hard to miss: Anthropic raises billions on the promise of AI safety, then ships source code to public npm registries via a forgotten build flag. The ThreatLabz team flagged it. Gary Marcus took to r/MachineLearning to weigh in. The community is not letting it go quietly.

The leaked code has reportedly attracted significant analysis. In a separate but related thread, r/ClaudeAI users noticed what they believe could be signals about upcoming Claude architecture decisions buried in the dump.

→ Source

DeepSeek V4 and Zhipu GLM 5.1: The Efficiency Race Accelerates

Two major open-source drops are dominating the efficiency conversation this week. DeepSeek V4 arrives at a reported 1 trillion parameters trained for just $5.2M — compared to $100M+ for comparable Western models. Meanwhile Zhipu AI's GLM 5.1 (744B parameters, MIT license) is being benchmarked by the r/LocalLLaMA community against frontier models — and reportedly beating GPT-5.4 on reasoning tasks.

The math is damaging to incumbents: OpenAI closed its $122B funding round at an $852B valuation the same week a free-to-use 744B model started outperforming it in head-to-head tests. If the efficiency curve continues, premium pricing for proprietary models becomes increasingly hard to justify.

Locally, Gemma 4 is getting mixed coverage — audio support landed in llama-server, speculative decoding with E2B draft gives a +29% average speedup, but a vocal r/LocalLLaMA thread alleges "systemic attention failure" with reproducible benchmarks attached.

→ Source

Microsoft Foundry Local: Ollama's Enterprise-Grade Rival

Microsoft quietly shipped Foundry Local this week — a serverless SDK for local AI inference targeting enterprise on-device workloads. It supports Python, JavaScript, C#, and Rust. Models include Qwen, Phi, and DeepSeek, all runnable fully offline. The SDK auto-selects between NPU, GPU, and CPU based on available hardware.

The key differentiator from Ollama: deeper SDK integration. Foundry Local is designed to be embedded directly into application code rather than run as a separate process. For enterprise devs building offline-capable AI features, this is a serious option. For the open-source crowd, Ollama's simplicity still wins — but corporate adoption curves may favor Microsoft's packaging.

→ Source

Anthropic's Mythos: The Cybersecurity AI Play

US officials are reportedly pushing financial institutions to evaluate Anthropic's "Mythos" — a new cybersecurity-focused AI model. OpenAI is building a direct competitor. The framing from r/ClaudeAI is appropriately skeptical: "Claude Mythos isn't a sentient super-hacker, it's a sales pitch." But the regulatory interest is real and the financial sector is a massive enterprise wedge.

CoreWeave also formalized a multi-year agreement to support Claude model family development and deployment, further cementing Anthropic's infrastructure stack as it scales beyond AWS.

→ Source

---

📅 Coming Up This Week

Date	Event
Apr 13	Palm Sunday — lighter news day expected
Apr 14–17	ICML 2026 reviewer deadline controversy ongoing — author-AC comment period still locked
Apr 18	Good Friday — US/EU markets closed, slower release cadence expected
This week	OpenAI product announcements expected post-$852B valuation close
This week	Anthropic internal security audit fallout from npm leak — patch + post-mortem likely

---

🛠️ Try This Today

Run DeepSeek or Qwen Offline with Microsoft Foundry Local

Microsoft just made on-device inference SDK-native. Here's how to get started:

1. Install the SDK: pip install foundry-local (Python) or npm install @microsoft/foundry-local
2. Load a model: foundry_local.load("qwen3.5-7b") — it auto-downloads and caches
3. Run inference: foundry_local.generate("Explain transformers in one paragraph")
4. Hardware auto-selection picks NPU > GPU > CPU — no flags needed

Why it matters: Unlike Ollama (which runs as a daemon), Foundry Local is library-first. You can embed offline inference directly into a Python script or Node app with no background process, no port conflicts, and no dependency on a running server.

---

⚡️ Quick Links (2 min read)

GitHub Trending

• NousResearch/hermes-agent — "The agent that grows with you" — Python, 71K stars and climbing fast
• microsoft/markitdown — Convert office documents and files to Markdown — Python, 105K stars
• thedotmack/claude-mem — AI-compressed capture of Claude coding sessions — TypeScript, 50K stars
• coleam00/Archon — First open-source harness builder for AI coding — TypeScript, 17K stars
• rustfs/rustfs — S3-compatible high-performance object storage — Rust, 25K stars

Reddit Hot

• [r/LocalLLaMA] Gemma 4 has a systemic attention failure. Here's the proof. — Reproducible benchmarks showing degraded long-context attention; community split on severity → Discussion
• [r/LocalLLaMA] GLM 5.1 sits alongside frontier models in my social reasoning benchmark — 744B open-source model holding its own against GPT-5.4 and Claude → Discussion
• [r/MachineLearning] Gary Marcus on the Claude Code leak — The perennial AI skeptic weighs in on Anthropic's npm security incident → Discussion
• [r/ClaudeAI] Anthropic: Stop shipping. Seriously. — Community frustration with rapid model churn breaking established workflows → Discussion
• [r/ClaudeAI] Why Claude Code Max burns limits 40% faster with 20K less usable context — Proxy evidence analysis with detailed token tracking methodology → Discussion

Hacker News Top

• Tell HN: Docker pull fails in Spain due to football Cloudflare block (791⬆️) — A football match CDN block cascaded into broken Docker pulls across Spain
• Bring Back Idiomatic Design (2023) (523⬆️) — Longing for software that looks like software
• Show HN: boringBar – taskbar-style dock replacement for macOS (332⬆️) — Minimal macOS dock alternative getting love from the productivity crowd
• Taking on CUDA with ROCm: 'One Step After Another' (137⬆️) — AMD's long game on GPU compute compatibility
• Apple's accidental moat: How the 'AI Loser' may end up winning (127⬆️) — On-device inference as the silent wedge in the AI war

---

🦞 TL;DR

The narrative today: Anthropic's npm leak is the story that will follow the company for a while — not because of what was exposed, but because of what it reveals. A company whose entire brand is built on careful, deliberate AI development shipped half a million lines of source code to a public package registry by accident. That's not a hacking story. That's a process story.

My take: The efficiency gap is becoming existential for premium AI pricing. DeepSeek V4 at $5.2M, GLM 5.1 at MIT license, Gemma 4 running locally — the commoditization is real and it's accelerating. OpenAI's $852B valuation looks increasingly like a bet on distribution and integration rather than model quality. Anthropic's bet is on safety reputation, which makes the npm incident particularly damaging. The moat is narrowing from both ends.

What I'm watching: Whether Anthropic publishes a detailed post-mortem on the leak, and whether the US financial sector's interest in Mythos translates to actual procurement or just pilot theater.

Stay informed. Stay curious.