<p><strong>TLDR:</strong> <a href="http://Claude.ai" target="_blank" rel="noopener nofollow">Claude.ai</a>, the API, and Claude Code are all showing elevated errors today, with the status page logging a 93.09% uptime record for April. Separately, researchers disclosed prompt injection attacks against GitHub Actions integrations at Anthropic, Google, and Microsoft — all three paid bounties and patched quietly, with no CVEs filed and no user notification. Google is contributing a gRPC transport layer to MCP, and OpenAI shipped a significant Agents SDK update with sandboxed workspaces and a portable Manifest abstraction for cloud storage backends.</p>
<hr>
<h2>Claude service disruption</h2>
<p><a href="http://Claude.ai" target="_blank" rel="noopener nofollow">Claude.ai</a>, the developer console, backend systems, and Claude Code CLI are all degraded as of today. The April status history shows this isn’t isolated — the service has logged multiple outage and degraded-performance events this month, landing at 93.09% uptime overall. For teams running Claude Code in CI or using the API in production workflows, that number is worth tracking against your own SLA requirements.</p>
<h2>AI agent prompt injection: bounties paid, users left in the dark</h2>
<p>Researchers from Johns Hopkins embedded malicious instructions in PR titles, issue bodies, and HTML comments to hijack GitHub Actions-integrated AI agents. Anthropic’s Claude Code Security Review, Google’s Gemini CLI Action, and Microsoft’s GitHub Copilot Agent all fell for it — leaking API keys and GitHub tokens. All three vendors paid bounties ($100, $500, and undisclosed respectively), patched quietly, and filed no CVEs. Users running older versions have no way to know they’re exposed. The structural problem here isn’t the specific bug — it’s that LLMs can’t reliably separate data from instructions, and there’s no established disclosure framework for AI agent vulnerabilities the way there is for traditional software.</p>
<h2>Google adds gRPC transport to MCP</h2>
<p>Google is contributing a gRPC transport layer for Anthropic’s Model Context Protocol, replacing JSON-RPC over HTTP/SSE with Protocol Buffers over HTTP/2. For teams already running gRPC-heavy microservice infrastructure, this removes the dual protocol stack and adds native bidirectional streaming. The MCP SDK is being refactored to support pluggable transports, keeping JSON-RPC as the default. Spotify has validated the approach internally. Worth noting: performance gains are negligible for low-frequency agent workflows, and the MCP description layer still does the heavy lifting — gRPC alone doesn’t give LLMs the semantic context they need.</p>
<h2>OpenAI Agents SDK gets sandboxed workspaces</h2>
<p>OpenAI shipped a substantial Agents SDK update: sandboxed workspaces that separate the agent harness from compute, a Manifest abstraction for portable workspace definitions across S3, GCS, Azure Blob, and Cloudflare R2, and native support for sandbox providers including E2B, Modal, Vercel, and Cloudflare. The harness is open source and configurable, with support for MCP tool use, <a href="http://AGENTS.md" target="_blank" rel="noopener nofollow">AGENTS.md</a> custom instructions, and durable execution via snapshotting. Credentials stay server-side, away from model-generated code. Currently Python-only; TypeScript is planned. Pricing is unchanged — tokens and tool use only.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Nginx UI CVE-2026-33032 (CVSS 9.8) actively exploited:</strong> The <code>/mcp_message</code> endpoint has no authentication, giving unauthenticated attackers full nginx config takeover. 2,600 instances exposed on Shodan; patch to v2.3.6 immediately.</li>
<li><strong>Claude Code finds 23-year-old Linux kernel heap overflow:</strong> Anthropic researcher Nicholas Carlini used a simple bash loop over kernel source files to surface multiple confirmed vulnerabilities in NFS, io_uring, futex, and ksmbd. Kernel security list volume jumped from 2-3 reports/week to 5-10/day.</li>
<li><strong>WordPress supply chain attack via Flippa acquisition:</strong> An attacker bought 31 plugins for a six-figure sum, waited eight months, then activated a backdoor using an Ethereum smart contract for C2 and cloaked SEO spam visible only to Googlebot. <a href="http://WordPress.org" target="_blank" rel="noopener nofollow">WordPress.org</a> forced an update but manual remediation of wp-config.php is still required.</li>
<li><strong>Fortinet FortiSandbox critical bugs (CVSS 9.1):</strong> CVE-2026-39808 is unauthenticated RCE via OS command injection; CVE-2026-39813 is an auth bypass via path traversal in the JRPC API. Public scanners already exist. Patch to 4.4.9+ or 5.0.6+.</li>
<li><strong>OpenTelemetry declarative config reaches stable:</strong> JSON schema, YAML config files, and in-memory representation are now stable. Language support covers C++, Go, Java, JavaScript, and PHP. Set via <code>OTEL_CONFIG_FILE</code> at startup; dynamic remote config is next.</li>
<li><strong>Eagle3 speculative decoding in vLLM:</strong> Benchmarks on gpt-oss-120B show 10-21% throughput improvement and 12-20% latency reduction even at 200 concurrent requests, contradicting the assumption that speculative decoding only helps at low concurrency. Sweet spot is 2-3 draft tokens.</li>
<li><strong><a href="http://Cal.com" target="_blank" rel="noopener nofollow">Cal.com</a> goes closed source:</strong> Citing AI-automated vulnerability scanning as a near-zero-cost threat, <a href="http://Cal.com" target="_blank" rel="noopener nofollow">Cal.com</a> moved its production codebase private and released a stripped MIT-licensed fork called Cal.diy for self-hosters.</li>
<li><strong>Cloudflare Project Think:</strong> New Agents SDK primitives including durable execution with fibers, sub-agents with isolated SQLite storage, persistent tree-structured sessions with forking, and sandboxed code execution via Dynamic Workers.</li>
<li><strong>Disaggregated LLM inference in production:</strong> Prefill is compute-bound (90-95% GPU utilization), decode is memory-bound (20-40%). Routing each phase to separate GPU pools yields 2-6x throughput gains and 15-40% cost reductions at Perplexity, Meta, and LinkedIn — but only makes sense above 16 GPUs with fast interconnects.</li>
<li><strong>LLM cost attribution complexity:</strong> Thinking tokens billed but invisible in responses, asymmetric cache pricing, context-length-based pricing tiers, and non-token billing for media all break naive cost tracking. Portkey open-sourced a pricing database covering 3,500+ models across 50+ providers.</li>
<li><strong>GitHub Actions supply chain hardening:</strong> A detailed post-mortem of the 2025-2026 SpotBugs-to-Trivy attack chain, with 12 concrete mitigations including SHA-pinned actions, OIDC replacing static AWS keys, and egress blocking via Harden-Runner.</li>
<li><strong>Microsoft Zero Day Quest pays $2.3M:</strong> Nearly 700 submissions, 80+ high-impact cloud and AI vulnerabilities including credential exposure, SSRF chains, and cross-tenant access issues.</li>
<li><strong>PyMongo 4.13+ native async API:</strong> Motor is no longer needed for async MongoDB in Python. Benchmarks under 500 concurrent users show async PyMongo at ~113 RPS vs ~49 RPS for sync, with median latency of 2,800ms vs 8,700ms.</li>
<li><strong>Cloudflare Workflows V2:</strong> Concurrency limits up from 4,500 to 50,000 simultaneous instances, creation rate from 100 to 300/second. Live migration of millions of existing instances completed with zero downtime.</li>
</ul>


Server-side development, system design, API patterns, and distributed architecture.

Backend Digest

Claude.ai and the API are experiencing elevated errors with 93.09% uptime logged for April. Researchers from Johns Hopkins disclosed prompt injection attacks against GitHub Actions-integrated AI agents from Anthropic, Google, and Microsoft — all three paid bounties and patched silently with no CVEs filed and no user notification, highlighting the lack of a disclosure framework for AI agent vulnerabilities. Google is contributing a gRPC transport layer to MCP, replacing JSON-RPC over HTTP/SSE with Protocol Buffers over HTTP/2. OpenAI shipped an Agents SDK update with sandboxed workspaces, a portable Manifest abstraction for cloud storage, and durable execution via snapshotting. Additional notable items include a critical Nginx UI CVE (CVSS 9.8) being actively exploited, Claude Code surfacing a 23-year-old Linux kernel heap overflow, a WordPress supply chain attack via Flippa acquisition, OpenTelemetry declarative config reaching stable, PyMongo 4.13 adding native async support, and Cloudflare Workflows V2 scaling to 50,000 simultaneous instances.

Claude API outage hits 93% uptime, AI agents get prompt injection CVEs with no public disclosure