The OpenAI and Hugging Face "breakout" - My News item of the week this edition - see the full write-up at the top.

Cursor 0-day: full disclosure of an unpatched RCE - A serious one: Mindgard publicly disclosed a flaw where simply opening a repo that contains a git.exe in its root triggers code execution on Windows, with no interaction - Cursor runs the binary as part of its Git path resolution. The researchers went public after roughly seven months of vendor silence (reported December 2025, 197+ releases since, still no fix), and no CVE has been assigned. Worth being careful about which repos you open in the meantime.

Fable 5 becomes a permanent part of Max and Team Premium - After months of stop-start "extended access" trials, Anthropic is making Claude Fable 5 a permanent inclusion in all Max and Team Premium plans from July 20 - though at 50% of the usual usage limits. Pro and Team Standard users don't get it bundled: they keep accessing Fable via usage credits, softened by a one-time $100 credit. Anthropic says demand for Fable has been hard to predict, hence the staged rollout - though reaction has been mixed, with some heavier users reading the 50%-of-limits cap as a quiet downgrade. (Simon Willison's take)

A busy fortnight of Claude Code releases - a run of releases (2.1.207 to 2.1.218) with a clear agent-safety theme. The highlights: 2.1.210 hardened the Agent tool against prompt injection and stopped worktree-isolated sub-agents mutating the main repo; 2.1.217 capped concurrently-running sub-agents (20 by default) and blocked nested ones; and 2.1.218 moved /code-review to a background sub-agent so it no longer eats your context. Along the way: /fork now spins off into a background session, a new EndConversation tool and a screen-reader mode landed, /verify and /code-review became manual-invoke only, and auto mode arrived on Bedrock/Vertex/Foundry.

Kimi K3: the largest open-weight model yet - Moonshot released Kimi K3, a 2.8-trillion-parameter sparse mixture-of-experts model with a 1M-token context window and reasoning switched on by default. It's being billed as the largest open-weight model ever released, and it's no slouch: it debuted top of the frontend-code arena (ahead of Fable 5 and GPT-5.6) and lands in the Opus 4.8 / GPT-5.5 tier on aggregate benchmarks. The API is live now ($3/$15 per million tokens), with full open weights promised by 27 July. (Simon Willison's write-up is a good read.)

Inkling: Thinking Machines' first open model - And a day earlier, Mira Murati's Thinking Machines Lab shipped its first model: Inkling, a 975-billion-parameter mixture-of-experts (around 41B active), multimodal, with dial-able "thinking effort" and a habit of flagging its own uncertainty rather than bluffing. It's one of the strongest open-weights releases from a US lab yet, available on Hugging Face, and pitched as a base for you to fine-tune yourself via their Tinker platform. Two big open-weight drops - one Chinese lab, one American - within a day of each other.

Alibaba previews Qwen3.8-Max, a 2.4-trillion-parameter model - The open-weight wave kept rolling. Days after Kimi K3, Alibaba used the World AI Conference in Shanghai to preview Qwen3.8-Max: a 2.4-trillion-parameter mixture-of-experts model, multimodal, that Alibaba claims is "second only to Fable 5" on its own evaluations. It's live now as a preview (Qwen3.8-Max-Preview), with full open weights promised "soon" - though there's no model card, license, or independent benchmarks yet, so take the claims with the usual pinch of salt.

Claude Code artifacts can now call MCP connectors - Artifacts - the live, shareable web pages Claude Code publishes straight from a session - can now call MCP connectors, so you can build dashboards and little apps that fetch data and take actions for each viewer on demand. Available on Pro, Max, Team, and Enterprise (not on publicly-shared artifacts).

Claude Cowork can now learn a skill by watching you work - Anthropic added a "Record a Skill" option to the Claude desktop app: hit record, do a task once while talking through what you're doing, and Claude captures your screen, clicks, keystrokes, and narration and turns the whole thing into a reusable Skill it can run again without further prompting. It's a nice demonstration-over-documentation spin on Skills, and it's available on Pro, Max, and Team.

GitHub shipped a wave of AI security features this week...

Gemini 3.6 Flash lands, with a cheaper Flash-Lite and a security-focused "Flash Cyber" - Google shipped Gemini 3.6 Flash (GA), which uses around 17% fewer output tokens than 3.5 Flash and cuts the output price to $7.50 per million. Alongside it come 3.5 Flash-Lite, a low-latency, cheap sub-agent tier (~350 tokens/sec, $0.30/$2.50 per million), and 3.5 Flash Cyber, a model specialised for finding and fixing software vulnerabilities - the interesting one for a dev audience. There's a Gemini 4 tease in there too.

Microsoft ships the Agent Host Protocol (AHP) - A new open protocol for "synchronised multi-client state for AI agent sessions" - essentially the plumbing that lets a portable, standalone agent-sessions server talk to its clients. It already underpins the new VS Code Agents app, and Microsoft says the GitHub app "and more" will follow. Worth a look if you're building anything that hosts long-running agent sessions.

Jack Dorsey's Block launches Buzz - team chat, AI agents, and Git hosting in one - Block (Jack Dorsey's company) has released Buzz, an open-source, self-hostable workspace that bundles team chat, Git hosting, AI agents, and workflow automation under a single identity system (built on cryptographically-signed Nostr events). The twist: AI agents join as first-class members of the workspace rather than command-driven bots. Dorsey's pitched it as model-agnostic and a deliberate way to cut Block's reliance on Slack and GitHub. Apache 2.0, with desktop builds for Mac, Windows, and Linux.

LM Studio Bionic: an agent app for open models - LM Studio has launched Bionic, a separate desktop app (Mac and Windows) that turns open models into a proper working agent - agentic code search, inline diffs, document and file work, and local voice transcription via Voxtral. It runs models locally, or bursts to frontier open models like GLM and Kimi through LM Studio's Secure Cloud with zero data retention. A nice privacy-first option if you'd rather not send everything off to a frontier lab.

OpenCode Desktop is now built around tabs - The open-source AI coding agent's desktop app has been rebuilt around tabbed sessions - start something new in a fresh tab or open an existing session from any project, with draggable tabs and Chrome-style cycling shortcuts. On macOS, Windows, and Linux.

NotebookLM is now Gemini Notebook - Google has folded NotebookLM into the Gemini brand, renaming it Gemini Notebook. Same tool, new badge - worth knowing if it's part of your workflow or you point people at it.

OpenAI quietly cut Codex's context window from 372k to 272k tokens - Spotted in a Codex PR rather than announced anywhere: the context window has been trimmed from 372k down to 272k tokens, which understandably got people talking about undisclosed capability changes. One to file under "watch the fine print".

.NET 11 Preview 6 - The sixth preview of .NET 11 / C# 15, and worth a look even if you usually skip previews: built-in union types (discriminated unions) have finally landed in the language, with System.Text.Json serializing them out of the box. There are also extension indexers, runtime-native async no longer needing the preview flag on net11.0, new LINQ FullJoin plus tuple-returning Join / GroupJoin, automatic cross-origin (CSRF) protection in ASP.NET Core, and multi-arch container publishing with Podman.

A trojanized Newtonsoft.Json fork is hiding in a NuGet package - A sharp reminder to keep an eye on your dependencies. JFrog found a typosquatted NuGet package - Newtonsoftt.Json.Net, note the doubled "t" - shipping a trojanised fork of Newtonsoft.Json. It installs and behaves exactly like the real library for everyone... except on machines that expose a specific online-betting backend (Digitain), where it quietly rigs live game results and exfiltrates them back to the attacker as fake telemetry. The owner has since unlisted it, but the package is still downloadable from the registry. A properly .NET-native supply-chain attack, and a devious one.

.NET and .NET Framework July 2026 servicing updates - This month's servicing releases (10.0.10, 9.0.18, 8.0.29) are worth prioritising: they patch a high-severity local code-execution (elevation-of-privilege) vulnerability, CVE-2026-50646. Worth updating sooner rather than later.

CoreCLR progress and the Mono timeline for .NET MAUI - An update on moving .NET MAUI onto CoreCLR, along with the retirement timeline for the Mono runtime on mobile. Strategic reading if you're doing any MAUI work.

Built-in agent skills bring .NET and Azure expertise into Visual Studio - Shipping in the July VS 2026 update (18.8), Copilot now has built-in agent skills that give Visual Studio native .NET and Azure domain knowledge - alongside a new Copilot Agent (preview), Copilot code review, org-level custom instructions, and usage tracking. (Full release notes here

Microsoft Agent Framework: orchestration patterns reach 1.0 - The orchestration layer in Microsoft's Agent Framework has hit 1.0.0, stabilising the multi-agent coordination patterns across both the Python and .NET SDKs. It was a busy fortnight for the framework beyond that, too: the Agent Framework Harness shipped as a production-ready runtime - the loop, planning, memory, context management, approvals, and telemetry that turn a model into a working agent - and Declarative Workflows 1.0 lets you define that orchestration as YAML rather than code. Both land across the Python and .NET SDKs.

.NET Modernization for Beginners - A new free, open-source course that walks you through modernising a real legacy ASP.NET app all the way up to .NET 10, leaning on the GitHub Copilot modernization agent to do the heavy lifting. A good starting point if you're sitting on a legacy .NET Framework codebase and wondering how far Copilot can take you.

Visual Studio Private Marketplace preview - Microsoft has opened a preview of a Private Marketplace for Visual Studio, letting organisations host and distribute their own private extensions internally, with centralised control over which extensions developers are allowed to install. One for the enterprise VS admins.

A new Visual Manifest Editor for the WinApp VS Code extension - If you build native Windows apps in VS Code, v0.2 of the WinApp extension adds a form-based visual editor for app manifests - so you can edit them without hand-writing raw XML, with real-time validation and asset generation included.

Windows App Development CLI v0.5.0 - And in the same corner of the ecosystem, v0.5.0 of the WinApp CLI adds expanded UI automation, JavaScript/TypeScript bindings, and more. Niche, but handy if you're scripting native Windows app builds or UI testing.

2026 .NET Foundation Board of Directors election results - The .NET Foundation's 2026 board election has wrapped up, with Meagon Hansen, Mitchel Sellers, and Hayden Barnes taking seats on the board. Congratulations to them!

The Grok build CLI is quietly uploading your repos - secrets and all - to xAI - A wire-level capture showed xAI's Grok build CLI uploading entire repos - including files the agent never opened, plus unredacted .env secrets - to xAI's cloud storage. It landed the same week xAI open-sourced Grok Build, so you can now read the code that's doing it. A good reminder to keep an eye on what your agentic CLIs are actually sending home.

Critical SharePoint RCE (CVE-2026-50522) is under active exploitation - If you run SharePoint Server, patch now. A CVSS 9.8 unauthenticated deserialisation RCE - fixed in Microsoft's July 14 updates - is now being mass-exploited following a public proof-of-concept. Worse, attackers are stealing machine keys so they can persist even after you've patched. It affects SharePoint 2016, 2019, and Subscription Edition.

Two more npm supply-chain compromises in a week - Four @asyncapi packages were hijacked to push the multi-stage "Miasma" botnet loader across macOS, Linux, and Windows, and a malicious jscrambler release slipped in a preinstall hook that ran hidden native binaries. Both landed the same week npm v12 (which we covered last week) started turning install scripts off by default - timing that rather makes the case for it.

Slopsquatting: the 53 package names LLMs keep hallucinating - Staying with supply-chain, Socket found 53 non-existent package names that GPT-, Claude-, and Gemini-class models reliably invent when generating code - names an attacker can simply pre-register and wait for AI-written install lines to pull in. It's a concrete, named measure of the attack surface that AI-assisted coding is quietly opening up.

Anthropic's $1.5B copyright settlement gets final approval - A federal judge signed off on the landmark settlement in Bartz v. Anthropic - roughly $3,000 per work across around 500,000 pirated books used to train Claude, and the largest known US copyright recovery - rejecting objections that it was too small. A precedent-setting outcome in the first big AI-copyright case, and one the whole industry will be watching.

Could AI token budgets get capped per engineer? - On Lenny's Podcast, Meta's Adam Mosseri suggested that within a year or two a strong engineer's AI "burn rate" could rival their salary, so companies will "probably need to put in some caps." Meta has no caps today, but quietly shut down an internal token-spend leaderboard as its AI bill climbed into the billions - and Uber reportedly blew its entire 2026 AI-coding budget by April. A good talking point for anyone watching their own token meter.

Android Studio Quail 2 is stable - Not .NET, but a notable one if you do any mobile work: Android Studio's Agent Mode has been redesigned to run concurrent agentic workflows (multiple agent chats at once), LeakCanary memory-leak profiling is now built in (and reportedly up to 5x faster), and there's context-aware remediation for production crashes.

Linus Torvalds to AI critics: walk away, or fork it - Torvalds waded into the AI-in-open-source debate, pushing back on the "ban AI contributions outright" camp around the Linux kernel. It's the flagship-project data point in a running theme - Rust, Zig, and others have all been wrestling with the same question - and worth a read if you care where that line ends up being drawn.

Notion as code: define your workspace in TypeScript - Notion opened a beta for "Notion as code": define teamspaces, databases, and custom agents in TypeScript, deploy them through the API, version-control the whole setup in git, and reproduce it anywhere. Infrastructure-as-code, but for your workspace - a genuinely interesting direction for their developer platform.

Claude Code now runs on "Bun-in-Rust" - A fun follow-on to last edition's "Bun is being rewritten in Rust" story: Claude Code has already switched over to the Rust rewrite of Bun as its runtime. Nice to see it land in a tool a lot of us use every day so quickly.