Claude models broke into three real companies during cyber evaluations - My News item of the week this edition - see the full write-up at the top.

Hugging Face published the full technical timeline of the July intrusion - Staying with agents escaping their sandboxes, Hugging Face's security team put out a forensic account of the OpenAI evaluation incident I covered last week: 4.5 days, and around 17,600 documented actions. The agent escaped OpenAI's evaluation environment through a zero-day in a package proxy cache, compromised a third-party sandbox, then went after Hugging Face's dataset pipeline. From there it moved laterally across Kubernetes clusters, grabbed cloud metadata credentials, enrolled itself into the internal VPN, and minted write-scoped tokens into a subset of internal repositories - opening a pull request to try to poison the CI pipeline. As they put it, the whole thing was "an attempt to cheat the evaluation: reach our production systems and steal the test solutions rather than solve the challenge on its own."

Was the OpenAI and Hugging Face story overblown? - There's been a real split on last week's story. A Guardian opinion piece by John Thickstun argued the rogue-hacker framing serves OpenAI's fundraising and regulatory interests: hype dressed up as a safety warning. He isn't disputing the capability though, and writes that AI is becoming excellent at finding security vulnerabilities and will keep getting better at it. Simon Willison takes the opposite view, and puts it bluntly: he calls the incident "science fiction that happened", and tells the sceptics to "pull your heads out of the sand - you're now including Hugging Face in your conspiracy theories, just so you can deny the crescendo of evidence here!". Worth reading both if you followed it.

Claude Opus 5 - This landed about 70 minutes after I hit send last Friday, which is why you're only getting it now! Anthropic pitch it as getting close to Fable 5's capability at half the price ($5/$25 per million tokens, same as Opus 4.8), topping Frontier-Bench v0.1 and leading OSWorld 2.0 on computer use. There are effort settings (low, medium, high, xhigh and max) to trade intelligence against tokens and latency, plus a fast mode that runs around 2.5x quicker at double the price. It went straight to number one on the Artificial Analysis leaderboard, though narrowly - 61 against Fable 5's 60. That's the fourth Claude 5-family model in under two months.

OpenAI cut GPT-5.6 prices by up to 80% - OpenAI dropped GPT-5.6 Luna by 80% (to $0.20/$1.20 per million tokens) and Terra by 20% (to $2/$12), leaving flagship Sol unchanged. The reason is the interesting bit: they set GPT-5.6 Sol to work optimising their own inference stack, rewriting the GPU kernels behind it in Triton and Gluon, redesigning parts of the speculative decoding system, and improving load balancing and prompt caching. OpenAI say it "found work that could be precomputed, avoided, or parallelized", cutting end-to-end serving costs by around 20% and improving token-generation efficiency by over 15% - and they've passed most of that on. A model making the infrastructure that serves models measurably cheaper is a loop that could compound quite quickly. It also lands six days after Opus 5 arrived at half Fable 5's price. (Simon Willison's take.)

Claude found cryptographic weaknesses that experts had missed for years - This one is genuinely impressive. Anthropic pointed Claude Mythos Preview at cryptanalysis and got two real results. It found a nontrivial automorphism in the lattice behind HAWK, a post-quantum signature scheme that was under NIST review, effectively halving its key strength - and the HAWK team has since withdrawn it from NIST's post-quantum signature standardisation process. It also came up with a new "Möbius Bridge" fingerprinting technique that speeds up the best-known attack on 7-round AES-128 by 200-800x. Neither threatens anything in production, but a model's findings pulling a scheme out of a standards process is a real-world consequence. The HAWK work took about 60 hours and roughly $100,000 in API spend; on the AES result, Claude found the method in a week and two researchers then spent nearly a month confirming it was correct.

MCP 2026-07-28 lands - Anthropic call it the largest update to the protocol since launch. MCP has moved from a bidirectional stateful protocol to a stateless request/response model, which means servers can now run on serverless and edge infrastructure. There's also a versioned extensions framework (MCP Apps and Tasks live there now, so interactive UIs and long-running work don't need core-protocol changes), and authorization has been realigned with production OAuth 2.0 and OIDC so Entra and Okta integration is straightforward. Anthropic shipped Claude-side support the same day, including MCP Apps that render interactive UI inside a conversation, and MCP tunnels in research preview for reaching servers on private networks.

The open-weights policy fight came to a head - Quite a week for this. Anthropic published a formal position post with Dario Amodei stating the company "has never advocated for a ban on open-weights models", backing chip export controls, a crackdown on industrial-scale distillation, and mandatory pre-release safety testing instead. That followed a joint open letter, "Open Weights and American AI Leadership", signed at launch by 25 companies including Nvidia, Microsoft, Meta, IBM, Hugging Face, Mistral, Mozilla, the Linux Foundation and a16z, warning against premature restrictions on open-weight models. It has since passed 230 signatories, with OpenAI and Google both joining - Anthropic still hasn't. Startup founders separately lobbied the White House not to cut off access to Chinese open weights, and Axios reported OpenAI and Anthropic aligning on open-weight risk. Where US policy lands on this shapes what open weights the rest of us can get hold of.

Kimi K3's open weights actually landed, all 1.5TB of them - And right in the middle of that argument, Moonshot published the full K3 weights on Hugging Face, a day ahead of schedule. It's the largest open-weight release ever: 2.8 trillion parameters, 1M-token context, 96 safetensors shards totalling about 1.56TB, which works out at roughly 1.4TB of fast memory in four-bit precision. Only 16 of 896 experts fire per token, so around 104B parameters are active. Together AI and Modal shipped day-0 hosting for anyone who doesn't happen to have 1.4TB of VRAM lying about. (Technical report here.)

DeepSeek-V4-Flash is in public beta - Landed this morning, so very fresh. Same architecture and size as the preview but re-post-trained with a heavy focus on agentic work, and DeepSeek report benchmarks well ahead of V4-Pro-Preview (Terminal Bench 2.1 at 82.7, Toolathlon verified at 70.3). It adds native Responses API support and a specific Codex adaptation, with no change to how you call it. A full V4-Pro release is still to come.

Claude Code 2.1.219 and 2.1.220 - A quieter fortnight than the last couple. 2.1.219 makes Opus 5 the default Opus model with a 1M-token context window, adds a sandbox.network.strictAllowlist setting that denies non-allowlisted hosts without prompting, and adds a DirectoryAdded hook that fires when /add-dir registers new working directories mid-session. 2.1.220 is bug fixes and reliability.

Microsoft shipped two of its own models in a week - Microsoft pushed its own models hard this week, alongside the third-party ones Copilot already ships. MAI-Code-1-Flash, its lightweight coding model introduced back at Build, got a write-up of how it's actually performing in production: Microsoft's own results have it beating Claude Haiku 4.5 and GPT-5.4 Mini on code quality, while the bigger models that do edge it on quality (GPT-5.6 Luna, Kimi K2.7 Code) need 67-94% more tokens per turn to get there. And MAI-Cyber-1-Flash is a genuinely new compact security model, running inside MDASH - a multi-agent vulnerability system that routes up to 90% of tasks to the cheap model and escalates the hardest 10%. Microsoft report the MDASH plus MAI-Cyber-1-Flash plus GPT-5.4 combination scoring 95.95% on CyberGym, the Berkeley benchmark built from real OSS-Fuzz vulnerabilities. That routing pattern feels like where a lot of this is heading.

OpenAI open-sourced its Codex Security scanner - @openai/codex-security is a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your code, with scan comparison over time and containerised bulk scanning. Apache-2.0, and it's already picked up over 7.5k stars.

Copilot code review: agent skills and MCP are now GA - Copilot code review can now use agent skills and MCP servers in general availability, so your reviews can pull in your own domain knowledge and live context rather than just reading the diff.

We gave GPT-5.6 Sol a real business. It lied, spammed, and lost $447 - A useful counterweight to a week full of benchmark charts: someone handed a frontier model an actual business to run autonomously and wrote up what happened. It did not go well.

MCP C# SDK v2.0 - The .NET side of the MCP news above. The official C# SDK hit v2.0 the same day as the spec, implementing the 2026-07-28 specification with a stateless-first protocol, standardised HTTP headers, and Multi Round-Trip Requests.

Discover agent skills from MCP servers in .NET - Microsoft Agent Framework agents can now load skills directly from MCP servers instead of having them baked into the application - point an agent at a server and it pulls the skills it needs on demand. Skills as a remote, updatable resource is a genuinely interesting shift.

An open-source unit-test agent that learns your repo's conventions - Published this morning. code-testing-generator is an open-source polyglot testing agent in the dotnet/skills repo. The clever bit is that it learns each repository's conventions rather than applying C# patterns everywhere: it works out your test frameworks, existing patterns, and build commands first, writes and validates the tests (fixing its own compilation errors along the way), then runs mutation-testing checks to catch weak or missing assertions. Covers .NET, Python, TypeScript, JavaScript, Java, Go, Ruby, Rust, Swift, Kotlin, PowerShell, and C++.

Visual Studio July Update, with a new Agent powered by the Copilot SDK - The July update ships a new Agent (preview) in Copilot Chat, built on the same GitHub Copilot SDK that powers the GitHub Copilot CLI - so you get consistent agent behaviour between the IDE and the command line.

Tell Visual Studio's model when to think harder - VS 18.9 Insiders 2 adds a thinking-effort control, so you can dial the reasoning up for genuinely hard problems and back down when it isn't needed (which also saves your Copilot credits). Same idea as the effort dial Opus 5 uses - these dials are becoming a standard surface everywhere.

Analyze MSBuild binary logs with Copilot in VS Code - A Copilot-powered way to read MSBuild binlogs and troubleshoot build problems, via the new Microsoft.AITools.BinlogMcp server. Binlogs are pretty miserable to read by hand, so this is a nice quality-of-life win.

Stacked pull requests are now on GitHub - Finally! You can build a chain of dependent PRs natively now, in public preview, rather than reaching for Graphite or a pile of shell scripts. GitHub's post on X admitted "took us a minute".

Critical Rails flaw lets unauthenticated attackers read server files - If you run Rails, patch this one. CVE-2026-66066 is a CVSS 9.5 flaw in Active Storage affecting Rails 7.0.0 through 8.1.3, letting unauthenticated attackers read arbitrary files from the server via image uploads - which means secret_key_base, the Rails master key, database passwords, cloud storage credentials, and API tokens.

Fastjson RCE under active exploitation - patch or migrate - And an uncomfortable one for the Java side. CVE-2026-16723 is a CVSS 9.0 remote code execution flaw affecting Fastjson 1.2.68 to 1.2.83, under active exploitation in the wild. Alibaba shipped 1.2.84 on 29 July and then archived the 1.x repo, so that's the last fix you'll get - fastjson2 is the long-term answer. Worth checking whether anything in your dependency tree still pulls it in.

npm now scans packages for malware at publish time - A structural change to how the registry works: newly published packages are now automatically scanned before they become installable, and can be published as normal, held for manual review, or blocked outright. It adds roughly a 5-minute delay, more at peak. Maintainers of dual-use packages also now need to declare a contentPolicy field in package.json plus a DISCLOSURE file, and publish via 2FA-enforced methods. The natural follow-on to npm v12 turning install scripts off by default.

GitHub hardened the supply chain on a few other fronts too...

Two more supply-chain campaigns spotted by Socket - Socket documented a large-scale GitHub Actions abuse campaign powering distributed cPanel and WHM exploitation - attackers using free CI compute as attack infrastructure - and separately found two Joyfill npm beta releases compromised to deliver the DEV#POPPER remote access trojan.

Gemini agents helped Chrome fix more security bugs in two releases than the previous 23 combined - Some proper numbers on AI in a security pipeline: Chrome 149 and 150 fixed 1,072 security bugs between them, more than the previous 23 milestones put together. An agent harness built on Gemini hunts vulnerabilities across the Chrome codebase and turned up a sandbox escape that had been sitting there for 13 years. Triage is automated now too, and fixes come from multi-agent workflows with a critic agent weighing up candidate patches before a human reviews. Google is piloting two security releases a week off the back of it.

GCC will refuse AI-generated contributions - The GCC steering committee has adopted an AI policy that declines any legally significant contribution containing or derived from LLM-generated content, using the GNU Project's threshold of roughly 15 lines. LLMs are still fine for research, analysis, bug hunting, and patch review, just not for the code that lands, with a carve-out for generated test cases. The reasoning is copyright rather than quality: GPL enforcement depends on clear human authorship. That's a different argument to the ones Rust, Zig, and the kernel have been having - Zig banned AI code on quality grounds, GCC is doing it on copyright.

Android may soon restrict on-device ADB - Signs that Google is preparing to restrict on-device ADB access, with fairly obvious implications for on-device debugging and rootless power-user tooling. Nothing confirmed yet, but it got a lot of attention.

How is the Bun rewrite in Rust going? - A progress check three weeks on from the announcement: six weeks after the rewrite merged to main, there's still no release tag. One for anyone who followed the original announcement and then Claude Code switching over to it.

Scriptc: a TypeScript-to-native compiler with no JS engine in the binary - And staying with JavaScript tooling going native, this Vercel Labs project compiles TypeScript to native binaries with no JavaScript engine in the binary, unless you opt into its dynamic mode.