AI News — June 24, 2026

Coding agents

• [2026-06-23] Anthropic — Claude Tag launched in beta for Claude Team and Enterprise, putting Claude into Slack as a teammate you @-mention into any thread: it reads the channel’s context, does the work, and posts back where everyone can see it. Two things distinguish it from a chat bot — it can schedule tasks for itself and pursue a project autonomously over hours or days, and it learns over time by following along in a channel, so it accumulates context instead of being re-briefed each time. Admin controls are central: a system administrator scopes which tools and data the model can touch per channel, and its memories stay scoped to those channels too. Anthropic says its own internal version already generates 65% of its product team’s code. It matters because it moves the agent from a tool you open to a participant that’s already in the room with the project’s history — and pairs that with channel-scoped, admin-defined access rather than a blanket grant. (official, source)

  Because it accumulates context by following a channel over time, where you add it matters as much as what you ask: Claude dropped into a room it has watched for weeks arrives already knowing the project’s history, while one summoned into a fresh thread starts cold — so teams will get more out of it by leaving it in the channels where decisions happen than by inviting it per task.

  For Software Developers: Say a database migration has been grinding through your team’s channel for a week. @-mention Claude there and, because it can schedule its own tasks and work over hours or days, it keeps chipping at the migration and posts progress back into the thread between your other work — and the per-channel access scope means it holds only the repos and tools that one project needs, not a standing grant to everything you can reach.

• [2026-06-23] Anthropic — Claude Code v2.1.187 added a sandbox.credentials setting that blocks sandboxed commands from reading credential files and secret environment variables, brought org-configured model restrictions into the model picker (a disallowed model now shows “restricted by your organization’s settings” rather than silently failing), and changed remote MCP tool calls to abort with an error instead of hanging for five minutes (override via CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT). It also fixed --resume failing with “No conversation found” after a run that produced no model turns, --json-schema / workflow structured-output bugs, and background jobs stuck in a “working” state. The sandbox.credentials block is the substantive part — it puts a deterministic wall between an agent’s sandboxed shell and the secrets on disk, so a prompt-injected or misbehaving command can’t read your keys out of .env or the environment. (official)

  A prompt-injected command that used to mean “rotate every key the agent could see” becomes, with this setting on, a logged and contained miss — the value is that it shrinks the blast radius of a bad command rather than trying to detect the bad command in the first place.

  For Security Engineers: Turn it on in the org’s managed Claude Code settings and every developer’s agent runs with sandboxed commands walled off from credential files and secret environment variables by default — a command coaxed into cat-ing a credentials file or echoing $AWS_SECRET_ACCESS_KEY comes back blocked, so credential isolation becomes a policy you ship once for everyone instead of trusting each engineer to keep keys out of the agent’s reach.

Watch list

• Fable 5 / Mythos 5 restoration — both remain suspended under the June 12 export-control directive, now twelve days on with no official restoration date; Anthropic’s notice still commits only to restoring access “as soon as possible,” and the included-plan window has now closed with usage-credit metering live since June 23 (the included days spent during a blackout no one could use). The newer signal is the path back: Anthropic’s updated consumer terms and privacy policy — reportedly taking effect July 8 — enumerate identity-verification data, which analysts read as the most likely mechanism for a US-users-first restoration that satisfies the directive without lifting it, while the broader negotiating track (the June 2 Executive Order’s covered-frontier-model framework) carries an underlying ~August 1 deadline. Watch for a restoration date and whether access returns gated by identity/nationality. (official notice, terms update, plan terms, prior coverage)

  Two dates now bracket the likely outcomes: a return on or near the July 8 terms change would point to the identity-verification path — US-users-first, gated by who you are — while one that slips toward the ~August 1 framework deadline would suggest a broader settlement that doesn’t sort access by nationality.

• Gemini 3.5 Pro (late June) — still a limited Vertex AI enterprise preview with GA targeted for June; with month’s end days away there’s still no model card, public benchmarks, or pricing for the promised 2M-token context and Deep Think mode. (prior coverage)

  With the June GA target now days away and still nothing testable published, the question shifts from what Deep Think can do to whether Google holds the date at all — watch for either a rate card this week or a quiet slide into Q3.

• xAI Grok V9-Medium — the ~1.5-trillion-parameter, Cursor-trained coding model is reportedly live in the consumer Grok product on X and SuperGrok but still has no API string or model card on x.ai, so nothing testable has shipped for anyone building on it. (prior coverage) (unconfirmed)

• MCP spec finalization (July 28) — the 2026-07-28 release candidate (stateless core, Extensions framework, Tasks, MCP Apps, authorization hardening, formal deprecation policy) is in its validation window; watch for the rest of the SDK support landing before the cutover. (official, prior coverage)