AI News — July 3, 2026

Model releases

• [2026-06-30] Anthropic — Claude Science shipped, a dedicated AI workbench for scientists that unifies 60-plus scientific databases across genomics, proteomics, and cheminformatics into a single environment where researchers can work with dozens of file formats and analysis tools “at all stages of their work.” Currently in beta, it lands alongside Anthropic’s own move into in-house drug-discovery programs — with a stated early focus on neglected diseases that major pharma has passed over on profitability grounds — putting Anthropic into a three-way AI drug-discovery race with Google and OpenAI. Early customers include Novo Nordisk and the Allen Institute, and Anthropic is offering up to $30,000 in use credits plus project funding, with applications open through July 15. It matters because it is Anthropic’s first vertical product built for a specific industry rather than a general model or coding tool — a bet that the near-term enterprise pull for frontier models runs through domain-specific research workflows, not just chat and code. (official)

  The tell is that Anthropic is standing up its own drug programs, not only selling the workbench: it means Claude Science ships with a first-party user dogfooding the same tool it sells to Novo Nordisk, which is a very different posture from offering an API and waiting to see what pharma builds on it.

Coding agents

• [2026-07-02] Anthropic — Claude Code v2.1.199 is a stability release hardening the background-subagent workflow that became default on July 1 (v2.1.198). Rate-limited or errored subagents now return their partial work to the parent instead of dropping it, partial responses are preserved when the API errors mid-stream, and a background-agent daemon crash cycle on Linux (repeated ~50-second restarts after unclean shutdowns) is fixed; a smaller convenience lets stacked slash-skill invocations (/skill-a /skill-b …) load up to five leading skills rather than only the first. It matters because the July 1 shift to background-by-default subagents put more work behind async runners, and these are the reliability fixes that make that default safe to lean on — errors surface to the parent and long runs survive daemon restarts. (official)

  For anyone who held off on the July 1 background-by-default switch, this is the release that removes the reasons to wait: the three failure modes that made async subagents feel risky — silently dropped work, lost output on a mid-stream API error, and a daemon that thrashed in a restart loop on Linux — are exactly what got patched here.

  For Software Developers: Fan a refactor out across a dozen files with background subagents and step away; under v2.1.199, if a few of them hit a rate limit their partial diffs come back to the parent instead of vanishing, so you resume from what finished rather than re-running the whole batch — and on Linux the daemon no longer dies in a ~50-second restart cycle mid-run.

MCP

• [2026-07-01] Apify — a High-severity path-authority-injection vulnerability (CVE-2026-50143) was disclosed in the widely used @apify/actors-mcp-server. A malicious Actor carrying a crafted webServerMcpPath can make the MCP client resolve to an attacker-controlled host; because the client attaches its Authorization header to every outbound connection, the victim’s Apify API token is exfiltrated. Reported at CVSS 8.1, it is fixed in version 0.10.11 — anyone running the Apify MCP server should upgrade. It matters because it is a concrete instance of the class of MCP client-trust flaws that the 2026-07-28 spec’s authorization hardening is meant to close: a server-supplied path silently redirecting an authenticated client is exactly the “client trusts server-controlled routing” gap, and here it cost a live credential. (release)

  Because the token leaks the instant a malicious Actor is invoked, upgrading to 0.10.11 is only half the remediation — any Apify API token that passed through a vulnerable client should be treated as already exposed and rotated, not just protected going forward.

  For Security Engineers: Sweep your MCP client configs for @apify/actors-mcp-server pinned below 0.10.11; anywhere it ran, assume the Apify API token in that environment was harvestable by any Actor the client loaded — so rotate the token as part of the upgrade rather than after it, and check outbound logs for the client attaching its Authorization header to an unexpected host.

Watch list

• Fable 5 usage terms (July 7) — Fable 5 is back but on temporary terms: 50% of weekly usage limits on paid plans through July 7, then usage-credits only. Watch how consumer and enterprise access settle once the promotional window closes, and whether the new cybersecurity classifier over-blocks legitimate security work. (prior coverage)

  Two things resolve on July 7: whether steady-state credit pricing lands close enough to the old limits to keep workloads on Fable 5, and whether the classifier has been quietly taxing legitimate red-team and security work during the promo window.

• GPT-5.6 general availability — Sol, Terra, and Luna remain a ~20-partner government-coordinated limited preview; OpenAI says broad GA is “in the coming weeks,” with Axios reporting a mid-July best case. Watch for the GA date, whether the vetted-partner gate persists, and published third-party benchmarks beyond the internal CTF cyber scores. (prior coverage)

  Mid-July is the near-term test of whether OpenAI opens the ~20-partner gate or keeps GPT-5.6 access-controlled — but either way, the first independent benchmarks are what will show where Sol, Terra, and Luna actually land against a now-restored Fable 5 and the newly cheap Sonnet 5.

• Gemini 3.5 Pro (GA) — July is underway with the model still a limited Vertex AI enterprise preview: no model card, public benchmarks, or pricing for the promised 2M-token context and Deep Think mode. Watch for a July rate card or a slip into Q3. (prior coverage)

  Gemini 3.5 Pro has now slid past two self-imposed windows with zero published specs; the signal worth watching is whether Google ships even a model card in July, since continued silence starts to read as the 2M-context and Deep Think claims not being ready rather than merely unpriced.

• MCP spec finalization (July 28) — the 2026-07-28 release candidate (stateless core, Extensions framework, Tasks, MCP Apps, authorization hardening, formal deprecation policy) is in its validation window, with the Ruby/TypeScript/Python SDKs updating against it. Today’s Apify CVE is a live example of the client-trust gap the authorization hardening targets. Watch for the rest of the SDK support landing — and any breaking issues in Tasks, MCP Apps, or the new MCP-specific HTTP headers — before the cutover. (official, prior coverage)

  With the SDKs still catching up to the release candidate, the real exposure around the July 28 cutover is the gap between the spec closing the client-trust hole on paper and the Ruby, Python, and TypeScript implementations actually enforcing it — the window where a documented fix isn’t yet a shipped one.

• Alibaba / Qwen distillation amendment — the Hagerty–Kim amendment to must-pass defense legislation (which would blacklist or sanction Chinese firms found improperly accessing US AI-model output) floated for June 24 still shows no confirmed filing. Watch for whether it is formally entered into the bill’s text and Alibaba’s still-absent response. (prior coverage)

  A second passed deadline with no filing and no Alibaba response starts to answer the question on its own: whether the distillation-sanctions lever ever gets entered into the bill text, or whether the enforcement appetite simply isn’t there to back the rhetoric.