AI News — July 15, 2026

Coding agents

• [2026-07-14] GitHub — /security-review comes to the Copilot app, moving AI vulnerability scanning out of the CLI and into everyday coding workflows. The command runs an AI-driven security review over in-flight changes and surfaces likely vulnerabilities before they land, bringing the same scan GitHub shipped to Copilot CLI on June 10 into the Copilot app itself. It’s in public preview and available across Copilot Free, Pro, Business, and Enterprise. It matters because the CLI version reached only developers already living in the terminal; folding the review into the app is what puts pre-merge vulnerability scanning in front of the broader Copilot base, on the same surface where they already read diffs and drive the agent — closer to GitHub’s own code-scanning and Copilot Autofix stack than to a standalone linter. (official, CLI precedent)

  The load-bearing detail is when the scan runs: a review invoked on in-flight changes catches issues while the code is still a working-tree diff, before the PR and before CI, which is the cheapest point to fix them. Whether that translates into real signal rather than noise depends on precision — pre-merge scanners that over-flag get muted fast — so the number worth watching as this leaves preview is the false-positive rate, not the feature list.

  Because it runs as a slash command the developer types rather than an automatic gate on every push, coverage is opt-in per diff — so unlike GitHub’s push-triggered code scanning, whether a change gets reviewed comes down to whether the developer remembers to invoke it, which makes uptake a habit problem as much as a tooling one.

  For Software Developers: Working a change to an auth or upload handler, you type /security-review in the Copilot app before you open the PR and get the AI’s read on the diff while it’s still in your working tree — the same scan you’d otherwise only reach by dropping into Copilot CLI, now on the surface where you’re already reading the change and driving the agent.

Watch list

• Gemini 3.5 Pro (GA), July 17 target — two days out and still a limited Vertex AI preview, with no model card, published benchmarks, or pricing for the promised 2M-token context and Deep Think mode. Reporting continues to tie the date to a full architectural rebuild that scrapped the 2.5 Pro base, and to early-tester notes that Pro trails Fable 5 and GPT-5.6 on coding and long-horizon reasoning; Google has confirmed none of it. It is the only major summer flagship still entirely unlaunched, so the signal that this becomes real is a model card with published numbers landing before the 17th — not another date sliding into view. (unconfirmed) (prior coverage)

  Gemini’s problem two days out isn’t only the missing card: if the early-tester read that Pro trails Fable 5 and GPT-5.6 on coding holds up, even an on-time GA lands behind the field on the metric buyers weigh most, leaving the 2M-token window and Deep Think mode to carry the differentiation on their own.

• Fable 5 metered cutover (July 20) — Anthropic’s second extension keeps Fable 5 included at up to 50% of weekly limits on Pro, Max, Team, and eligible Enterprise seats through 11:59pm PT July 19; after that, access moves to usage credits at $10 / $50 per million input/output tokens, the top of the published rate card. Anthropic still frames the meter as temporary, pending capacity, with no date attached — so the planning assumption remains the meter. Watch whether a third extension appears before the 19th, and whether standard Enterprise seats can enable usage credits at all before the included allowance empties mid-session. (official, prior coverage)

  Two extensions in, each buying almost exactly a week, the July 20 date reads as soft — but the capacity constraint driving the slips could just as easily make this one hold, so betting on a third reprieve is the riskier read even though the pattern invites it.

• MCP spec finalization (July 28) — the 2026-07-28 release candidate (stateless core, Extensions framework, Tasks, MCP Apps, authorization hardening) is in its validation window, with the Python/TypeScript/Go/C# SDKs updating against it in beta. The Streamable HTTP transport now requires the Mcp-Method/Mcp-Name routing headers that security analysts have flagged as fresh attack surface; list/read results also gain ttlMs/cacheScope caching fields. Watch for the remaining SDK support landing and any last header changes before the RC locks. (official, prior coverage)

  Set aside the much-flagged routing headers and the new ttlMs/cacheScope caching fields are the quieter change with correctness stakes: once clients can cache list/read results on a server-declared TTL and scope, a tool list or permission set that changes server-side can go stale in the client until the TTL lapses — so how the SDKs honor and invalidate those fields is worth reading closely as the RC locks.