AI News — July 17, 2026

Model releases

• [2026-07-16] Google — Gemini 3.5 Pro misses its July 17 target; Bloomberg reports the flagship is “months behind schedule,” and Alphabet sheds ~$200B in market value. A day before the widely reported July 17 GA date, Bloomberg — citing people familiar with the matter — reported that Google is months behind on delivering Gemini 3.5 Pro, its most powerful model, because the company keeps taking more time to improve it, with coding capabilities in particular falling short of internal expectations. The reporting says the slippage has frustrated Google engineers, researchers, and managers who worry the company is ceding ground as Anthropic and OpenAI ship models that exceed Gemini’s. Google did not announce a GA; asked about status, it said only that it is “currently testing 3.5 Pro, an upgraded Flash model, and other models with partners.” Markets took the delay badly: Alphabet closed down ~4.4% on July 16, wiping out roughly $200 billion in market capitalization. It matters because the July 17 date has anchored this briefing’s watch list for over a week as the last unlaunched major summer flagship — today it lands not as a launch but as a confirmed, open-ended slip, and the stated reason (coding, not just token efficiency) is the exact axis on which Fable 5, GPT-5.6, and Grok 4.5 are already competing. (source, report, prior coverage)

  Teams that parked a model-selection call to benchmark Gemini 3.5 Pro against Fable 5 or GPT-5.6 now have nothing dated to wait for — and with the reason given as coding shortfalls rather than a fixed launch slip, the practical move is to stop treating it as imminent and design around the flagships already shipping.

Coding agents

• [2026-07-17] Anthropic — Claude Code 2.1.211–2.1.212 close a plan-mode permission bypass and add runaway-loop caps. Two releases across the window carry real safety-relevant fixes rather than cosmetics: 2.1.212 (July 17) fixes plan mode auto-running file-modifying Bash commands (e.g. touch, rm) without a permission prompt or SDK canUseTool callback, and fixes worktree creation following a repo-committed symlink at .claude/worktrees that could write files outside the repository. It also adds a session-wide WebSearch cap (default 200) and a per-session subagent-spawn cap (default 200) to stop runaway search/delegation loops, plus MCP calls over 2 minutes auto-backgrounding and a /resume session picker. 2.1.211 (July 15) neutralizes bidirectional-override, zero-width, and look-alike quote characters in permission previews relayed to chat channels so tool inputs can’t visually alter the approval message, and makes a PreToolUse hook’s ask decision floor auto mode for unsandboxed Bash. It matters because the plan-mode fix closed a genuine hole in the approval model — plan mode is the surface users trust to be read-only — and the homoglyph/bidi neutralization hardens exactly the human-in-the-loop confirmation step that agent permission systems lean on. (official)

  Both fixes target the confirmation step rather than the model — a reminder that in agentic tools the approval UI is itself attack surface, and worth a version bump for anyone running Claude Code unattended or in CI, where a skipped prompt has no human to catch it.

  For Security Engineers: If you’ve cleared Claude Code’s plan mode as a read-only investigation surface for your developers, 2.1.212 lands right on that assumption: before it, plan mode could auto-run file-modifying Bash like touch or rm with no permission prompt and no canUseTool callback — a gap in the exact control you were relying on — while the 2.1.211 change strips bidi-override and look-alike characters out of permission previews so a tool’s inputs can’t visually misrepresent what you’re approving.

Watch list

• Gemini 3.5 Pro — delayed past July 17, no new date — with the July 16 delay report (above), the target that led this list for a week is gone and Google has not published a replacement. All the headline specs — the 2M-token context window, Deep Think mode, and pricing — remain reported, never confirmed by Google, and there is still no model card. The signal to watch is now narrower: a Google post with an actual date and a published model card, not another leaked target. Reporting also points to an upgraded Flash model in partner testing that could ship first. (unconfirmed) (report, prior coverage)

  With the flagship un-dated, the nearer-term Gemini signal is that reported upgraded Flash model in partner testing — if it ships first, it’s something concrete to evaluate while Pro stays a set of leaked specs with no model card behind them.

• Fable 5 metered cutover (July 20) — Anthropic’s second extension keeps Fable 5 included at up to 50% of weekly limits on Pro, Max, Team, and eligible Enterprise seats through 11:59pm PT July 19; after that, access moves to usage credits at $10 / $50 per million input/output tokens. Anthropic still frames the meter as temporary pending capacity, with no date attached — so the planning assumption remains the meter. Watch whether a third extension appears before the 19th, and whether standard Enterprise seats can enable usage credits before the included allowance empties mid-session. (official, prior coverage)

  With two week-long extensions already behind it the date reads soft, but capacity — not price — is what’s driving the slips, so the move that pays off either way is benchmarking your heaviest Fable 5 paths against the $10/$50 meter before the 19th rather than counting on a third reprieve.

• GPT-5.6 first independent benchmarks — Sol/Terra/Luna are in broad GA use, but every public performance figure still traces back to OpenAI’s own numbers. Muse Spark 1.1, Grok 4.5, and Opus 4.8 now carry published scores on the same coding suites (SWE-Bench Pro, Terminal-Bench, DeepSWE); watch for the first neutral eval that runs those against Sol. (prior coverage)

  A neutral eval running Sol on SWE-Bench Pro and DeepSWE next to Opus 4.8 and Grok 4.5 is the piece still missing — until it lands, every GPT-5.6 coding claim rests on OpenAI’s own figures rather than a number you can line up against the field.

• MCP spec finalization (July 28) — the 2026-07-28 release candidate (stateless core, Extensions framework, Tasks, MCP Apps, authorization hardening) is in its validation window, with the Python/TypeScript/Go/C# SDKs updating against it in beta. The Streamable HTTP transport now requires the Mcp-Method/Mcp-Name routing headers that security analysts have flagged as fresh attack surface; list/read results also gain ttlMs/cacheScope caching fields. Watch for the remaining SDK support landing and any last header changes before the RC locks. (official, prior coverage)

  With the RC locking July 28, the practical gate for anyone building on MCP is whether the Python/TypeScript/Go/C# SDKs all reach stable support against the final headers first — a spec that locks ahead of its SDKs leaves implementers hand-validating the new Mcp-Method/Mcp-Name routing until support catches up.