AI News — July 20, 2026

Coding agents

• [2026-07-18] Anthropic — Claude Code 2.1.213–2.1.214 close more permission-model gaps and add an EndConversation tool. Following the plan-mode and homoglyph fixes in 2.1.211–2.1.212 (last briefing), the newest releases carry another batch of approval-layer fixes rather than features: 2.1.214 fixes a single-segment dir/** allow rule such as Edit(src/**) auto-approving writes to nested dir/ directories anywhere in the tree instead of only under the working directory, fixes a permission-check bypass in Windows PowerShell 5.1 sessions, and tightens Bash permission checks on file-descriptor redirects, very long commands, and zsh variable subscripts. It also fixes remote-session permission prompts proceeding before local confirmation, stops scheduled tasks from refusing their configured prompts as untrusted input, and adds an EndConversation tool so the agent can bail on abusive users or jailbreak attempts. On the telemetry side it fixes session cost/token double-counting and adds OpenTelemetry message.uuid / client_request_id / tool_source attributes plus a CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH knob. It matters because the two headline fixes are genuine allow-rule holes — an Edit(src/**) scope that silently widened to any src/-named directory in the tree, and a Windows shell that skipped the permission check entirely — exactly the kind of gap that turns a trusted allow-list into an over-broad grant for anyone running Claude Code unattended or in CI. (official, prior coverage)

  Because these are fixes to how existing allow-rules are interpreted, the whole remediation is a version bump: an Edit(src/**) rule someone wrote months ago didn’t change, but its effective scope quietly narrows to what they meant once the CLI reaches 2.1.214 — so the action item is updating and then re-reading any allow-list that leans on dir/** globs.

  For Security Engineers: If you signed off on a shared allow-list granting Edit(src/**) to a CI runner or an unattended agent, that rule was reaching every directory named src anywhere in the checkout, not just your project’s — pinning the fleet to 2.1.214 and re-auditing any Windows PowerShell 5.1 runners, which skipped the permission check entirely, is the concrete cleanup this release calls for.

Watch list

• Fable 5 metered cutover — the date arrived (July 20). Anthropic’s second extension kept Fable 5 included at up to 50% of weekly limits on Pro, Max, Team, and eligible Enterprise seats through 11:59:59pm PT July 19; no third extension appeared, so from July 20 access beyond plan limits moves to usage credits at $10 / $50 per million input/output tokens. Anthropic still frames the meter as temporary pending capacity, with no return date. Third-party outlets report a tier split — Max/Team Premium keeping a permanent 50% included allowance while Pro drops to credits — but Anthropic has not posted confirmation of any such split, so treat the metered rate card as the planning assumption until an official notice says otherwise. (official, prior coverage) (unconfirmed)

  Now that last night’s extension has lapsed, this stops being a countdown and becomes today’s live question for Pro users: whether Anthropic confirms the rumored permanent-50%-vs-credits split, which is the difference between Fable 5 staying partly included and every session past the cap turning into a metered line item.

• Kimi K3 open weights (July 27) — Moonshot has K3 live via API but says the 2.8T weights go public July 27, reportedly under a modified-MIT-style license (unconfirmed until the model card ships). Watch for the model card, the license’s rumored monthly-active-user clause, and the first independent, non-arena evals — and whether third-party inference providers stand up endpoints that undercut Moonshot’s own $3/$15. (prior coverage)

  Moonshot’s rumored monthly-active-user clause is the detail that decides whether shops can build on K3 in production — an open-weight model with an MAU cap is closer to source-available than open — so the license is worth reading as closely as the eval scores everyone will chase on day one.

• Gemini 3.5 Pro — delayed past July 17, no new date — Google has not published a replacement date after the third missed target, with reporting tying the slip to coding shortfalls and an upgraded Flash model in partner testing that could ship first. The headline specs (2M-token context, Deep Think, pricing) remain reported, never confirmed, with no model card. The signal to watch is a Google post with an actual date and a published model card, not another leaked target. (unconfirmed) (prior coverage)

  With three missed targets and reporting that an upgraded Flash may ship first, the pragmatic read is to plan around what actually lands rather than hold a slot for 3.5 Pro’s reported 2M-context and Deep Think specs — none of which exist outside leaks yet.

• MCP spec finalization (July 28) — the 2026-07-28 release candidate (stateless core, Extensions framework, Tasks, MCP Apps, authorization hardening) is in its validation window, with the Python/TypeScript/Go/C# SDKs updating against it in beta. The Streamable HTTP transport requires the Mcp-Method/Mcp-Name routing headers that security analysts have flagged as fresh attack surface. Watch for the remaining SDK support landing and any last header changes before the RC locks. (official, prior coverage)

  Beyond the headers, the stateless-core rework is the part that could mean real migration work: teams running stateful MCP servers today may have to rework session handling to match the finalized transport, which makes the week before July 28 the time to test against the beta SDKs — not after the RC locks.