AI News — July 22, 2026

Coding agents

• [2026-07-21] Anthropic — Claude Code 2.1.216–2.1.217 add subagent fan-out limits and keep closing worktree/symlink workspace-escape holes. After the 2.1.211–2.1.215 permission-hardening run (last briefings), these two releases shift from interpreting allow-rules to bounding what a single message can spawn and spend. 2.1.217 caps concurrently-running subagents at 20 by default (CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS), stops subagents from spawning nested subagents unless you raise CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH, and makes --max-budget-usd actually halt background subagents — once the cap is hit, new spawns are denied and running background agents are stopped. 2.1.216 adds a sandbox.filesystem.disabled setting (keep network-egress control without filesystem isolation) and fixes a quadratic slowdown that made long sessions stall for seconds. Both also patch a cluster of workspace-escape bugs: worktree-isolated subagents redirecting git into the shared checkout via git -C/GIT_DIR/GIT_WORK_TREE, background sessions not canonicalizing symlinked working directories (letting a session escape its workspace folder), /rewind restoring or deleting files through symlinks and hard links, workflow and scheduled-task writes following a .claude symlink to land outside the project, and Windows read-only commands reaching network paths without a permission prompt. It matters because the fan-out caps are the first hard limits on runaway multi-agent spawning and cost — a single prompt could previously launch unbounded background agents and keep spending past a configured budget — while the symlink/worktree fixes close the exact escape routes that make unattended and CI runs risky. (official, prior coverage)

  A workflow that quietly leaned on launching dozens of parallel agents can start throttling the moment a machine updates, since the 20-subagent cap and the no-nested-spawn rule are defaults rather than opt-ins — so the practical follow-up is to scan your automation for anything that assumed unbounded fan-out before 2.1.217 changes its behavior without you touching a config.

  For Security Engineers: A worktree-isolated agent redirecting git into the shared checkout via git -C/GIT_DIR, or a background session escaping its workspace folder through a symlinked working directory, were the concrete objections that kept autonomous coding agents out of CI — 2.1.217 closes both, so the follow-up is to pin runners to at least that version, switch on --max-budget-usd now that it genuinely halts runaway background agents, and re-run those symlink and git-redirect escape cases before clearing unattended use.

Watch list

• Kimi K3 open weights (July 27) — Moonshot has K3 live via API (kimi-k3, $3/$15 per million) but says the 2.8T weights go public July 27, reportedly under a modified-MIT-style license (unconfirmed until the model card ships). Watch for the model card, the license’s rumored monthly-active-user clause, whether third-party inference providers stand up endpoints undercutting Moonshot’s own pricing, and the first independent, non-arena evals. (prior coverage)

  With K3 already callable via API, July 27 changes what you can check rather than what you can use: open weights are the first point at which the 2.8T architecture and its claimed numbers can be inspected and reproduced independently, rather than taken on faith from a hosted endpoint.

• Gemini 3.5 Pro — still undated; an August window is rumored — after the third missed target (July 17) and Bloomberg’s “months behind schedule” report, Google has not published a replacement date, and reporting floats an August window with an upgraded Flash model in partner testing that could ship first. The headline specs (2M-token context, Deep Think, pricing) remain reported, never confirmed, with no model card. The signal to watch is a Google post with an actual date and a published model card, not another leaked target — and whether the upgraded Flash lands first as the first concrete evidence the pipeline is unblocked. (unconfirmed) (report, prior coverage)

  Google has now stopped publishing a replacement date at all rather than slipping to a new one — after three misses, that silence says more about the timeline than any leaked spec, and a Google post carrying an actual date is the only development worth revising a plan around.

• MCP spec finalization (July 28) — the 2026-07-28 release candidate (stateless core, Extensions framework, Tasks, MCP Apps, authorization hardening) is in its validation window, with the Python/TypeScript/Go/C# SDKs updating against it in beta. Security analysts continue to flag the stateless rework’s new surface — client-held state manipulation and a “hit-and-run” async-task DoS — on top of the Mcp-Method/Mcp-Name routing headers. Watch which of the four SDKs reaches parity last and any final header changes before the RC locks. (official, prior coverage)

  What makes July 28 matter is that it freezes the transport every SDK and server builds against — which also makes it the deadline past which the flagged surface (stateless client-held state, the async-task “hit-and-run” DoS) ships as-is rather than gets reworked, so the RC validation window is the moment to test against the beta SDKs, not after the lock.