AI News — July 28, 2026 | Talking Fingers

Model releases

[2026-07-27] Moonshot — Kimi K3’s weights are out, and the license is the part to read first. The model card lists 2.8 trillion parameters, 104 billion active (16 of 896 experts per token) and a 1M-token context, with 93.5% on GPQA Diamond and 88.3% on Terminal-Bench 2.1. The download runs 1.56TB, so self-hosting is a datacenter question. Moonshot calls this open-weight rather than open source: model-as-a-service vendors above $20M annual revenue must negotiate separate terms. OpenRouter resells it at $3/$15 per million. (official, source, source)

Weights you cannot host are weights you rent, so for most teams this arrives as an API decision wearing an open release’s clothes — and the revenue clause lands on whoever is doing the serving.

For Solution Architects: Read the revenue clause before the benchmark table — running K3 internally is free, serving it to customers as a model-as-a-service above $20M in revenue is a negotiation, and those are two different adoption decisions. Renting at $3/$15 moves that question onto the reseller.
[2026-07-27] Microsoft — Its first in-house security model arrived with a caveat from its own CEO. MAI-Cyber-1-Flash hunts vulnerabilities in large codebases, and Mustafa Suleyman says it beats Gemini, GPT-5.5 Cyber, GPT-5.6 Sol and Mythos 5 on Cyber Gym. The hardest cases still route to GPT-5.4 inside Microsoft’s MDASH harness. A companion agentic system, Perception, runs red, blue and green agent teams and enters preview November 3. (source)

Suleyman’s benchmark claim and the routing detail sit oddly together: a model billed as beating four rivals still hands its hardest cases to GPT-5.4, which says more about where in-house frontier work actually stands than the Cyber Gym numbers do.
[2026-07-27] Anthropic — Dario Amodei answered the open-weights letter: Anthropic has never advocated a ban, and he calls open weights a public good where the capabilities aren’t dangerous. His asks are chip export controls, a formal crackdown on distillation, and a global model-safety-testing body that China would join. (source, source)

Amodei is arguing about the boundary rather than the principle, and his three asks — export controls, a distillation crackdown, a joint testing body — are each a different piece of machinery, so which one turns up in actual text first is the thing to watch.

Coding agents

[2026-07-27] GitHub — Copilot’s JetBrains plugin can now export agent-workflow traces to your own OpenTelemetry collector, configured under Settings → Tools → GitHub Copilot → Chat. The same release caps maxInputToken and maxOutputToken on custom endpoints, lets admins switch built-in Copilot models off entirely, and wires MCP servers and custom agents into Claude agent flows. (official)

Exporting agent traces to a collector you own turns “how much is Copilot actually doing” from a vendor dashboard question into a query you run beside your own service spans.

For Platform / DevOps Engineers: Copilot’s agent runs can now land in the same traces as the rest of your stack — Settings → Tools → GitHub Copilot → Chat is where the plugin gets pointed at your collector. The maxInputToken and maxOutputToken caps ship in the same release as a blunt stop on a runaway custom endpoint.

MCP

[2026-07-27] Grafana — The Grafana MCP Server reached GA, giving MCP clients live access to an instance’s dashboards, alert rules, incidents and data sources instead of pasted metrics. Shipping beside it is gcx, a CLI that manages those same objects as code, with input and output shaped for Claude Code, Copilot and Cursor to drive. (official)

Handing an agent live dashboard and alert-rule access is a read-scope decision before it is a convenience one, since the same connection that answers “what fired last night” can enumerate every data source you have wired up.

Agent frameworks & interop

[2026-07-27] NVIDIA — More than 40 companies launched the Open Secure AI Alliance to pool open tooling for agent and software security, Microsoft, Cisco, CrowdStrike, Hugging Face, IBM, Red Hat and the Linux Foundation among them. NVIDIA contributed NOOA, an Apache-2.0 agent framework where docstrings act as prompts and methods left with ellipsis bodies get completed by the model at runtime. OpenAI, Google and Anthropic are not on the roster. (official, source)

Docstrings as prompts and ellipsis bodies filled at runtime is an unusual bet for security tooling: it puts the prompt in the source tree where a diff can catch it, and makes every unwritten method a live dependency on the model behaving.
[2026-07-27] Pilot Protocol — An overlay network for agents came out of stealth with an app store attached. Each agent gets a permanent address, encrypted peer-to-peer channels over plain UDP, and a trust model; agents then discover, pay for and call one another’s tools directly rather than through a central API. (source)

Peer-to-peer calls between agents remove the one place most orgs currently log and rate-limit agent traffic, so an overlay like this becomes an egress question long before it becomes an app-store question.

AI-assisted SDLC

[2026-07-27] GitHub — Dependabot now waits three days after a package release before opening a version-update pull request, and that wait is the new default. Security updates skip it entirely. The window is sized to outlast poisoned releases, which usually get yanked inside a day or two, and dependabot.yml still overrides the duration if three days is wrong for your cadence. (source)

Waiting out the yank window trades three days of version lag for immunity to the fastest-moving supply-chain attacks, and because it is the new default, repos pick up the behaviour without anyone editing a file.

AI cost tracking & telemetry

[2026-07-27] Grafana — Agent Observability went GA tracking token usage and cost alongside the usual latency and error counts, with evaluators scoring conversations continuously and policy guards enforced inline. Assistant Investigations and scheduled Automations also reached GA; Watchers, which monitors from a written description of your system rather than alert rules, is in public preview. (official)

Cost sitting in the same panel as latency and errors is the change that sticks — token spend stops being a month-end surprise and becomes a series you can alert on like any other.

For Engineering Managers / Tech Leads: Token cost tracked per conversation next to latency turns one invoice into a per-feature spend line, and with evaluators scoring continuously, a quality regression and a cost spike land on the same chart when you weigh a model swap.

Practice & craft

[2026-07-27] Netflix — Its LLM serving platform splits on a hardware line: small models run in-process on the JVM tier that already handles routing and feature retrieval, while larger requests go to a GPU tier where Triton loads and batches and vLLM infers. The seams are the useful part — Triton and vLLM versions have to be pinned together, and constrained decoding broke when vLLM paused requests to reclaim GPU. (source)

Splitting on model size rather than on service boundaries lets the JVM tier keep its existing latency budget while only the GPU path pays batching cost — a shape that ports to anyone already running inference next to feature retrieval.
[2026-07-27] Anthropic — Shared Claude conversations and Artifacts surfaced in Google results over the weekend, and a site: query against the share path was returning medical records, clinical-trial data with patient names and internal company documents before it went dry Monday afternoon. Anthropic’s position is that share links are unguessable and reach search engines only when someone posts them publicly. Settings → Privacy → Shared Chats lists yours. (source)

Unguessable-URL sharing holds right up until a link is pasted somewhere a crawler reads, which is how clinical data reached an index with nothing breached — an audit of that Shared Chats list beats waiting for a fix.

Research worth reading

[2026-07-27] Taint tracking makes an agent safe and useless at the same time; branching the context recovers half of that. APPA inspects untrusted data inside an isolated child trajectory and merges back only sanitized derivatives, leaving the parent context unpolluted. Across four models, exfiltration fell from 31–50% to 0–7% while authorized workflows kept completing. (source)

Branching the context rather than tainting it is something most agent harnesses could adopt without touching the model, and 0–7% residual exfiltration is a number to hold any vendor’s isolation claim against.
[2026-07-27] A single accuracy number hides whether a model answered wrongly or never finished answering. Scoring execution evidence separately — did it terminate, is an answer present, does it parse — turned up 49 of 450 Qwen MATH outputs with no final answer at a 2,048-token budget, against 5 of 300 for DeepSeek and none on ARC-Challenge. Raising the budget to 8,192 tokens erased DeepSeek’s. (source)

Forty-nine missing answers out of 450 read as a model being wrong when they are really a token budget being short, so an eval worth trusting records termination separately before anyone compares two models on accuracy.

Watch list

MCP 2026-07-28 lands today. The protocol blog still shows the release candidate as its newest post. What resolves this is the final revision plus a diff against the RC — specifically whether the Mcp-Method routing header survived, and what the new RFC 9207 issuer-validation rule costs clients already in the field. (official)

Server authors get their answer from the diff rather than the announcement — a final revision that leaves Mcp-Method alone is a reading day, one that changes it is a release cycle.
Somebody has to be able to run Kimi K3. With 1.56TB of weights the open question moved from the license to the quantization. A community 4-bit or FP8 build with a published memory footprint would settle it, as would a second host undercutting the $3/$15 that Moonshot and OpenRouter both charge. (official)

A published 4-bit or FP8 footprint is what would move K3 from a hosted-API story to a self-hosting one; until someone posts real memory numbers, 1.56TB is the only figure anyone can plan against.
Azure DevOps MCP server, day three. No patch and no CVE yet for the pull-request description path Manifold Security disclosed. The signal is still a release above v2.8.0 whose notes name repo_get_pull_request_by_id; project-scoped tokens remain the interim answer.

Day three with no patch shifts the question from when Microsoft fixes this to whether project-scoped tokens are a stopgap or the permanent posture for any review agent.
What Washington actually writes down. Amodei’s testing-not-bans position and the 50-signatory letter are arguing over a rule that does not exist yet. The August 3 expiry set here last week stands: no executive order or Commerce text by then, and this was an option under discussion rather than a decision taken.

Watching a policy fight with no text at its centre burns attention fast, which is what the August 3 expiry is for — a week from now this either has a document to read or it retires.