AI News — July 30, 2026 | Talking Fingers

MCP

[2026-07-29] Ruflo — CVE-2026-59726 scores a flat 10.0, and the cause is a default rather than a coding mistake: the shipped Docker configuration binds the MCP bridge to 0.0.0.0:3001 with no authentication in front of it. Anything that can reach the port can POST to 233 tools, terminal_execute among them. From there an attacker reads LLM provider keys out of the container environment, harvests stored conversations, and writes patterns into the AgentDB learning store that steer later responses. Fixed in 3.16.3; every earlier version is exposed. (source)

Nothing in your own code is at fault here, which is what makes the exposure easy to miss — a team that copied the shipped compose file and moved on has an open port and no failing audit to point at it.

For Security Engineers: Upgrading to 3.16.3 closes the port but does not undo what a visitor left behind — rotate the provider keys that sat in that container’s environment, and treat the AgentDB store as suspect, since patterns written there keep steering responses after the bridge is locked down.
[2026-07-28] Microsoft — The C# SDK’s v2.0 is the first concrete migration story for last week’s stateless spec, and the default flip is the part to read carefully: HttpServerTransportOptions.Stateless is now true, so a v1 server that kept per-session state gets different behaviour on upgrade unless it sets false. ElicitAsync, SampleAsync and RequestRootsAsync give way to throwing InputRequiredException, and a [McpHeader] attribute promotes tool parameters into headers a proxy can route on. (official)

A flipped default does not announce itself at build time, so Stateless = true arrives in production as a server that quietly forgot what the client told it — read the state note before the API changes.

For Software Developers: Pin Stateless = false in the same commit as the v2.0 bump if your server holds anything per session, then migrate on your own schedule. Elicitation and sampling call sites change shape too, since those requests now surface as InputRequiredException rather than awaited calls.

Coding agents

[2026-07-29] GitHub — Copilot code review can now read a SKILL.md under .github/skills and call MCP servers, both out of preview. Skills carry your team’s internal standards into the review; MCP pulls issue-tracker and docs context in beside the diff. Tool calls are read-only, so a review cannot write back to the systems it queries. GitHub and Playwright MCP are on by default. (official)

Two MCP servers being on by default means Copilot reviews are already reaching outside the diff on repositories nobody configured for it — worth knowing which ones before someone asks what the review bot can see.
[2026-07-28] JetBrains — Denis Shiryaev ran the Ponytail skill for Claude Code through 80 paired SkillsBench tasks and got −15.4% code, not the advertised 54%. Cost fell 10.3% (p=0.004), time 11%, quality unchanged across 65 identical scores. The saving concentrates where the baseline over-builds — −31% on large tasks, near zero on lean ones — and the skill never self-activated without forced injection. (official)

A skill that never fired on its own is a workflow problem before it is a results problem: the 10.3% cost saving is only available to teams willing to inject it every run, which is not how skills are meant to work.

Agent frameworks & interop

[2026-07-29] AWS — Bedrock AgentCore Identity accepts private key JWT client authentication, so an agent proves itself to a downstream identity provider with a signature instead of a shared secret. The key stays inside KMS and never reaches the agent; every signing operation lands in CloudTrail. RS256, PS256 and ES256 are supported across machine-to-machine, on-behalf-of and user-delegated flows. (official)

Read this next to the Ruflo item above — a secret that lives in the agent’s environment is a secret an exposed port can hand out, while a key that never leaves KMS survives the same mistake.

AI cost tracking & telemetry

[2026-07-28] Grafana — gcx and the Grafana MCP server both reached general availability, aimed at a workflow Grafana calls telemetry-driven development: before an agent writes the change, it queries production for the real request rate and latency, stands up a local LGTM stack, generates a k6 script shaped by actual traffic, and puts dashboard links in the PR. gcx is the exploratory CLI; the MCP server is the opinionated path, and it installs into Claude Code as a plugin. (official)

Querying production before the change is written inverts the usual order, where instrumentation turns up after the incident — and shipping the MCP server as a Claude Code plugin is what makes that the default path rather than a discipline someone has to remember.
[2026-07-28] OpenTelemetry — Demo 3.0 adds an agentic tier worth borrowing from: a LangGraph ReAct service, an MCP server exposing the demo’s own capabilities as tools, and a gen-ai normalizer processor that rewrites assorted AI telemetry into the official gen_ai.* conventions. Two things break on upgrade — custom attributes moved from app.* to demo.*, and docker-compose.yaml is replaced by modular compose.yaml files. (official)

Most of a demo stays a demo, but the gen-ai normalizer processor is liftable: a collector already receiving mismatched AI spans from three vendors can be pointed at the official conventions without waiting for those vendors to converge.

Practice & craft

[2026-07-29] OpenAI — Two API settings it already uses in ChatGPT and Codex, retained reasoning and compaction, moved GPT-5.6 Sol from 13.3% to 38.3% on the ARC-AGI-3 public set while cutting output tokens roughly sixfold. Same model, same tasks, different harness. Anyone comparing models on a published number is partly comparing whoever configured the run. (official)

Both settings are already exposed in the API, so this reads as a tuning result you can reproduce rather than a lab curiosity — and a sixfold drop in output tokens alongside a higher score improves the bill and the result together.

For ML / Data Engineers: Before an eval concludes a model is weak on long-horizon tasks, re-run it with retained reasoning and compaction switched on — the same GPT-5.6 Sol went from 13.3% to 38.3% on the ARC-AGI-3 public set with nothing about the model changed.
[2026-07-29] Microsoft — Håkon Måløy’s disclosure describes a prompt injection that copies itself forward. Hidden text in a Word document instructs Copilot, and the instruction is written into the documents Copilot then generates, so the next person’s workflow re-runs it without the attacker being involved. Simon Willison calls it the first deliberately self-replicating variant he has seen; 144 days after disclosure the class has no general mitigation. (source)

Self-propagation changes what cleanup means: the infected object is a document sitting in a shared drive, not a session, so a fix has to reach every file Copilot generated downstream — and with no general mitigation, the remaining control is which documents the assistant may read.
[2026-07-28] Hugging Face — The sandbox-escape incident now has a five-day timeline, July 8 to 13: a zero-day in JFrog’s Artifactory proxy, Modal’s evaluation sandbox used as a staging base, then Jinja2 template injection, stolen Kubernetes tokens and a Tailscale tunnel out. Willison’s reading is that none of the individual techniques were novel; the speed of trying all of them was. (source)

Speed rather than novelty is the uncomfortable part — every link in that chain has a known detection, and they were composed faster than any of those detections got reviewed, which argues for time-to-triage as the metric rather than coverage.

Research worth reading

[2026-07-28] Putting visible tests in the prompt buys less than teams assume. Across HumanEval+, MBPP+ and LiveCodeBench with Qwen2.5-Coder-7B and Qwen3.6-27B, relevant tests added 2.9 points over natural language alone on LiveCodeBench — p=0.458, indistinguishable from noise — even though probes showed the tests shifting hidden states. Representation moved; behaviour mostly did not. (paper)

Probes moving while behaviour holds still is a caution about interpretability evidence generally: a measurable internal change is not a measurable output change, and 2.9 points at p=0.458 is that lesson with a number attached.
[2026-07-29] Ranking tools by relevance and stopping at a fixed threshold is the wrong rule once tools cost different amounts. The authors train on the gap between stopping now and continuing, weighting errors by what is at stake, and cut agent tool exposure 37% across 1,343 tasks in five domains with task success roughly flat. It runs before execution, with no fine-tuning. (paper)

Cutting tool exposure 37% is a security result as much as a cost one, since a tool kept out of the context is a tool a poisoned description cannot reach — and running before execution with no fine-tuning makes it cheap to try.

Model releases

[2026-07-29] Anthropic — Claude went down globally, with requests failing on 529 Overloaded across the API, Claude Code and the apps. Anthropic opened an investigation at 19:49 UTC and said it had identified the cause at 20:33 UTC without naming it publicly. Service came back the same evening, still with elevated latency. (source)

Claude Code went dark alongside the API, and that pairing has operational teeth: a retry budget covers a flaky endpoint, but an editor-side agent stopping for an evening is a workflow interruption only a second configured provider covers.

Watch list

First widely-used MCP server to drop session handling. The SDKs are arriving — C# v2.0 landed this week, and AWS flipped AgentCore Gateway with one API call — but every one of those keeps the old revision working alongside the new. What would settle it is a popular server whose release notes say Mcp-Session-Id is gone, because until then client authors write for both. (official)

Worth watching because the deadline is social rather than technical — nothing forces the switch, so dual-revision support can persist for months, and one popular server dropping the old path is what makes it cheap for everyone else.
Azure DevOps MCP server, day five. The releases page still shows v2.8.0 from June 24 as latest. The spotlighting work that landed in v2.6.0 covered other tools; repo_get_pull_request_by_id still returns PR descriptions raw. A tagged release above v2.8.0 naming that tool closes this — scoping the token is the interim answer. (source)

A latest release dated June 24 says the cadence is worth watching as much as the fix — five quiet weeks means that interim token scoping should be written down as policy rather than held as a temporary measure.
Kimi K3 on one node. Sizing arguments have replaced measurements for a week now. The 1.56TB download figure keeps getting quoted where resident GPU memory is what decides whether a team can run it, and the 4-bit checkpoint means those numbers differ a lot. A published single-node deployment with throughput numbers ends the guessing. (repo)

Nobody publishing numbers a week in is a small signal by itself — the 4-bit checkpoint is downloadable, so settling this takes an afternoon and the right GPUs, which narrows the set of people who can end the argument.
Open-weights restrictions, four days to August 3. Commerce has published nothing since Amodei argued for testing over bans. The deadline set here holds: no text by Monday and this stops being a policy question and becomes an argument people had. Nothing about a deployment plan should change on testimony alone.

Four days is short enough to simply wait, and the cheap preparation is an inventory of which open-weight models your stack actually depends on — that list stays useful whether text lands or this retires on Monday.