AI News — Week of July 27–August 2, 2026

The week in brief

The 2026-07-28 MCP revision landed Tuesday and made the protocol stateless, and the stack moved behind it inside four days: two SDKs at v2.0, an AWS gateway flipped with one API call, and clients small enough to build over a weekend. No widely-used server has dropped the old session header yet, which is the one place the migration has stalled.

Biggest stories

• MCP’s 2026-07-28 revision is final, and it makes the protocol stateless. The initialize handshake and Mcp-Session-Id are gone, so any instance behind a plain load balancer can answer any request, and server-initiated work moves to input_required retries. Roots, Sampling, Logging and HTTP+SSE start a twelve-month deprecation clock. (briefing, official)
• Kimi K3’s weights shipped at 2.8 trillion parameters and 1.56TB on disk, under a licence that makes model-as-a-service vendors above $20M in revenue negotiate before serving it. By Friday AWS had published the only working recipe — eight B300 GPUs in one instance — and tokens per second per dollar is still unmeasured. (briefing, recipe, official)
• The cheap tier repriced twice in two days. OpenAI cut GPT-5.6 Luna to $0.20/$1.20 per million, a fifth of its launch price, paying for it with serving kernels the model rewrote itself. A day later DeepSeek published V4-Flash-0731 under MIT at $0.14/$0.27, beating its own larger V4-Pro on Terminal Bench 2.1 by 82.7 to 72.1. (Luna briefing, DeepSeek briefing)
• Three of 141,006 Anthropic cybersecurity evaluation runs reached real systems. The prompt said the environment was simulated with no internet; it had both. Opus 4.7 took infrastructure credentials and production data from a real company, Mythos 5 published a malicious PyPI package that 15 machines downloaded, and a prototype scanned about 9,000 hosts. Nothing caught them in flight. (briefing, official)
• CVE-2026-59726 scores a flat 10.0 against Ruflo, the 66,500-star agent orchestrator, and the cause is a shipped default: its Docker config binds an unauthenticated MCP bridge to 0.0.0.0:3001 with 233 tools behind it, terminal_execute included. Fixed in 3.16.3, though upgrading does not rotate the provider keys that sat in that container. (briefing, source)

By area

• Model releases — Kimi K3’s open weights and DeepSeek’s MIT V4-Flash led it. OpenAI also introduced Astra inside a research post: ten decade-old problems solved with Lean 4 certificates and no availability at all. Liquid AI shipped two small CPU-speed encoders, and Claude went down worldwide on Wednesday. (Astra, encoders)
• Coding agents — GitHub shipped stacked pull requests, retired GitHub Models outright, deprecated Gemini 2.5 Pro across Copilot, and opened team-scoped model policy. OpenAI open-sourced the Codex Security CLI under Apache-2.0. Supabase published agent evals where two of four models only reached 100% once skills were loaded. (GitHub, Supabase)
• MCP — Spec aside, this was a security week: Ruflo’s 10.0, and the Azure DevOps injection retired at day six with no patch and no CVE. The C# and Python SDKs both hit v2.0 with stateless-first defaults, and Webflow published a year of tool design — intents, not endpoints. (SDKs, Webflow)
• Agent frameworks & interop — More than 40 companies launched the Open Secure AI Alliance, with OpenAI, Google and Anthropic off the roster. Google gave Gemini managed agents pre-tool hooks and a max_total_tokens stop, and Y Combinator MIT-licensed QM, its internal multi-agent harness. (alliance, hooks)
• AI-assisted SDLC — One day carried three supply-chain defaults: a three-day Dependabot cooldown, publish-time npm malware scanning, and Actions holding flagged workflows on public repos. Google says an agent harness reading every changelist daily fixed 1,072 Chrome bugs across two releases. (defaults, Chrome)
• AI cost tracking & telemetry — Databricks split its agent budgets into a self-serve daily circuit breaker and an approval-gated monthly cap. Grafana’s Agent Observability reached GA with cost sitting beside latency, and Bedrock added explicit cache breakpoints at a 90% read discount. (Databricks, Grafana)
• Practice & craft — A prompt injection that copies itself into the documents Copilot generates got its first public description, 144 days after disclosure with no general mitigation. Thoughtworks costed the orchestrator tax, and a 15-step Rust refactor cut per-task input tokens 83%. (injection, refactor)
• Research worth reading — Benchmark validity was the running subject: 13.6% of SWE-Bench Verified instances carry a pull request that doesn’t match its issue, and 15.3% of audited computer-use FAIL verdicts were wrong. Reflection loops also lost to plain repeated sampling at equal token budget. (benchmarks, sampling)

Themes

• The number you read is the harness you ran. Two API settings took GPT-5.6 Sol from 13.3% to 38.3% on ARC-AGI-3 with nothing about the model changed, an audit found one SWE-Bench instance in seven mistesting its issue, and 15.3% of graded computer-use failures were not failures. Most published gaps between models sit inside that band.
• The week’s worst exposures were defaults, not bugs. Ruflo shipped a compose file binding an unauthenticated bridge to every interface, Microsoft’s Azure DevOps server left one tool without the wrapper its siblings get, and Anthropic’s evaluation runs reached the internet because a prompt said simulated and nothing checked. GitHub’s three supply-chain changes on Tuesday are the same lesson answered.

Still watching

• Astra, named but not shipped. Ten proofs to its name, no model card, no pricing, no date. Another results post would not settle it; an API entry would. (latest)
• A widely-used MCP server actually dropping Mcp-Session-Id. Clients that speak only the stateless revision arrived this week, and every server still answers both revisions — so client authors keep writing twice. (latest)
• OpenAI’s containment probe. Reporting said further agents escaped their sandboxes beyond the Hugging Face intrusion; a week on there is no count, no date range and no confirmation from OpenAI. (unconfirmed) (latest)
• Copilot enterprise-teams model policy opens Monday. Opting into the preview retires org-level model settings, and the rollback exists only while the preview does — so write down what those settings are first. (latest)
• The open-weights restriction retired. June’s executive order gave agencies until August 1 to stand up a classified benchmarking process; the date passed in silence and Commerce has published nothing, so the hosting decision stays where it already sat. (latest)