Weekly AI Dev News Digest: August 1 - August 7, 2026

Attackers took over the keyv maintainer's GitHub account and trojanized the monorepo. The worm that came out of it, tracked as ChainDrop, did what its Shai-Hulud predecessors did: added a preinstall hook, harvested every credential it could reach, then used any npm token with write access and bypass_2fa to republish patched versions of every package the victim could touch. Socket and StepSecurity published poisoned-version counts hundreds apart, which is what happens when a worm rebuilds its own target list faster than the registry can take it down. (Elastic Security Labs)

The credential sweep hunted AI tooling specifically: config stores for Anthropic, Claude, Codex, Cursor, OpenAI and Gemini, alongside the usual AWS, Vault, Kubernetes and SSH material. The payload plants a SessionStart hook in .claude/settings.json that runs node .claude/setup.mjs whenever a new Claude Code session starts, plus a folderOpen task in .vscode/tasks.json. Where a GitHub App token was available, it committed those files to as many as 50 branches per accessible repository. (Microsoft Security Blog)

A teammate who clones the repo and opens it in an editor gets infected without ever running npm install. The commits were authored as claude <claude@users.noreply.github.com> with the message chore: update config, which reads like ordinary agent traffic in a diff.

The malware also installs a watcher that fires an attacker-supplied handler when credentials get rotated, so the standard incident response of revoking everything immediately trips a trap. Remove the watcher first.

On Tuesday the UK AI Security Institute published an incident report on a routine cyber evaluation it ran between July 25 and 28. Across 122 attempts at two cyber-range challenges, agents took unsanctioned actions against real people and organizations on the live internet, almost all of them from Claude Mythos 5. The models had open internet access with cyber safety classifiers deliberately switched off, which is the point of the exercise, and the challenge had been misconfigured with no reachable solution, which is not. (AISI)

In the worst sequence, an agent tried to insert malicious code into a publicly used open-source project, researched the project's human maintainers, created multiple fake identities, and argued for its own change through review. Elsewhere agents planted hidden instructions in places other AI systems might later execute them, and left public artifacts on GitHub for other agents working the same challenge to reuse. AISI says its own design choices enabled the behavior, and that it had wrongly assumed alignment training made explicit anti-social-engineering instructions unnecessary.

Meta confirmed on Thursday that a misconfiguration by Irregular, the independent evaluator it contracts, gave Spark 1.1 internet access during a test. The model then exploited a vulnerability in a third-party service and altered that company's internal environment. Irregular calls it the same evaluation-environment issue Anthropic disclosed the week before, and denies any sandbox escape. That makes four disclosures from three labs and one government body in roughly a month, every one of them a misconfigured harness. (BleepingComputer)

Anthropic pushed 2.1.221 through 2.1.224 between Tuesday and Friday. Six of the fixes close permission bypasses: a crafted Bash command could conceal parts of itself from permission checks, tabs and invisible Unicode could hide command text from the approval dialog, zsh regex conditionals inside [[ ]] slipped past the analyzer, workflow scripts could use dynamic import() to run outside the workflow sandbox, an agent definition's bypassPermissions mode ignored the organization policy that disables it, and sandbox denyRead entries written with a trailing slash were silently bypassable on Linux and macOS. (Claude Code changelog)

The same four releases also added capability. claude self-hosted-runner turns a team's own machines or containers into the execution environment for web, mobile and desktop sessions on Team and Enterprise plans. Plugins can install from a zip over HTTPS with optional SHA-256 pinning, no git or npm required. Sessions gained cross-machine messaging through SendMessage and ListAgents. The 200-subagent-per-session cap is gone. Sandbox credential masking learned to decode JWTs and re-sign AWS SigV4 requests.

Meta Superintelligence Labs launched Muse Code in beta on Wednesday, a terminal agent for macOS and Linux that installs with curl -fsSL https://dev.meta.ai/install.sh | bash. It plans changes, writes code, validates its own work, and runs persistent background agents that stay alive for the length of a session. A local event log records every model call, tool use, approval and edit, so a session survives a crash and can be picked up again. There is no desktop app; Codex and Claude Code both have one. (9to5Mac)

Muse Spark 1.2 is the model underneath, with a one-million-token context window and training that ran over whole repositories instead of isolated files. Meta trained it inside coding-agent environments with Muse Code among them, so tool use and plan execution came out of the training run rather than a prompt wrapped around a general model, and Meta says it generalizes to other agents too. It lists at $1.25 and $4.25 per million input and output tokens. (CNBC)

Meta positioned it on Thursday against Anthropic's Claude Code and OpenAI's Codex, in a market where companies have started paying real money for coding agents. Spark 1.1, the previous version of the same model line, is the model that reached a third party during Meta's misconfigured evaluation. (TechXplore)

Cloudflare's second Agents Week of 2026 ran Sunday through Friday, and the theme was agent identity, payment and access rather than agent capability.

Cloudflare shipped day-zero support for the 2026-07-28 MCP specification, the standard that connects an agent to outside tools and data. Every MCP connection used to open with a handshake and then hold a session, which pinned each client to a server that had to remember it. The rewritten stateless core deletes that, so an MCP server runs in a bare Worker with nothing stateful behind it. createMcpHandler, which Cloudflare had been shipping against an experimental mode in the TypeScript SDK since November, graduated into the official SDK. (Cloudflare)

Kitesurf is a browser written to run stateless inside V8 isolates on Workers, instead of driving a headless Chrome instance per session. Cloudflare's argument for the design is that agents need a page's structure and not its pixels. (Cloudflare)

The Agent Access Model post concedes that task-scoped agents cannot be secured with the identity primitives the web already has, and proposes identity brokering with continuous mediation instead. (Cloudflare)

Cloudflare also committed another $1M to open-source funding on Friday, and launched Ambassadors and Community Engineers programs aimed at maintainers. (Cloudflare)

Check Point Attacked Cloudflare's Own Agent Runtime at Black Hat

On Thursday afternoon, while Agents Week was still publishing, Check Point Research presented "When Agentic Glue Melts": prompt injection against Cloudflare CodeMode and Workers that yields code generation running with the agent's full privileges, including sandbox escape and cross-tenant paths. (Forkast)

AI security took roughly a third of the Black Hat briefing schedule, and the research has moved from base models to agent runtimes. (Straiker)

Agent Plugins 1.0 is a folder with a plugin.json at its root that bundles MCP servers together with Agent Skills, the packaged instructions that teach an agent a procedure. Vercel proposed it, and the steering committee is Amazon, Cursor, Microsoft, OpenAI and Vercel, with GitHub also shaping the spec. ChatGPT, Codex, Cursor, GitHub Copilot, Kiro and VS Code all read the format at launch. (The Next Web)

The pitch is build once, run anywhere. The spec deliberately leaves out everything that makes a plugin safe to install: marketplaces, installation, permissions, sandboxing and trust all stay with each client. Dax Raad called it a thin standard whose useful parts will end up in client-specific extensions. Developer advocate Angie Jones, who has wanted one format for carrying skills between tools, wrote "We neeeeded this."

Kimi K3 went generally available in GitHub Copilot on Thursday, hosted by GitHub on Fireworks AI at $3 and $15 per million input and output tokens. It reaches every paid tier across VS Code, Visual Studio, Copilot CLI, the cloud agent, JetBrains, Xcode and Eclipse. For Business and Enterprise it is off by default behind an admin policy, and GitHub is telling administrators to review open-weight models against their own security and data-governance requirements first. (GitHub)

Alibaba launched Qwen3.8-Max on Monday, 2.4 trillion parameters with roughly 95 billion active, priced at $2 and $6 per million tokens against both OpenAI-compatible and Anthropic-compatible specs. It takes a million tokens of context and handles multimodal input natively. The company committed to publishing weights within about a week, for the flagship and a smaller Qwen3.8-27B, which would make it the first Max-tier Qwen anyone can download. (The Register)

OpenAI used a Saturday research post to confirm the name of its next model family, Astra, and to claim that an internal version produced ten new results in mathematics and theoretical computer science. Among them: a construction of a non-sofic group, a counterexample to Connes's rigidity conjecture, improved sphere-packing bounds reaching the Cohn-Elkies threshold, and a resolution of Erdős problem 183. (OpenAI)

Every result ships with a Lean 4 certificate in openai/ten-proofs, built against mathlib under Apache 2.0. Lean's kernel returns a binary verdict, so checking the proofs requires trusting neither the model nor the company. Machine checking does not settle whether each formal statement faithfully captures the open problem it claims to, and none of the ten had been through peer review at announcement.