Weekly AI Dev News Digest: July 11 - 17, 2026

Moonshot AI, backed by Alibaba, launched Kimi K3 on July 16: a Mixture-of-Experts model with roughly 2.8 trillion total parameters, a 1-million-token context window, and native multimodal input. Moonshot says the weights go public on July 27, which would make K3 the largest open-weight model released to date, more than double the roughly 1 trillion in the prior Kimi K2 line and clear of DeepSeek's 1.6-trillion V4-Pro. In blind testing by the Arena evaluator, developers preferred K3 over every leading US model, though Moonshot's own numbers put it behind GPT-5.6 Sol and Claude Fable 5 in some areas. At around $12 per million tokens, it is priced higher than the deep discount Chinese labs are usually known for. (Axios)

GitHub Copilot CLI's July 14 update hard-blocks workspace-mutating tool calls during plan mode. Before the change, a model could drift mid-plan and trigger a file edit while a developer thought the agent was only sketching an approach. The fix moves the block to the runtime layer instead of relying on the prompt to hold the line, and it extends the sandbox filesystem policy to cover Language Server Protocol access paths. The release also brought the canvas API into the terminal and a /voice devices command for saving a preferred microphone. (TechTimes)

Claude Code's releases across the week ran on the same theme. One fix stops permission previews from being spoofed by bidirectional-override, zero-width, and look-alike quote characters, so a tool's inputs can no longer visually rewrite the approval message a developer sees. Another floors a PreToolUse hook's ask decision so auto mode can't override it for unsandboxed Bash, and background task notifications now state plainly that no human input occurred, which blocks a fabricated in-transcript approval from being acted on. A separate shell-injection fix rejects ${user_config.*} in shell-form plugin commands. (Claude Code changelog)

OpenAI's Codex 0.144.5, out July 16, improved its dangerous-command detection, catching more forced rm forms and returning clearer reasons when a command is denied. On its own it is a patch. Read next to the GitHub and Anthropic changes, it is the third coding agent in one week to spend a release tightening what its own automation is allowed to run. (Codex changelog)

On July 14, attackers compromised the release pipelines of four core AsyncAPI GitHub repositories and published five trojanized packages to npm under a campaign calling itself miasma-train-p1. Palo Alto Networks' Unit 42, which has tracked an escalating run of registry attacks through 2026, identified the payload as a descendant of the Miasma remote access trojan. The attack bypassed code review by injecting into the build and release path rather than a pull request. (Unit 42)

Anthropic opened an Admin API beta for Claude Enterprise organizations on July 14. Admins can list and look up members by email, change roles, remove people, manage invites and groups, and read custom roles over the API instead of the dashboard. Group and custom-role calls require the ce-user-management-2026-07-13 beta header, and an Admin API key scoped to read:org_audit can call every user-management GET endpoint. The platform also made mid-conversation system messages generally available on the Claude API, Amazon Bedrock, and Google Cloud with no beta header, across Claude Fable 5, Claude Mythos 5, and Claude Opus 4.8. (Claude release notes)

The same day, Anthropic made HIPAA configuration self-serve for both Claude Enterprise and the Claude Platform. An eligible admin can now review the Business Associate Agreement, download the implementation guide, and switch on the HIPAA configuration in a single flow, without routing the request through a sales or support cycle. (Anthropic support)

GitHub added a /security-review slash command to the GitHub Copilot app in public preview, bringing the AI vulnerability scan that already lived in Copilot CLI into the everyday coding surface. It analyzes in-flight changes, scores findings by severity and confidence, and offers fixes a developer can apply and re-verify without leaving the app. (GitHub Changelog)

Copilot for JetBrains added bring-your-own-key support for OpenAI-compatible custom endpoints, so teams can point the assistant at their own models across every plan tier. (GitHub Changelog)

Visual Studio's Copilot update introduced trust validation for MCP servers: at startup it now compares an MCP server's configuration and asset fingerprint against a trusted baseline, flagging drift before the server is used. That, plus general availability for the first C++ modernization-agent scenarios, rounded out GitHub's July 14 batch. (GitHub Changelog)