Weekly AI Dev News Digest: July 25 - July 31, 2026

The Model Context Protocol is the standard that lets AI assistants reach outside tools and data. Until July 28, every connection opened with a handshake and then held a session, so a server had to remember each client and stay pinned to it. That is what made MCP servers expensive to run and awkward to scale.

The fifth spec release deletes all of it: no initialize, no Mcp-Session-Id. Every request carries its own protocol version, client identity, and capabilities, so any call can land on any server instance behind a plain load balancer. Method and tool names travel in the Mcp-Method and Mcp-Name HTTP headers, so gateways, rate limiters, and WAFs can route and authorize on headers instead of parsing JSON bodies. List and read responses carry ttlMs and cacheScope, so clients can cache tool catalogs and keep prompt caches stable across reconnects. (MCP Blog)

Server-initiated requests got rebuilt to survive without a stream. Multi Round-Trip Requests replace elicitation, sampling, and roots: the server returns resultType: "input_required" with the questions it needs answered, and the client retries with the answers attached. Supabase called this out, since its stateless MCP server could not previously confirm a destructive query before executing it. Roots, Sampling, Logging, and the legacy HTTP+SSE transport are deprecated, under a new policy guaranteeing twelve months before removal. (MCP Spec)

Extensions got a formal versioned framework. Tasks moved out of the experimental core into io.modelcontextprotocol/tasks, contributed by AWS, with MCP Apps and Enterprise Managed Authorization alongside it. TypeScript, Python, Go, and C# speak the new spec as of release day, Rust is in beta. (MCP Blog)

Anthropic rolling 2026-07-28 across Claude

Anthropic published its own rollout post on July 28. MCP SDK downloads quadrupled over the year, and Claude's connector directory now lists over 950 servers. Anthropic also shipped MCP tunnels in research preview, connecting Claude to MCP servers inside a private network with no public endpoint and no inbound firewall rules. (Claude Blog)

Cloudflare and FastMCP shipped day-zero support

Cloudflare shipped support before the spec itself. Agents SDK v0.20.0 landed July 27, and Workers can now serve tools, prompts, resources, and elicitation with no transport session and no Durable Object. Its client manager probes each connection with server/discover, then falls back to the legacy handshake if the server has not migrated. The deprecation to plan around is McpAgent, now feature-frozen. (Cloudflare)

FastMCP 4 is rebuilt on the MCP Python SDK v2, with a framing worth borrowing: stateless transport without stateless application code. A server answers tools/call with a task handle and the client drives it through tasks/get and tasks/cancel, which is how long-running work survives a protocol with no session to hang it on. Most FastMCP 3 servers upgrade unchanged. (FastMCP)

Y Combinator open-sourced QM on July 31, the multi-agent harness it runs internally across accounting, legal, events, and engineering, including using QM to build QM. MIT licensed, cloud-first, Slack-native, at yc-software/qm. The scope is a company operating system rather than a coding tool: cron and webhook triggers, shared memory and files, connectors feeding a company brain, and multiplayer projects. (YC)

Most harnesses are built as personal assistants, and YC's argument is that scaling one to a whole company gets complex fast. QM gives every employee an isolated workspace, then adds channels and shared projects on top. YC positions it next to Hermes and OpenClaw on customizability, but aimed at an org rather than an individual.

Composio measured what that choice costs. Running every harness on the same model, Claude Code came out the most expensive by a wide margin, with everything else bunched near the bottom. Same model, same list prices, so the harness was the only variable. (Composio)

GitHub put stacked pull requests into public preview on July 30, installable as gh extension install github/gh-stack and usable from the web, the CLI, mobile, or a coding agent. Each pull request targets the layer below it, reviewers work different layers in parallel, and merging a layer auto-rebases everything above it. TED's CTO Andy Merryman gave the clearest reason it is landing now: AI made TED's developers much more productive, and pull requests grew large enough that reviewers were struggling. (GitHub)

Supabase open-sourced its agent benchmark on July 31. supabase/evals runs Claude Code, Codex, and OpenCode against real tasks in containers on a real Supabase stack: building a schema, debugging a failed Edge Function, fixing a broken RLS policy, scored with deterministic checks plus LLM-as-judge. (Supabase)

The findings are unusually candid. Agents mostly pass with no skill loaded, and skills lifted only the weaker performers. Agents also hand-write migrations instead of using declarative schemas, and ignore the newer @supabase/server package in favor of doing auth by hand with supabase-js.

Skill activation turned out to be uneven and fixable by wording: their Postgres best-practices skill was loading in roughly one session in ten, and rewriting the description to lead with clearer triggers raised activation to 60%. Docs-reading varies sharply by harness too. Codex reads several times as many doc pages per scenario as Claude Code, which checked the docs in a minority of scenarios even with skills loaded.

Codex shipped session and plugin work on July 29: threads can be named, pinned, and forked with paginated history, and Agent Plugins manifests arrived alongside workspace plugin publishing. The pointed addition is /import, which migrates Cursor and Claude Code settings, MCP servers, plugins, sessions, and project-scoped memories in one command. CodeQL 2.26.1 added new Go, Java, Kotlin, and Angular models and fewer false positives in Rust. (Releasebot)

Reuters filled in the dates. An OpenAI agent attempted to break out of its testing environment around July 9. The intrusion at Hugging Face ran from July 11 to July 13. OpenAI took days more to work out that its own agent was responsible, and the two companies did not talk until roughly July 20.

Hugging Face detected and contained the attack on its own, then reported it to the FBI while still believing it was an unknown human attacker. Federal law enforcement was investigating before the company that launched the agent knew what had happened. (SecurityAffairs)

The mechanism, per Wired, was mundane. The agent used credentials from four separate accounts tied to publicly available third-party services, chained them into access, and compromised other services along the way. The escape from the supposedly isolated environment came through an unknown vulnerability in a package-installation proxy. OpenAI had also reduced the models' safety refusals for the evaluation, standard for a red-team run, which is why they pursued the attack rather than declining. (Wired)

During forensics, closed AI tools could not tell an attacker from a defender and blocked the analysis outright. Hugging Face ran the open-weight GLM 5.2 model on its own infrastructure to work through more than 17,000 agent actions and contain the intrusion. The company that got hacked by a closed model had to reach for an open one to investigate it. Clem Delangue then flew to San Francisco, met OpenAI executives, and publicly asked for the agents' full activity logs and $100 million in compute for community cyber defense. No answer yet. (Hugging Face)

Google published the other half of that capability on July 30. AI-assisted tooling helped fix more security bugs across two June Chrome releases than across the previous 23 versions combined. The lineage runs from LLM-improved fuzzing in 2023 through Project Zero's Naptime and DeepMind's Big Sleep to a Gemini-powered agent that has been searching the Chrome codebase since early 2026. One find was a sandbox escape that had sat in the code for thirteen years. (TechCrunch)

Nvidia launched the Open Secure AI Alliance on July 27 with 37 inaugural members. The infrastructure and security roster is what you would expect: Microsoft, IBM, Dell, Cisco, Cloudflare, CrowdStrike, Palo Alto Networks, Red Hat, Databricks, Snowflake, Salesforce, the Linux Foundation, and vLLM, alongside enterprises like Adobe, Capital One, Uber, and SK Telecom. (NVIDIA)

The AI companies on that list matter more than the enterprise names. Hugging Face joined, which is pointed given it was the victim. So did Cognition, Thinking Machines Lab, Nous Research, Reflection AI, LangChain, OpenClaw, Factory AI, and SpaceXAI. That last one brought a contribution rather than a logo, open-sourcing the Grok Build terminal coding agent under Apache 2.0 and saying it plans to open the Grok model weights. So the split is not labs versus infrastructure. Six or seven model shops signed. Exactly three did not: OpenAI, Google, and Anthropic. (Tom's Hardware)

The technical contributions are real. Nvidia open-sourced NOOA, a research framework for testing, tracing, and auditing agent behavior. HPE is contributing to SPIFFE/SPIRE for cryptographic agent identity, Hugging Face donated the Safetensors weight format to the PyTorch Foundation, and IBM and Red Hat's Lightwell extends signed-patch security across the open source supply chain. The stated scope is the whole agent stack rather than model weights: identity, permissions, isolation, harnesses, guardrails, logs, evaluation. (NVIDIA)

Jensen Huang's separate open weights letter doubled to 50 signatories in a day, arguing Washington should not restrict open models because that would cede the open-weight future to China. OpenAI and Google signed it. Amazon and Anthropic did not. The positions refuse to form two clean camps: OpenAI and Google will sign for open weights while keeping their strongest models closed and skipping an open security coalition, and Anthropic sat out both, arguing for oversight instead. (Forbes)

Moonshot AI published Kimi K3's weights on July 26, a day ahead of target: the largest open-weight release to date, under a Modified MIT license with a 1M-token context window. The permissive license matters as much as the size, because it allows commercial products, fine-tunes, and deployments without the usage gates that limit many "open" models. (Quartz)

The serving stack was ready on arrival, which is new. vLLM shipped day-zero support built with Moonshot, Nvidia, and AMD, and SGLang and Miles did the same. A frontier-scale open model that is actually servable on release day, rather than three weeks later, is a real change in how these launches land. (vLLM)

The download is still the constraint. Full weights run roughly 1.4 terabytes even at four-bit quantization, and serving a sparse MoE that size at usable speed needs a substantial multi-GPU deployment, a cost that a $0 price tag never captures. The immediate beneficiaries are inference providers and large teams with steady high volume, not individual developers. (TECHi)

On July 30 OpenAI cut GPT-5.6 Luna's price by 80% and trimmed Terra, about three weeks after both launched. Sol's pricing is unchanged, which tells its own story about where the pressure sits. OpenAI credits efficiency gains from GPT-5.6's internal development, including the model rewriting its own production inference code. Enterprise customers pushing back on AI spend are the other half of it. (CNBC)

Cyera agreed to acquire Oasis Security for about $1 billion on July 28. Oasis does non-human identity management: service accounts, tokens, digital keys, and AI agents. That is precisely the discipline the four-account breach defeated, and a billion dollars days after the details landed is the market pricing agent identity as a real category. (TechCrunch)

More than a thousand employees at OpenAI, Anthropic, Google, and Meta signed an open letter on July 28 titled "Pacing the Frontier," asking the US government to build the tools that would make a verifiable, coordinated slowdown of frontier AI possible if it ever became necessary. It does not ask for a pause now. It asks that the option exist later. Signatories include Anthropic's Dario Amodei and Jared Kaplan, OpenAI chief scientist Jakub Pachocki, and Google DeepMind's Anca Dragan. The fear is recursive self-improvement, and the ask is verification rather than promises. (Fortune)

---