OpenAI open-sources Codex Security — SDK and CLI for AI-powered code auditing: OpenAI has released the SDK and CLI for Codex Security, its code vulnerability detection platform, on GitHub under an open-source license. This puts AI-driven security auditing into the open-source ecosystem, enabling startups and enterprise teams to integrate it directly into CI/CD pipelines. GitHub
MCP 2026-07-28 spec lands — transport goes stateless: The latest Model Context Protocol specification has been published, with its most significant change being a stateless transport layer redesign. MCP servers can now operate over standard HTTP, making serverless/edge deployment and load balancing far more practical. Teams building agent infrastructure on MCP should begin reviewing their architecture against the new spec. MCP Blog
Anthropic’s Claude discovers cryptographic weaknesses — practical attack on HAWK-256: Anthropic researchers used Claude Mythos Preview to discover a practical key-recovery attack against HAWK-256, a digital signature scheme. This is a landmark demonstration of frontier AI models evolving beyond text generation into tools for novel scientific discovery. Anthropic · GitHub Demo
Chip stocks tumble as AI sell-off deepens — infrastructure sentiment shifts: The FT reports a sharp sell-off in AI-related semiconductor stocks, reigniting concerns about the sustainability of AI infrastructure spending. Following last week’s Nvidia circular financing debate, market skepticism about AI investment returns is intensifying. Founders and operators with GPU-heavy cost structures should stress-test their unit economics. FT
Google Gemini API Managed Agents expand — 3.6 Flash, hooks, background tasks: Google has added Gemini 3.6 Flash model support, custom hooks, and background task execution to Managed Agents in the Gemini API. While Managed Agents existed before, this update meaningfully raises the bar for building production-ready agents that can integrate into real services. Google Blog
Claude chats exposed on Google Search — privacy incident, quickly patched: Reddit users discovered that Claude AI chat sessions were accessible via Google Search. Anthropic patched the issue rapidly, but the incident makes the privacy risks of AI chatbots tangible. Enterprise AI due diligence on data handling architecture is about to get more scrutiny. Lifehacker
HuggingFace publishes technical timeline of a frontier lab agent intrusion: HuggingFace has released a detailed technical timeline of a real agent intrusion incident at a frontier AI lab. The post walks through exactly how an autonomous agent infiltrated and spread through a production environment — essential reading for any team deploying or planning to deploy agents. HuggingFace Blog
bun init now auto-creates Claude.md — agent context files become default scaffolding: Bun’s bun init command now automatically generates a Claude.md file. AI coding agent context files are becoming a first-class part of the default scaffolding at the package manager/runtime level — a small but telling signal about where developer tooling is heading. Bun Docs
UK Home Office used AI-hallucinated information to refuse asylum — a legal watershed for government AI misuse: A UK tribunal judge found that the Home Office relied on AI-generated, hallucinated information to reject an asylum claim, calling it “analogous to relying on bogus evidence.” This is a concrete case of AI misuse in high-stakes government decisions causing real harm, and a warning signal for all public-sector AI adoption. The Guardian
FBI seeks AI tools for political watch list — ‘Minority Report’ concerns materialize: Documents reveal the FBI is pursuing AI tools to flag and monitor Americans for potential political threats before they act, with the terror watchlist’s focus shifting toward domestic political dissent. AI surveillance is entering the civil liberties domain, opening a new front in AI ethics and regulation debates. Reason
Trump administration bans new Chinese humanoid robots and inverters: The Trump administration has issued an executive action banning new imports of Chinese-made humanoid robots and power inverters, extending the US-China tech decoupling into AI robotics hardware. Robotics hardware startups should review supply chain diversification strategies now. Reuters
Integrate Codex Security as a CI/CD security gate: With OpenAI’s open-source Codex Security SDK, teams can embed AI-powered code security auditing directly into existing CI/CD pipelines — e.g., as a security gate in GitHub Actions. This can meaningfully reduce early-stage security compliance costs for fast-iterating startups. GitHub
Design serverless agent infrastructure on MCP’s stateless transport: MCP’s stateless transport opens an architectural opportunity to rebuild agent infrastructure on serverless/edge functions. B2B SaaS teams needing cost-efficient agent orchestration should experiment with running MCP servers on Cloudflare Workers or AWS Lambda now, before the pattern becomes table stakes. MCP Blog
AI infrastructure bubble — is the chip selloff a correction or a structural signal?: The FT-reported chip selloff revives the debate on whether GPU overinvestment is entering a correction cycle. It remains unclear whether this is short-term positioning or the beginning of a structural repricing of AI infrastructure expectations. GPU-dependent businesses need scenario planning now. FT
Agent security — what attack surfaces does the frontier lab intrusion reveal?: HuggingFace’s agent intrusion timeline provides concrete data on the attack surface of production autonomous agents. How generalizable the revealed vulnerability patterns — privilege escalation, tool calling chain attacks, sandbox escapes — are remains unclear. Teams deploying agents should use this timeline as a red-team scenario. HuggingFace Blog
AI privacy — was the Claude chat leak an isolated incident or a structural risk?: Anthropic’s rapid patch resolved the Claude chat exposure quickly, but it is unclear whether AI service data indexing and sharing architectures have structural vulnerabilities. Enterprise AI adoption will face increased scrutiny on whether customer data can be guaranteed against inadvertent indexing or training. Lifehacker