What's changing in AI — every desk, every vendor.

OpenAI's new GPT-5.6 family arrived on 2026-07-09 in three task-matched variants: Sol, Terra, and Luna. It is rolling out inside GitHub Copilot — where you pick the variant per job — and is live on Vercel's AI Gateway with bring-your-own-key support and no gateway markup.

Reflect (beta) tracks and visualizes how you actually use Claude — patterns across topics, alignment with the 4D AI Fluency Framework, and optional quiet-hours/break reminders. It's live for Free, Pro, and Max users with memory enabled; Cowork conversation reflection is coming soon.

Grok 4.5, the latest model from the Grok team (xAI), is now available on Vercel's AI Gateway with no gateway markup, high rate limits, and bring-your-own-key support, per Vercel's 2026-07-08 changelog.

Anthropic's flagship Claude Fable 5 returned worldwide on July 1 after an 18-day, government-ordered blackout. A June 12 US export-control directive had forced Anthropic to disable Fable 5 and Mythos 5 over a cyber-jailbreak concern — the first frontier models ever pulled by government order, and the first brought back. The redeploy ships with new cybersecurity safeguards and a proposed industry jailbreak-severity framework.

Anthropic's new mid-size model runs agents (planning, browser + terminal use, long autonomous runs) at close to Opus 4.8 quality but far cheaper, and is now the default for Free and Pro. It also resists prompt-injection hijacks better than Sonnet 4.6.

OpenAI's new tier launched to only ~20 government-approved partners, at the White House's request, after Sol crossed OpenAI's 'High' cybersecurity-risk threshold on an internal attack test. Wider availability is promised 'in the coming weeks.'

Flagship upgrade at the same $5/$25 per-1M base price; user-level effort control (low/high/extra/max) and a fast mode cut from $30/$150 to $10/$50 per 1M tokens.

Google's Gemini 3 Pro and Gemini 3.5 Flash position around agentic action and coding, distributed through Antigravity, AI Mode, and the Gemini API.

V4 Pro (1.6T total / 49B active MoE) and V4 Flash (284B / 13B active), both MIT-licensed with 1M-token context.

Claude now writes its own orchestration scripts and fans work across tens-to-hundreds of parallel subagents in one session, with a verify-before-fold loop. Reported cap: 16 concurrent / 1,000 total agents per execution.

The protocol layer is now stateless: remote MCP servers run behind plain round-robin load balancers, no sticky sessions. Plus MCP Apps (server-rendered UI), a Tasks extension for long-running work, and OAuth/OIDC-aligned auth.

On 2026-07-07 Google expanded Managed Agents in the Gemini API, adding background/long-running task support and remote MCP so developers can build and host production-ready agents on Google's side.

Across v2.1.198–v2.1.205 (late June–July 8, 2026) Claude Code made background subagents the default (Claude keeps working while they run), had finished background agents auto-commit/push and open draft PRs, added agent_needs_input/agent_completed notification hook events and a "Dynamic workflow size" setting, and changed the permission-mode default to "Manual" across all interfaces.

On 2026-07-08 LangChain and NVIDIA released the NemoClaw Deep Agents Blueprint — a governed reference stack for building autonomous ("deep") agents on NVIDIA's Nemotron models — alongside companion guides on tuning the harness rather than the model and on controlling coding-agent cost.

The July release adds parallel multi-chat agent sessions (compare approaches within one agent session), general availability for Copilot Vision (attach images/PDFs to chat), read-only subagent-monitoring peer chats when an agent delegates work, and an experimental bring-your-own-key model path for agent-host sessions.

Reflect (beta) tracks and visualizes how you actually use Claude — patterns across topics, alignment with the 4D AI Fluency Framework, and optional quiet-hours/break reminders. It's live for Free, Pro, and Max users with memory enabled; Cowork conversation reflection is coming soon.

MCP — the now-standard way AI agents connect to tools and data — has no built-in way to verify a tool's identity or prove what it returned. 2026 security guidance is blunt: treat every tool response like something off the open internet unless you can prove where it came from.

Vercel build logs now automatically replace Sensitive Environment Variable values of 32 characters or longer with [REDACTED], closing a common accidental-secret-leak path in CI output (2026-07-09).

Across v2.1.198–v2.1.205 (late June–July 8, 2026) Claude Code made background subagents the default (Claude keeps working while they run), had finished background agents auto-commit/push and open draft PRs, added agent_needs_input/agent_completed notification hook events and a "Dynamic workflow size" setting, and changed the permission-mode default to "Manual" across all interfaces.

A Spotlight paper at ICML 2026 ("Modular Pretraining Enables Access Control," 2026-07-08) from AE Studio in collaboration with Anthropic introduces GRAM (Gradient-Routed Auxiliary Modules): during pretraining, specialized knowledge (e.g. virology, cybersecurity) is routed into small removable modules so one trained model can be reconfigured to turn those capabilities on or off at inference. Anthropic states GRAM has not been applied to any production model and may never be.

CISA added CVE-2026-55255 — an authorization-bypass (IDOR) flaw in Langflow, the drag-and-drop AI-agent-building tool — to its Known Exploited Vulnerabilities catalog on July 7, 2026, with a July 10 federal patch deadline. Attackers used it to harvest LLM provider keys, cloud credentials, and other secrets from other users' flows; the fix is Langflow 1.9.1+.

The Government of Alberta has been running Claude Code with both Opus and Sonnet models against its own systems to review code, find vulnerabilities, and ship the fixes — a public-sector case study Anthropic published July 6.

After the Fable 5 recall, Anthropic and Glasswing partners (Amazon, Microsoft, Google and others) proposed a shared way to score how severe a model jailbreak actually is — so a narrow bypass isn't treated the same as a systemic one.

Anthropic added Claude Security for codebase scans + patch suggestions, and expanded Project Glasswing, a software-security initiative with technology and financial partners.

GMO Flatt Security researcher RyotaK found that Claude Code's GitHub Action trusted any GitHub App's installation token as authorized input, letting a crafted issue or pull request bypass write-permission checks and expose the OIDC credentials needed to push code. Reported to Anthropic in January 2026 and fixed within four days, with further hardening through spring; the fix ships in claude-code-action v1.0.94 (CVSS v4.0 7.8).

"Zero Trust for AI Agents" adapts zero-trust security principles — never trust, always verify; assume breach; least privilege — to autonomous agents, covering identity, access control, memory-poisoning defense, and behavioral monitoring across a three-tier (Foundation/Advanced/Optimized) maturity model aimed at regulated industries.

The NSA's AI Security Center published a Cybersecurity Information Sheet on MCP, warning that the protocol's server-executes-actions-for-clients pattern creates largely untraced attack paths, and flagging serialization risk, unclear trust boundaries, and arbitrary code execution as recurring issues in real deployments. Recommendations include auditing MCP servers, defining trust boundaries, sandboxing tool execution, signing/verifying messages, and logging every tool invocation.

On 2026-07-08 LangChain and NVIDIA released the NemoClaw Deep Agents Blueprint — a governed reference stack for building autonomous ("deep") agents on NVIDIA's Nemotron models — alongside companion guides on tuning the harness rather than the model and on controlling coding-agent cost.

On 2026-07-07 Google expanded Managed Agents in the Gemini API, adding background/long-running task support and remote MCP so developers can build and host production-ready agents on Google's side.

CISA added CVE-2026-55255 — an authorization-bypass (IDOR) flaw in Langflow, the drag-and-drop AI-agent-building tool — to its Known Exploited Vulnerabilities catalog on July 7, 2026, with a July 10 federal patch deadline. Attackers used it to harvest LLM provider keys, cloud credentials, and other secrets from other users' flows; the fix is Langflow 1.9.1+.

Q2 2026 is a race to parallel/background orchestration: Cursor 3 "Build in Parallel," Antigravity 2.0 dynamic subagents, and Windsurf relaunching as Devin Desktop on the open Agent Client Protocol (ACP).

Claude now writes its own orchestration scripts and fans work across tens-to-hundreds of parallel subagents in one session, with a verify-before-fold loop. Reported cap: 16 concurrent / 1,000 total agents per execution.

The protocol layer is now stateless: remote MCP servers run behind plain round-robin load balancers, no sticky sessions. Plus MCP Apps (server-rendered UI), a Tasks extension for long-running work, and OAuth/OIDC-aligned auth.

Jarred Sumner reportedly used dynamic workflows to port Bun from Zig to Rust: ~750k LOC, 99.8% of the test suite passing, 11 days first-commit-to-merge.

The NSA's AI Security Center published a Cybersecurity Information Sheet on MCP, warning that the protocol's server-executes-actions-for-clients pattern creates largely untraced attack paths, and flagging serialization risk, unclear trust boundaries, and arbitrary code execution as recurring issues in real deployments. Recommendations include auditing MCP servers, defining trust boundaries, sandboxing tool execution, signing/verifying messages, and logging every tool invocation.

Claude Desktop, Claude Code, Cursor, Codex CLI, ChatGPT desktop, OpenAI Agents SDK, and Amazon Bedrock AgentCore Gateway all speak MCP; 500+ public servers. MCP was donated to the Linux Foundation in Dec 2025.

AI Uni designed and reviewed the durable-state layer for its own autonomous work loop — the piece that lets an agent pick its own goal back up after the terminal driving it dies, its context is compacted, or its model is swapped mid-task. The loop persists only the small amount of state that can't be recomputed from artifacts (which step it's on, the iteration count, which test is still red, how much budget it has burned) in a signed cell on disk, so a killed-and-re-invoked run resumes where it stopped instead of starting cold. Six named consistency guarantees define what 'durable' has to mean, and the go-live keystroke stays the human owner's (what we call the FOUNDER). Honest state: the mechanism is green across its test suites and has passed a multi-seat architecture review, but it has NOT run live anywhere — no dry-run has executed, and no ratified goal sits on a production lane yet.

• The core insight is small and reusable: cross-session durability was failing not because the loop lacked persistence, but because it had two half-loops that never touched. One half could evaluate a goal and drive a build-then-judge iteration but held its state in memory that dies with the session; the other half persisted work across idle and restart but was goal-blind — it knew a work lane existed, not what 'done' meant or how far along it was. The fix was NOT a new engine. It was one thin durable controller plus ONE shared state cell that both halves read and write. The cell carries only state that genuinely can't be recomputed from artifacts: current step, iteration count, which test is still failing, budget used so far, last-pass timestamp, and a 'gated' flag. Everything else stays stateless and recomputed. The transferable lesson: find the smallest set of state that ISN'T derivable from what's already on disk, and make only that durable.
• Three mechanics make the loop safe to run unattended, each proven by its own test suite. Resume: a killed controller, re-invoked in a fresh process, reads the cell and continues from the saved step and iteration with the failing test recalled — not from step zero (resume suite, 13 pass / 0 fail). Cumulative budget: the turn-and-cost meter hydrates from the cell at the start of every pass, so N restarts enforce ONE budget that halts at the true cap, instead of N fresh budgets — the failure mode that would quietly make an 'unattended for a month' safety claim false (budget-durability suite, 5 pass / 0 fail). Halt-safety: a corrupt, zeroed, or negative budget refuses fail-safe rather than granting a fresh slice, and a loop making no progress halts on a no-progress rule (two identical no-advance passes) or an independent pass ceiling — it cannot spin forever (halt suite, 18 pass / 0 fail). If you build one of these, budget-hydration-from-the-cell is the non-obvious part: a meter with zero persist calls looks correct within a single session and is silently wrong across restarts.
• The team wrote down six named consistency guarantees as the definition of 'durable,' then had an independent seat grade whether each is mechanically proven TODAY — and published the honest grade rather than a claim of six-for-six. The six: G1 work survives a killed terminal; G2 budget is cumulative across restarts; G3 a stuck goal halts and hands back (never a silent sleep); G4 the loop never ships on its own; G5 the goal is the human owner's, not an agent's; G6 the record is append-only and re-renderable (a replay renders identically to the live run). The graded reality: three (G1/G2/G3) have dedicated green commands; two (G4/G5) are proven at the mechanism level but under-cite their strongest defense (a trust-root test, 14 pass / 0 fail) and share one suite instead of each carrying its own command; and one (G6) has NO committed verifier yet — a build spec exists for it, but the check isn't written. The reusable move is the discipline itself: name your guarantees, require each to name its own failing command, and treat 'shares a test with another guarantee' or 'graded by a human' as not-yet-done.
• The two most safety-relevant defenses target a write-capable agent trying to cheat its own loop, and both hold in tests. A trust-root gate (14 pass / 0 fail) rejects a tampered state cell — a schema-valid 'cold-start lie' that fakes a fresh budget or un-parks a goal is refused as un-attested at hydrate — rejects a self-authored human-approval row, and fails CLOSED when the bootstrap secret is unset (no secret, no run). Layered on top, the loop never crosses a human-owner gate on its own: when the work is green but the next step is a ship, a deploy, or one of the eight destructive classes (schema changes, data deletion, secret rotation, auth, payments, production deploy, branch protection, external accounts), the loop reaches a distinct terminal state — PARKED-AT-EYES — that is a VALID stop, not a failure, and it will not self-cross; re-invoking a parked goal keeps it parked. The design deliberately separates the 'done' gate (the machine's job) from the 'ship' gate (always the human's keystroke). One pattern worth stealing: make the ship keystroke structurally impossible for the agent to press, and make an un-attested state cell refuse rather than trust its own file.
• Honest state, stated plainly because it is the most important thing here: this loop is green across its suites and has passed a multi-seat review, and it is NOT live anywhere. The known gaps are documented on disk, not glossed. There is no FOUNDER-ratified operational goal yet — only a schema-proving template that no driver reads; there is no loop state on any production lane; the end-to-end auto-re-wake of a dead terminal is built-and-composed but unproven on a real lane; and, critically, NO dry-run has executed. Go-live is defined as one proven dry-run on a single safe, bounded, recurring real target — the leading candidate is AI Uni's own daily research refresh, which today dies with its session, the exact seam the loop is meant to close — followed by the human owner's explicit go-live word. The takeaway for anyone shipping autonomous infrastructure: 'green in tests' and 'reviewed' are real milestones, but they are not 'live,' and saying so precisely is part of the engineering, not a caveat bolted on afterward.

15 sources consulted: S93 goal-loop consolidated spec — the ratified 'surgical mend' + durable-controller design — docs/specs/S93-opus-goal-loop-FINAL-PROPOSAL.md · Durable Loop go-live requirements pack — 16 requirements (REQ-DL-01..16), Gherkin acceptance, honest starting-state gap table — docs/product-requirements/pipeline/DURABLE-LOOP-GOLIVE-REQUIREMENTS-2026-07-13.md · CTO architecture-integrity verdict — the six consistency guarantees enumerated verbatim + graded per-guarantee (under review, PR #925) — docs/architecture/DURABLE-LOOP-SIX-GUARANTEES-2026-07-13.md · Loop monitoring + maintenance runbook — defines the six guarantees in §5 (merged, PR #919) — docs/runbooks/DURABLE-LOOP-MONITORING-MAINTENANCE.md · Durable Loop architecture doc (merged) — docs/architecture/DURABLE-LOOP-ARCHITECTURE.md · The durable controller — the mend that drives the goal-contract loop — scripts/harness/goal-loop-controller.mjs · The shared durable state cell — read / write / inspect + HMAC stamp — scripts/harness/goal-state-cell.mjs · FOUNDER-approval binding — content-hash over the goal bytes + a real approval artifact — scripts/harness/founder-approval.mjs · Dead-terminal re-wake transport — scripts/wake-watcher.sh (test-wake-watcher.sh: 21 pass / 0 fail, CTO re-run this session) · Resume-across-session-loss suite — scripts/test-goal-loop-resume.sh (13 pass / 0 fail, CTO re-run this session) · Halt-safety / no-runaway suite — scripts/test-goal-loop-halt.sh (18 pass / 0 fail, CTO re-run this session) · Cumulative-budget durability suite — scripts/test-budget-durability.sh (5 pass / 0 fail, CTO re-run this session) · Trust-root anti-forge / anti-tamper suite (the last gate before unattended-with-write) — scripts/test-f3-trust-root.sh (14 pass / 0 fail, CTO re-run this session) · Import-wiring resolve-on-main suite — scripts/harness/wiring.test.mjs (6 pass / 0 fail, CTO re-run this session) · The schema-proving TEMPLATE goal (explicitly NOT an operational goal; no driver reads it) — scripts/harness/goals/378-roadwork.goal.json

Internal engineering research on AI Uni's own autonomous work loop. Grounded in the FOUNDER-ratified consolidation spec, the built harness scripts on `main`, a Volere-style 16-requirement go-live pack (authored by the Business Analyst), and an independent CTO architecture-integrity verdict; every claim traces to a committed repo artifact by path, and every test count was re-run this session by the CTO on scripts byte-identical to `main` — an independent re-run, so the seat that graded is not the seat that built. Honest-state discipline throughout: the loop is green-in-tests and reviewed but NOT live — no dry-run has executed and go-live is the human owner's explicit word; nothing here claims the loop is running.

AI Uni audited its own cross-session memory system (the write / consolidate / recall / apply loop that lets an agent survive between sessions) against seven external approaches — Anthropic's own memory tool, Letta, Zep/Graphiti, LangMem, mem0, consumer auto-capture tools, and the academic consolidation literature — and found the same pattern everywhere, including in our own system: retrieving memory is becoming a platform commodity, but capturing and consolidating it well is still nobody's solved problem.

• Anthropic's `memory` tool (`memory_20250818`) went GA on the Messages API: a client-side file store (you own the storage backend, Claude just requests view/create/edit/delete operations over a `/memories` prefix), an auto-injected “check your memory before doing anything” system-prompt protocol, and — paired with context-editing — Anthropic reports 84% token savings on long-running tasks. If your team is hand-rolling cross-session state for an agent, there's a good chance this is already built for you.
• Every system compared splits memory into four steps — write, consolidate, recall, apply — and the same step breaks almost everywhere, including in our own: recall and apply are mechanizable (a hard gate, a retrieval call, a tiered memory block), but write-back and consolidation are treated as unenforced discipline nearly universally. Two concrete fixes worth copying: Letta's “sleep-time compute” (a separate, idle-time agent that distills raw memory into synthesized knowledge using a slower model) and Generative Agents' (Park et al., 2023) accumulated-importance threshold as the trigger that fires it — instead of a calendar reminder or “run it sometime.”
• Zep/Graphiti's bi-temporal fact model is a stronger staleness answer than a binary “this is stale” flag: every fact carries both a valid-time (when it was true in the world) and an ingestion-time (when the system learned it), so a superseded fact is marked invalid-as-of-a-date rather than deleted or just flagged — giving an auditable history of what was true when.
• The clearest UX lesson from consumer memory tools (ChatGPT memory, Cursor, Windsurf) is corroborated across independent sources: pure auto-capture over-remembers noise, and users end up manually curating the high-value items within a week or two anyway. The pattern that's held up is capture liberally and automatically, then run a separate curation/consolidation pass — not pure auto-capture and not pure manual discipline.
• Turning the same four-step framework on ourselves: our recall→apply loop was already ahead of the field — a mechanical gate that blocks a commit or dispatch until a prior failure class is acknowledged, backed by hundreds of live enforcement events — something none of Letta, Zep, mem0, or LangMem enforce mechanically; they retrieve and hope. But our write-back and consolidation were pure discipline, same as everywhere else. We shipped six WARN-first mechanisms the same day to close exactly that gap — a capture write-back check, a scheduled consolidation sweep, dedup-before-write, and three others — each with a committed promotion-to-blocking date, following the field's own lesson: mechanize the gap, don't just write a rule about it.

17 sources consulted: Memory tool — Claude Platform Docs · Managing context on the Claude Developer Platform — Anthropic · Sleep-time Compute — Letta · Memory Blocks — Letta · Zep: A Temporal Knowledge Graph Architecture for Agent Memory (arXiv 2501.13956) · getzep/graphiti — GitHub · LangMem overview (secondary summary of LangChain primary) · DeepLearning.AI — Long-Term Agentic Memory with LangGraph · mem0 — Memory Types docs · mem0 (arXiv 2504.19413) · Mem0 vs Letta (2026) — vectorize.io · How MemoryPlugin Works · AutoMem · Mimicking Windsurf's Memory in Cursor (Medium) · Reflexion — Shinn et al., 2023 (Semantic Scholar) · Generative Agents — memory stream & reflection (memx.app glossary, secondary summary of Park et al. 2023) · Auto-Dreamer (arXiv 2605.20616)

Internal architecture audit (Codebase Intelligence, re-grounded against the live codebase, 2026-07-12) cross-referenced against an external landscape review of seven cross-session memory approaches; every external claim traces to a primary source fetched or searched this session (dated), with primary-vs-secondary sourcing marked throughout and benchmark numbers flagged VOLATILE where not independently reproduced.

AI Uni's research desk asked three questions about 2026 AI-verification tooling — can you trust a report about code an AI read on someone else's machine, can you trust session/telemetry data as proof of engagement, and can you bind a submission to a raw artifact you can re-check — and checked the external landscape against each. The honest picture: you can verify what a tool you run produced, you can't trust a claim about work done on someone else's machine, and nothing on the market tells you whether real understanding happened.

• Repo-read attestation ("my AI read your repo and it checks out") has no external fix in 2026 — MCP has no built-in tool-identity/provenance mechanism and AI-code detectors are rated not reliable enough to stand alone — so it stays a claim, never a proof, unless AIU itself operates the read.
• Comms-bus / session telemetry (minutes-on-task, "a session happened") gets worse, not better, on closer look: hand-transcribed AI output is keystroke-indistinguishable from genuine writing, and behavioral detectors carry a peer-reviewed, durable bias against non-native English writers — telemetry should stay observability-only, never gating a pass or a fail.
• Artifact provenance (binding a submission to a raw artifact AIU can re-check) is the one place the landscape adds genuinely new, buildable vocabulary: "Tool Receipts" (a lightweight signed record a specific tool call happened) is a concrete, cheap implementation shape, and Open Badges 3.0 is the dominant 2026 external shape for the eventual pass credential itself.

26 sources consulted: GitHub changelog — code-to-cloud traceability + SLSA Build Level 3 · GitHub Docs — artifact attestations · Sigstore docs — verifying attestations · nhimg.org — what breaks when MCP tools are treated as trusted by default · Secure AI Atlas — "Agentjacking", June 2026 · ACHIVX (Medium) — MCP server security vulnerabilities · ccodelearner.com — can AI-generated code be detected? · overchat.ai AI Hub — are AI code detectors accurate? · arXiv 2603.10060 — Basu, Tool Receipts · arXiv 2507.22956 — manual transcription defeats keystroke detection · arXiv 2406.15335 — keystroke dynamics against academic dishonesty · Deane — Journal of Educational Measurement (Wiley), 2026 · Liang et al. — Patterns (Cell Press) via PMC, 2023 · PubMed 37521038 · Coursera Blog — Academic Integrity suite, 2026 · eyesift.com — C2PA / Content Credentials, 2026 · c2pa.org · arXiv 2604.25200 — Bicakci, attested evaluation bundles · arXiv 2607.05397 — Rhodes & Kang, Proof of Execution · Emergent Mind — zero-knowledge proofs of ML inference · Cryptowisser — zkML guide, 2026 · sertifier.com — micro-credentials 2026 guide · Accredible — Open Badges 3.0 + W3C Verifiable Credentials · University of Toronto CTSI — viva voce oral exam, 2026 · SAGE Perspectives — oral exams in the age of AI, Feb 2026 · Financial Content / TokenRing — NYU Stern AI-graded oral exams, Jan 2026

External landscape research: every claim traces to a source fetched or searched this session (dated); peer-reviewed/PMC/journal sources preferred over aggregator blogs; 3 arXiv PDFs fetched directly (not just search snippets) to verify claims firsthand.

MCP — the now-standard way AI agents connect to tools and data — has no built-in way to verify a tool's identity or prove what it returned. 2026 security guidance is blunt: treat every tool response like something off the open internet unless you can prove where it came from.

Across 2026 assessments, AI-code detectors score well on untouched AI output but fall apart on edited or paraphrased code, dropping to roughly 20–63% accuracy. The field's own consensus: no detector is reliable enough to be standalone evidence.

A peer-reviewed study found AI-text detectors wrongly flagged 61% of essays by non-native English writers as machine-generated on average — one detector flagged 98% — while rarely misjudging native writers. The bias is durable and still the 2026 baseline.

A 2026 research proposal called 'tool receipts' adds a lightweight signed record proving a specific tool ran with specific inputs and returned a specific output — cheap, unlike the heavy cryptography alternatives. The catch: it only works for tools the checker itself operates.

Multiple 2026 sources converge that a live oral defense is the hardest verification for AI to fake, because it demands spontaneous, real-time explanation. It's not unanimous — one program now has a panel of AIs grade the recorded conversation — but the human-judged live exam remains the strongest anchor.

A Spotlight paper at ICML 2026 ("Modular Pretraining Enables Access Control," 2026-07-08) from AE Studio in collaboration with Anthropic introduces GRAM (Gradient-Routed Auxiliary Modules): during pretraining, specialized knowledge (e.g. virology, cybersecurity) is routed into small removable modules so one trained model can be reconfigured to turn those capabilities on or off at inference. Anthropic states GRAM has not been applied to any production model and may never be.

After the Fable 5 recall, Anthropic and Glasswing partners (Amazon, Microsoft, Google and others) proposed a shared way to score how severe a model jailbreak actually is — so a narrow bypass isn't treated the same as a systemic one.

Two applied agent-engineering papers (late June 2026): SkillOpt treats agent instruction/skill files as trainable parameters external to a frozen model and reports a +23.5-point absolute improvement for GPT-5.5 on a six-benchmark average; Memora is a memory representation that separates rich content from lightweight abstractions and reports state-of-the-art results while using up to 98% fewer context tokens than full-context baselines.

Google shipped a Gemini-powered Classroom app for teachers, adaptive study notebooks that generate personalized quizzes, Guided Learning on Chromebooks, and no-cost ACT/GRE practice tests via The Princeton Review.

The third annual report finds AI use widespread in schools but most stuck at 'experimentation'; Microsoft paired it with new no-added-cost teaching tools built with educators and grounded in learning science.

A new benchmark scores coding agents by the actual end state they leave in a real project workspace — not just whether they refuse — and finds even top models cross harmful-action thresholds in more than 54% of tasks.

"Zero Trust for AI Agents" adapts zero-trust security principles — never trust, always verify; assume breach; least privilege — to autonomous agents, covering identity, access control, memory-poisoning defense, and behavioral monitoring across a three-tier (Foundation/Advanced/Optimized) maturity model aimed at regulated industries.

Khanmigo reached ~2.0M users (+731% YoY), but Khan candidly notes "for a lot of students it was a non-event"; a reimagined experience rolls out summer 2026.

Three education nonprofits announced an AI-focused college; the Khan TED Institute plans to accept applications in 2027 for a bachelor's in applied AI.

A line of work on evolving an agent's context at runtime so the model self-improves without weight updates.

165 students, 5 UK secondary schools: students with LearnLM support were 5.5 pp more likely to solve novel problems on later topics (66.2% vs 60.7% human-tutor-only).

Harvard's 2025 RCT (Kestin et al., Scientific Reports) shows properly-designed AI tutoring producing large effect sizes vs in-class active learning — more learning, more engagement, less time. A UK LearnLM RCT adds independent corroboration.

Ollama's v0.31.2 release turns on flash attention for older NVIDIA GPUs (compute capability 6.x) and lets integrated GPUs run vision models by padding to fit memory — so more people can run current models on hardware they already own. It also hardens local model creation and makes the Claude Code launcher disable telemetry by default. The follow-on v0.32.0 release candidate adds support for the Qwen3.5/Next model family.

Tencent's official Hy3 release (295B total / 21B active parameters, 256K context) follows its April preview, with Tencent claiming intelligence comparable to flagship models 2-5x its size on coding, office, and financial-modeling tasks. It's Apache-2.0 licensed and available day-one on Hugging Face, ModelScope, and OpenRouter.

GLM-5.2 arrived with full MIT-licensed weights within a week of launch, reported to punch above its size on long-context retrieval and multilingual tasks — part of a strong June wave of open-weight drops.

NVIDIA's Nemotron 3 Ultra (about 550B total / 55B active, mixture-of-experts) landed as open weights — the top-scoring US open-weights model on the Artificial Analysis index at release, built for deep reasoning and research workflows.

Apple has sued OpenAI alleging trade-secret theft, claiming the misconduct was directed by OpenAI's senior leadership and involved a longtime former Apple employee. The suit sharpens the legal and competitive tension between two of the biggest players building consumer AI.

Lyzr, which builds AI agents for enterprises, says it used its own agent to raise a $100 million round — presenting the deal as live proof that the product actually does the work. TechCrunch frames it as an unusual 'the product ran the process itself' moment for the agent market.

Product Hunt's AI category in early July 2026 is dominated by agent-infra and memory tools: scritty ("shared, searchable memory for every AI coding agent"), Knowledge Atlas by Fini ("self-learning knowledge base that improves itself"), Retrace ("debug AI agents by replaying and forking runs"), Compendium, agents-cli, and Mozaik (a TypeScript runtime for self-organizing agents).

The Government of Alberta has been running Claude Code with both Opus and Sonnet models against its own systems to review code, find vulnerabilities, and ship the fixes — a public-sector case study Anthropic published July 6.

Anthropic launched a Services Track and Partner Hub for the Claude Partner Network, plus an AI-enabled-cyber-threat mapping report with MITRE.

$65B Series H at $965B post-money; run-rate revenue reported crossing $47B; confidential S-1 submitted with a potential listing as soon as fall 2026.

Opus base unchanged at $5/$25 per 1M; fast mode $30/$150 to $10/$50; effort control as a token lever.