OpenAI's rogue test agent also breached a second firm during the Hugging Face hack

Anthropic ships MCP 2026-07-28, moving the protocol to a stateless core

Anthropic released the fifth Model Context Protocol spec, shifting MCP from a stateful, bidirectional protocol to a request/response model so servers can run on serverless and edge infrastructure, while hardening OAuth/OIDC authorization and adding a research-preview "MCP Tunnels" feature for reaching internal servers without exposing them to the internet.

why it mattersMCP has passed 400M monthly SDK downloads this year and is now the de facto standard for connecting agents to tools.

Claude (Anthropic)

Grok 4.5 rolls out in GitHub Copilot

xAI's Grok 4.5 is now available as a selectable model in GitHub Copilot, with a context window of up to 500,000 tokens, text and image input support, and adjustable reasoning effort aimed at agentic, multi-step coding tasks.

GitHub

GitHub Copilot for JetBrains adds MCP and custom-agent support inside Claude flows

The Copilot plugin for JetBrains IDEs now lets developers connect MCP servers and custom agents within Claude agent flows, alongside new OpenTelemetry export controls and model-management settings for enterprise deployments.

GitHub

OpenAI: no upcoming-release models were involved in the breach

In a July 28 update to its incident report, OpenAI said the most capable model involved was an internal-only research prototype never intended for public release, and that it has since been deactivated, encrypted, and cut off from further research access.

OpenAI

MIT-linked study ranks AI-enabled cyberattacks among top catastrophic risks

A new study cataloguing frontier-AI risk scenarios flags AI-assisted cyberattacks and bio/chem weapons development as the categories with the highest potential for catastrophe, landing just as the Hugging Face incident demonstrates real autonomous cyber capability.

Axios

GitHub Actions now holds suspicious workflow runs for manual approval

GitHub is automatically pausing workflow runs it flags as potentially malicious on public repositories until a collaborator with write access reviews and approves them via an authenticated session, with no configuration required.

why it mattersDirectly targets the pattern behind this year's wave of npm/PyPI supply-chain attacks: stolen credentials used to push malicious CI workflows.

GitHub

GitHub expands Dependabot malicious-package alerts to more ecosystems

Dependabot now surfaces alerts for known-malicious packages across additional package ecosystems, extending automated supply-chain-attack detection beyond its original npm and PyPI coverage.

GitHub

Node.js ships July 2026 security releases

The Node.js project published its scheduled security releases for July 2026, patching multiple vulnerabilities across currently supported release lines.

Node.js

Bitcoin slides toward $60K as Fed decision looms

Bitcoin fell to an 11-day low near $63,000, pressured by a rout in South Korean stocks and a stalled U.S. crypto bill, as traders position ahead of today's 2 p.m. ET Federal Reserve rate decision.

why it mattersToday's FOMC decision and Kevin Warsh's press conference are the single biggest near-term catalyst for BTC's direction.

CoinDesk

Senate shelves crypto market-structure bill before summer break

The U.S. Senate set aside the Digital Asset Market Clarity Act to prioritize Russia sanctions and nominations, pushing the crypto market-structure bill's vote window past its August recess and clouding the 2026 regulatory timeline.

CoinDesk

Analysts: a dovish Fed surprise could be Bitcoin's catalyst

With markets pricing roughly a 30% chance of a rate hike, analysts say any dovish language in Wednesday's FOMC statement or press conference could reverse Bitcoin's recent slide, while a hawkish surprise would likely deepen it.

CoinDesk