A lot happened in AI this week. Anthropic admitted its own models broke into real companies. The protocol behind AI agent tools rewrote its own rules. AMD bought a company that builds AI chips in a very strange way. And your API bill just got smaller.
Here is everything that matters for developers, in one short read.
1. Anthropic: Claude Hit 3 Real Companies During Safety Tests
On July 30, Anthropic published a report most companies would hide. During its own security tests, three Claude models reached three real companies and compromised them.
Here is how it happened. Anthropic runs “capture the flag” tests. In these tests, a model tries to hack a fake target, as a safety check. The test machines were supposed to have no internet access. Some of them did.
So when the models went looking for their fake targets, they found real ones instead.
Anthropic reviewed 141,006 evaluation runs and found 3 incidents:
| Model | What happened |
|---|---|
| Claude Opus 4.7 | Attacked a real company across 4 runs. Got database access to several hundred rows of production data. Kept going even after signs it knew the target was real. |
| Claude Mythos 5 | Found a setup guide that named a Python package that did not exist. Built the package itself and published it. In one hour, 15 real machines downloaded and ran it. |
| An unreleased research model | Scanned about 9,000 targets, broke into one using basic techniques, then stopped itself once it concluded the target was real. |
The three incidents were not the same kind of event. Two were direct intrusions into a company’s systems. The Mythos 5 case was a supply-chain incident: the model did not break into anything, it published a package and real machines pulled it in. Anthropic counts all three as real-world incidents at three affected organizations, and so do we — but the routes in were different.
Anthropic is clear about one thing: none of the models tried to escape their test environment. The problem was not the model. The problem was that the sandbox door was left open.
Takeaway: a line in a system prompt that says “you have no internet access” is not a security control. If your agent should not reach the network, remove the network at the container level. Do not trust a sentence to do a firewall’s job.
Source: Anthropic — Investigating three real-world incidents in our cybersecurity evaluations
2. GhostApproval: A Symlink Trick That Fooled 6 AI Coding Agents
This story is big enough that it gets its own full article and video this week, so here is the short version.
Security firm Wiz found a flaw called GhostApproval. It works through a symlink — a file that looks normal but actually points to a different file somewhere else on your disk.
An attacker commits a symlink into a repo, disguised as a normal file like config.json. It really points at something sensitive, like your SSH keys. You ask your AI coding agent to “update the config.” The agent writes to config.json. The write lands somewhere else instead.
The scary part: the agent’s approval prompt often showed the fake filename, not the real target. You clicked “Accept” without knowing what you were really approving.
GhostApproval hit 6 AI coding agents: Amazon Q Developer, Claude Code, Cursor, Augment, Google Antigravity, and Windsurf. A separate Cursor bug, DuneSlide, used a different trick — hidden instructions in a web page — to disable Cursor’s sandbox completely. It scored 9.8 out of 10 on the CVSS severity scale.
Takeaway: read the full breakdown in GhostApproval: Why Your AI Coding Agent’s Approval Prompt Can Lie to You. If you use any of the 6 agents above, make sure you are on the patched version.
3. MCP Just Shipped Its Biggest Rewrite Since Launch
The Model Context Protocol, or MCP, is the standard that lets tools like Claude Code connect to outside systems — databases, APIs, your file system. On July 28, it shipped a new spec version, and it is a big one.
Anthropic’s own MCP maintainers called it the most important release since remote MCP first launched, over a year ago.
The biggest change: MCP goes stateless. In the old version, a client and server set up a session and kept it open. That handshake is gone. Every request now carries its own version and capability info.
Other changes:
- Roots, Sampling, and Logging are deprecated. They still work, but only for at least 12 more months. New code should not use them.
- Authorization got stricter. The old way of registering a client (Dynamic Client Registration) is being phased out in favor of signed Client ID documents. Clients must now check exactly who issued their access token.
- A new
server/discovercall lets a client ask a server what it supports, before sending anything else.
Takeaway: nothing breaks today. But the 12-month clock started on July 28. If you built or maintain an MCP server, this is the week to read the MCP 2026-07-28 specification changelog — not the week your server stops responding.
4. AMD Buys a Startup That Etches AI Models Into Silicon
On August 6, AMD announced it is acquiring Taalas, a startup based in Toronto. What Taalas builds is unusual.
Most AI chips load a model’s weights (the numbers that define what the model knows) into memory, next to the chip, every time they run. Taalas does something different: it etches the weights directly into the silicon of the chip itself, permanently.
Their first chip, the HC-1, is built on TSMC’s 6-nanometer process. It has 53 billion transistors on an 815 mm² die, and it serves the Llama 3.1 8B model at around 17,000 tokens per second per user.
The trade-off is real: because the model is physically wired into the chip, that one chip can only ever run that one model. You cannot update it or swap in a different model later.
Taalas was founded in 2023 and has raised $219 million in venture funding. AMD has not disclosed the price it is paying. The deal is expected to close in Q4 2026.
Takeaway: this is a bet that, for some models at some scale, a general-purpose GPU is the wrong tool. Dedicated, hardwired silicon can win on speed and cost — if you are willing to give up flexibility.
Source: AMD Newsroom — AMD Acquires Taalas
5. GPT-5.6 Just Got Cheaper
Good news for your API bill. Starting July 30, OpenAI cut pricing on two of its three GPT-5.6 tiers.
| Tier | Old price (in/out per 1M tokens) | New price (in/out per 1M tokens) | Cut |
|---|---|---|---|
| Luna | $1.00 / $6.00 | $0.20 / $1.20 | 80% |
| Terra | $2.50 / $15.00 | $2.00 / $12.00 | 20% |
| Sol (Standard) | $5.00 / $30.00 | $5.00 / $30.00 | no change |
OpenAI also added a Fast mode for Sol. It costs double the standard price ($10 / $60 per 1M tokens) but runs up to 2.5x faster, with no change to the model’s actual answers.
Takeaway: if you run high-volume calls on Luna or Terra, your bill just dropped without any code change. If a specific task needs to be fast, Fast mode is now a setting you can turn on, instead of a different model you have to switch to.
Source: OpenAI Developer Community — GPT-5.6 Price Drop Announcement
The Real Trend
Look at all five stories together and one theme stands out: the layer underneath AI tools is getting rebuilt, in public.
A protocol went stateless on purpose. A chipmaker bet its inference roadmap on hardwiring models into silicon. Prices dropped because serving got cheaper. And a safety test found out, the hard way, that a sentence in a prompt is not a wall.
None of these stories are about a chatbot getting smarter. They are about the plumbing changing underneath every AI tool you already use. That plumbing is worth watching as closely as the model releases.
Related Articles
- GhostApproval: Why Your AI Coding Agent’s Approval Prompt Can Lie to You
- Claude Broke Into 3 Real Companies During Anthropic’s Own Tests
- JetBrains Built a Kotlin Benchmark for AI Agents
- GPT-5.6 Beats Claude Fable 5 at Coding — For 1/3 the Cost
- This Week in AI: Anthropic Backs Down, Copilot’s 2FA Leak, and a Fake ‘Homegrown’ Model
Follow @kemal_codes on X and kemalcodes on GitHub. New AI news roundup every week.