Supply chain security dominated developer tooling this week from two directions at once: GitHub coordinated three hardening changes to Actions, npm, and Dependabot in a single day, while a five-stage remote access trojan shipped inside compromised Joyfill npm packages, proof that the attacks these defenses target are not hypothetical. Model Context Protocol had its biggest week yet, with the protocol’s own specification dropping its session handshake entirely, GitHub’s Copilot code review reaching general availability under a read-only MCP constraint, and GitHub adding multi-select fields to the Projects and Issues data model those tools read from. AI development split between an industry fight and a research question: Anthropic stood alone against a 230-plus-signatory open-weights letter and then publicly denied favoring a ban, while a fourth skill-library regression paper, a $410 million recursive-self-improvement compute deal, and Google DeepMind’s whole-body robotics announcement all landed in the same window. Agriculture technology saw four distinct developments: Quercus Biosolutions and USA Drone Motors on the funding side, and Orbem and InnerPlant both extending hatchery- and crop-monitoring technology into new territory.

GitHub holds suspicious CI runs before they execute, not after

GitHub’s automatic workflow-hold change targets a specific, repeatable attack pattern: an attacker compromises a maintainer’s or contributor’s credentials, then pushes a malicious workflow file to a public repository. Because GitHub Actions workflows run with access to GITHUB_TOKEN and any configured secrets, that malicious workflow can exfiltrate CI/CD credentials and pivot into further attacks against downstream consumers or connected infrastructure. As of 2026-07-28, a workflow run identified as potentially malicious is held automatically, and a collaborator with write access must approve it through an authenticated web session before it continues. No configuration is required, and the protection applies by default to public repositories on github.com.

GitHub Enterprise Server (GHES) does not receive this protection at this time, a gap worth flagging for any organization still running self-hosted instances rather than the public github.com service. The same day, GitHub shipped npm publish-time malware scanning with dual-use metadata flagging and extended Dependabot malicious-package alerts to more ecosystems. Three changelog entries from one vendor on one day are not three independent security teams converging on the same conclusion; they are GitHub hardening its own package publishing, dependency alerting, and CI execution surfaces in a coordinated pass, following a month of smaller secret-scanning improvements through July (clearer detector names on 2026-07-10, extended metadata validation on 2026-07-07). Read plainly, it marks a shift in default trust posture for public CI, from executing first and detecting compromise after the fact to holding suspicious runs before they execute at all, and it sets a bar other CI platforms will now be measured against.

CodeQL 2.26.1 keeps building on the prompt-injection work from two weeks ago

CodeQL 2.26.1 shipped on 2026-07-29, improving framework coverage for Go, Java and Kotlin, and JavaScript and TypeScript, while reducing false positives in Rust analysis. The Go update expands modeling for the log/slog structured-logging package, covering Logger methods, With, WithGroup, Attr, and Value. Java and Kotlin analysis gained source, sink, and flow summary models for org.apache.poi, a widely used library for reading and writing Microsoft Office file formats, closing a gap where untrusted spreadsheet or document input could pass through undetected. JavaScript and TypeScript analysis added support for Angular’s @HostListener('window:message', ...) and @HostListener('document:message', ...) decorators, both common entry points for cross-window message injection. The release deploys automatically to every user of code scanning on github.com, with GitHub Enterprise Server support following in a later release, the same GHES lag pattern this week’s Actions workflow-hold change carries.

This is a single-vendor changelog entry, not independently corroborated coverage. What matters is the pattern it follows: CodeQL 2.26.0 shipped Kotlin 2.4.0 support and AI prompt-injection detection as a new static-analysis category on 2026-07-10. Static analysis for prompt injection is a young enough category that a second point release refining framework coverage two and a half weeks later signals GitHub is iterating on it quickly rather than shipping once and moving on, a pace to track as agent-integrated tooling keeps expanding the attack surface this category is meant to cover.

Node.js ships coordinated high-severity patches across three release lines

Node.js published security releases for its 22.x, 24.x, and 26.x lines on or shortly after 2026-07-28, each fixing a HIGH-severity issue in HTTP/2 handling. One flaw lets retained HTTP/2 header blocks evade the maxSessionMemory limit, giving a remote client a path to force unbounded memory growth on the server. The second is a re-entrancy bug: nghttp2_session_mem_send can be invoked while nghttp2_session_mem_recv is still executing on the same session, producing a heap-use-after-free condition, a memory-safety class that in the worst case is exploitable for remote code execution rather than only denial of service.

All three actively supported lines were patched in the same coordinated window rather than one line first with backports following, indicating the underlying nghttp2 code path is shared closely enough that the vulnerability and fix apply uniformly. Any Node.js deployment terminating HTTP/2 directly, rather than sitting behind a reverse proxy that already normalizes HTTP/2 framing before it reaches the application, is exposed to the memory-exhaustion path with no authentication and no application-level vulnerability required beyond running an affected version. Treat this as a mandatory patch window, not routine maintenance.

A five-stage remote access trojan shipped inside compromised Joyfill npm beta builds

Malicious beta builds of two widely used packages, @joyfill/components and @joyfill/layouts, appeared on the npm registry on 2026-07-28. StepSecurity discovered the campaign after automated scans flagged one layouts build as critical, and its analysis describes a five-stage implant: an in-bundle obfuscated loader, a blockchain-based command-and-control resolver that walks encrypted payloads across Tron, Aptos, and BNB Smart Chain transactions, two independently staged downloaders, and a final Socket.IO remote access trojan. Once active, the RAT can profile the infected system, list directories, upload and download files, read clipboard contents, and execute arbitrary JavaScript.

The detail that matters most for defenders: the malicious code executes when the package is imported, not during installation. The entire generation of supply chain scanning tooling built around install-hook inspection does not see this attack, because there is no install script to inspect. Running npm install --ignore-scripts, a common and previously effective mitigation, provides no protection here. Any lockfile referencing a 2026-07-28 or later beta of either package needs pinning back to a known-good release published before that date, followed by a full node_modules deletion and clean reinstall, since a cached copy of the malicious bundle survives a version bump in package.json alone. Five independent organizations reported or analyzed the compromise within days of the disclosure: StepSecurity, CyberSecurityNews, CyberPress, GBHackers, and Vulert, giving this genuinely broad corroboration rather than a single vendor’s claim.

Copilot code review reaches GA for MCP, and the read-only limit is the actual feature

Copilot code review’s support for agent skills and MCP server connections became generally available on 2026-07-29 for Copilot Pro, Pro+, Business, and Enterprise users, following an earlier public preview. Teams can now inject repository- or organization-specific review instructions by adding a SKILL.md file under a per-skill subdirectory in .github/skills (for example .github/skills/human-voice/SKILL.md), and pull live context into a review from any connected MCP server, whether that server exposes issue trackers, documentation platforms, or internal service catalogs.

The constraint underneath the feature deserves more attention than the feature itself: every MCP tool call Copilot code review makes is limited to read-only access, even when the underlying MCP server supports write operations. Copilot’s cloud coding agent, which does perform write actions, carries its MCP configuration over automatically, and GitHub’s own MCP server plus the Playwright MCP server are enabled by default, so every team gets a working baseline without setup. Review comments generated from skill or MCP context now carry explicit attribution, letting a reviewer distinguish a model’s own reasoning from injected external context. This is a defensible default for a workflow that sits adjacent to merge decisions without controlling them directly, and it lands six days after GitHub confirmed its own MCP Server supports the next Model Context Protocol specification (2026-07-23), suggesting GitHub is treating MCP as the standard interoperability layer across its entire agent product line rather than betting on it for one feature. Any team building a review-adjacent agent of its own should adopt the same read-broad, write-narrow pattern before expanding access.

The Model Context Protocol’s July 28 specification drops the session handshake entirely

The Model Context Protocol project published its 2026-07-28 specification, described by independent trackers as the largest revision since the protocol launched. The headline change removes the initialize/initialized handshake and eliminates the Mcp-Session-Id header entirely. Under the prior specification, a remote MCP server needed sticky sessions, a shared session store reachable by every instance behind a load balancer, and often deep packet inspection at the gateway to route follow-up requests correctly. None of that is required under the new stateless core; a server can now sit behind a plain round-robin load balancer with no session affinity at all.

This is an infrastructure decision wearing a protocol decision’s clothes. Removing session affinity does not change what an MCP server does from a client’s perspective, but it changes everything about how that server can be deployed and scaled, which is the actual precondition for MCP reaching production scale rather than remaining a research-grade protocol. SEP-2322, one of the specification’s own numbered enhancement proposals, introduces a second architecturally significant change: a Multi Round-Trip Requests pattern where a call to tools/call, prompts/get, or resources/read can return an InputRequiredResult instead of completing in one exchange, formalizing a pattern implementations were previously working around informally. Beta SDKs for Python, TypeScript, Go, and C# shipped the same day, alongside a formal extensions framework, response caching, and a deprecation policy. This connects directly to GitHub’s own MCP Server adopting the then-draft “next” specification on 2026-07-23 (noted in last week’s roundup): that was a preview against a moving target, and this week’s specification is the target itself becoming fixed.

GitHub adds multi-select fields to Projects and Issues

GitHub shipped multi-select fields for Projects and Issues in public preview on 2026-07-23, a long-requested capability that lets a single custom field hold more than one value at a time. Creating or editing a field now offers a multi-select type alongside the existing single-value options; teams can tag one item with, for example, several affected modules or several responsible teams instead of being forced to pick one value and lose the rest, then filter project views by any of the selected values.

This is a data-model change to GitHub’s own Projects and Issues surface rather than a specification or tooling release, so it sits at the edge of the API Design pillar rather than squarely inside it. The same week Copilot code review’s MCP integration reached GA (above), GitHub was also expanding the structured-metadata model that MCP-connected tools and agents ultimately read from and write to.

Anthropic stands alone against a growing open-weights letter, then denies favoring a ban

An open letter backing continued legality of open-weight AI models had 76 corporate signatories as of 2026-07-27, including Google, Microsoft, OpenAI, NVIDIA, Adobe, CrowdStrike, Cisco, Palo Alto Networks, Siemens, and Hugging Face, and grew past 230 organizations by 2026-07-30. Anthropic did not sign, and by 2026-07-27 venture capitalists David Sacks and Bill Gurley had publicly criticized the company, arguing the omission protects its business interests rather than reflecting a principled position. Dario Amodei published a rebuttal the same day denying that Anthropic advocates a category-wide ban, proposing three narrower measures instead: chip export controls, restrictions on industrial-scale distillation, and mandatory safety testing for the most capable systems. Amodei’s own concession is the most interesting detail: he acknowledged such restrictions would shield American labs from open-weight competition as a side effect, while framing his actual motivation around authoritarian-state capability and misuse risk.

The dispute traces back to Moonshot AI’s 2026-07-17 release of Kimi K3, an open-weight model with roughly 2.8 trillion parameters, among the largest publicly released models to date and a concrete demonstration that frontier-scale capability is no longer bottlenecked to labs willing to keep weights closed. The letter’s signatory mix, cloud and infrastructure vendors, security firms, and a direct model competitor in OpenAI, reveals whose commercial interest tracks with open weights staying legal: companies selling infrastructure benefit from a bigger open ecosystem regardless of which model wins, while Anthropic’s business is built almost entirely around proprietary API access. That alignment is consistent with, though it does not prove, the commercial-interest reading Sacks and Gurley offered.

The skill-library regression research keeps growing, two weeks running

Four arXiv papers converge on a question with direct stakes for anyone operating a production coding agent: does giving an agent a library of reusable skills reliably help, or does it sometimes lock the agent into patterns learned from a narrower context than the one it currently faces? “The Regression Tax: Decomposing Why Skills Help and Hurt LLM Agents” (arXiv:2607.22520) and two same-day companion papers, “Skill Self-Play: Pushing the Frontier of LLM Capability with Co-Evolving Skills” (arXiv:2607.22529) and “TRACE-ROUTER: Task-Consistent and Adaptive Online Routing for Agentic AI” (arXiv:2607.22465), all posted 2026-07-24 and were already covered in last week’s roundup as a coordinated research push on skill-library reliability.

What genuinely advances the narrative this week is a fourth paper, “Filesystem-Based Memory for LLM Agents: Organization, Evolution, and Sustainability” (arXiv:2607.26637), posted 2026-07-29, five days after the original three. It extends the same underlying concern, how accumulated agent knowledge should be organized and evolved over time, into the specific case of filesystem-backed memory rather than in-context skill libraries. The arrival of a fourth paper on the same theme nearly a week after the initial cluster suggests the research attention here is sustained rather than a single week’s spike, and it lands the same week GitHub’s Copilot code review reached general availability for skills defined in a SKILL.md file under a .github/skills subdirectory (see above), giving the regression-tax framing immediate practical relevance: any team building a skill library for a production coding agent now has a named failure mode to test against and, per Skill Self-Play, an early proposed mitigation to evaluate.

Grok 4.5 makes Copilot a four-model router in under two weeks

GitHub added Grok 4.5 to Copilot on 2026-07-28, the fourth frontier model the platform folded into its lineup within roughly two weeks; Claude Opus 5 and Gemini 3.6 Flash both arrived in the prior coverage window (already covered in last week’s roundup), and Grok 4.5 is the genuinely new addition here. The pace, one new frontier model roughly every two to three days, is paired with governance rather than left to grow unmanaged: GitHub shipped default model enablement changes for Copilot Business and Enterprise on 2026-07-29, enabled enterprise-managed settings for the Copilot app on 2026-07-27, and introduced a dedicated policy for managing Copilot app access the same day.

Read together, GitHub is betting that model choice itself, not allegiance to any single lab, is the durable competitive position for Copilot, provided the governance tooling gives enterprise administrators confidence to turn each new model on. For xAI, landing inside Copilot’s model picker is a meaningful distribution win independent of eventual usage share: it puts Grok in front of Copilot’s enterprise developer base without xAI building its own developer tooling integration. Google shipped a comparable signal the same week from a different angle, expanding managed agents in the Gemini API with Gemini 3.6 Flash support and new hook capabilities (2026-07-28), which suggests the model-agnostic router pattern is becoming an industry expectation for agent platforms generally, not a GitHub-specific strategy.

Gemini Robotics 2 puts whole-body control behind humanoid hardware

Google DeepMind announced Gemini Robotics 2 on 2026-07-30, a set of three models aimed at giving robots whole-body intelligence rather than the narrower single-arm manipulation most robotics models target. The vision-language-action model converts vision and language input directly into motor control, and for the first time controls an entire humanoid robot, demonstrated on Apptronik’s Apollo 2 performing sequences that combine walking, crouching, and object manipulation in a cluttered environment rather than an isolated tabletop task. The model operates both 22-degree-of-freedom hands and standard grippers, handling delicate tasks like tying knots and sealing containers, though DeepMind is explicit that multi-finger dexterous manipulation remains a hard, unsolved problem rather than something this release claims to close.

The second component, Embodied Reasoning 2, functions as the decision-making layer above motor control, managing multi-step tasks that run several minutes and involve hundreds of individual decisions, and coordinating multiple robots on a shared task. DeepMind also reports fast adaptation to new robot embodiments, claiming a working model for a new hardware platform from a few hours of data and fewer than 200 examples, a meaningfully lower bar than the data requirements robotics fine-tuning has typically needed. The release includes new ASIMOV-Agentic safety benchmarks and enhanced human-proximity detection aimed at collaborative settings where a robot shares physical space with people. The announcement carries DeepMind’s own framing plus real community engagement (a same-day Hacker News discussion scored 222 points), rather than independent third-party reporting; treat the specific capability claims as vendor-stated until outside labs or deployments corroborate them.

A $410 million Amazon deal and a new benchmark both target recursive self-improvement

Recursive Superintelligence signed a $410 million compute deal with Amazon, reported 2026-07-28. The same day, researchers from Evolvent AI and the National University of Singapore published RSIBench-Data (arXiv:2607.25886), a benchmark that scores LLM agents specifically as data-centric researchers: can an agent diagnose a model’s actual capability gaps from evidence of its failures, design a training-data strategy targeted at those gaps, and validate the result through checkpoint feedback, rather than merely completing a task.

Neither event alone would carry much weight; a compute deal is a business story and arXiv publishes agent-evaluation papers on a near-daily cadence. What makes the pairing notable is the coincidence of subject and timing: a nine-figure compute commitment to a company organized specifically around recursive self-improvement, landing the same day as the first benchmark that treats recursive self-improvement as a measurable, data-centric research task rather than a capability discussed mainly in policy and safety papers. This follows roughly two weeks of contested claims about whether recursive self-improvement is materializing in practice, and the pairing does not resolve that debate. It does mark a shift in how the question is approached, from asking whether this is happening toward asking how it would be measured if it were, and a $410 million bet from a major cloud provider says infrastructure money is now pricing this in as a near-term capability rather than a long-horizon research program.

Quercus Biosolutions borrows pharma’s protein design tools to fight herbicide resistance

Quercus Biosolutions closed an oversubscribed $5 million seed round on 2026-07-29, led by Serra Ventures, to build a new category of crop protection based on AI-designed mini proteins. The detail that sets this raise apart is where the underlying AI tooling comes from: Quercus uses machine learning methods first developed for drug discovery, sourced from partner Ordaos Bio, to design proteins that bind to validated biological targets inside resistant weeds. That is a direct transfer of pharmaceutical computational-biology infrastructure into agricultural chemistry, not a bespoke agtech modeling stack built from scratch.

The round’s backer list mixes impact-oriented and commodity-grower capital, spanning the Grantham Foundation for the Protection of the Environment alongside the Iowa Corn Opportunities Fund, Kentucky Corn Plus, and AgVentures Alliance. That combination suggests the pitch works for both environmental-outcome investors and grower-organization funds with a direct stake in solving herbicide resistance, a problem that has spread across major weed species for years while biological alternatives have historically struggled to match chemical herbicides at scale. Designer proteins aimed at specific, validated biological pathways represent an attempt to bring the same rational-design discipline chemical mode-of-action development has long used into a biological product. Quercus’s raise sits alongside other 2026 agtech biological-input rounds using AI-driven design, including Moa Technology’s herbicide mode-of-action work covered in an earlier roundup, reinforcing that agtech venture capital this year is concentrating on biological substitutes for chemical inputs using tooling borrowed directly from pharma, not on robotics or sensor hardware. The same coverage window still had a hardware-side counterpoint: USA Drone Motors emerged from stealth on 2026-07-24 to target a gap in the domestic drone supply chain, confirming that agtech capital did not go entirely quiet on the physical-equipment side even as biological inputs dominated this week’s raises.

Orbem’s MRI-based in-ovo sexing reaches its first US hatchery

Orbem began operating its first MRI-based in-ovo sexing system in the United States, reported 2026-07-27, with a second installation expected online in mid-August and a third project scheduled for 2027. The company has not yet named the hatcheries involved, though its head of global business development said an announcement from one of the large retailers should follow soon. In-ovo sexing determines a chick’s sex before hatching, letting a hatchery remove male layer eggs from the incubation process entirely rather than incubating them the full 21 days only to cull the chicks shortly after hatching, the standard practice the technology is built to replace.

Orbem’s Genus Focus system is fully automated and modular, processing up to 24,000 eggs per hour across as many as eight modules running in parallel, each handling 3,000 eggs per hour independently. The US entry follows Orbem closing a EUR 55.5 million Series B in January, led by Innovation Industries with Supernova Invest and existing investors participating, and follows earlier commercial-scale deployment work with Hendrix Genetics. This is a single-source item for the coverage window, an AgFunderNews report with no independent corroboration yet, worth tracking rather than treating as fully confirmed until a named hatchery or retailer partner surfaces.

InnerPlant extends its living-plant disease sensor network from soybeans into corn

InnerPlant’s CropVoice network uses genetically engineered plants that fluoresce when infected, giving growers a real-time signal of fungal disease pressure before symptoms are visible. Reporting on 2026-07-27 described the network expanding into a combined offering, CropVoice Whole Farm, that adds InnerCorn as a companion to the existing InnerSoy soybean coverage. InnerCorn is scheduled to launch in 2027 as an add-on for growers already enrolled in a CropVoice InnerSoy tier, priced from 1,000 to 5,000 dollars depending on soybean acreage.

The expansion is a distribution decision built on already-proven technology, not a new scientific claim: InnerPlant’s underlying real-time fungal detection reached Illinois growers earlier in July across multiple independent broadcast and local news outlets, and CropVoice was named one of TIME’s Best Inventions in 2024. The open question for InnerCorn is adoption, whether existing soybean customers see enough value in adding corn coverage to justify the additional per-acre cost, since the company is selling an add-on to an installed base rather than acquiring net-new customers. This candidate carries lighter sourcing than most of this week’s other findings: the Whole Farm expansion itself is reported in one trade-press item within the coverage window, with the broader real-time detection technology’s stronger multi-outlet corroboration dated in mid-July, outside this window.

Research Highlights

Several papers from this week’s Hugging Face daily papers list bear directly on developer tooling and coding agents. CodeNib (arXiv:2607.25431, 73 upvotes) proposes a multi-view data system for serving repository context to coding agents, addressing a practical problem every production coding agent eventually hits: deciding which parts of a large repository to surface for a given task without either starving the model of context or drowning it. ReDesign (arXiv:2607.25565, 58 upvotes) tackles a narrower but concrete problem, recovering editable design structures from images through agentic decomposition, relevant to any tool pipeline that needs to turn a screenshot or mockup into structured, editable source.

Keep It InMind (arXiv:2607.24368, 28 upvotes) benchmarks a specific failure mode in agent memory systems, an implicit-association blind spot where an agent fails to connect related facts stored separately in memory, a finding with direct relevance to the agent-memory tooling proliferating across coding assistants. CAST (arXiv:2607.25308, 27 upvotes) uses game solvers as turn-level teachers for LLM agents, a training approach distinct from the skill-library regression research covered above. MindForge (arXiv:2607.27146, 13 upvotes) teaches small language models whole-life-cycle software engineering through source-free program synthesis, worth watching for teams evaluating whether smaller, cheaper models can handle more of a coding agent’s workload than current deployments assume.

Two additional papers from this week’s arXiv listings fall outside the coding-agent theme but are worth flagging. “Linguistic Monoculture in LLM-Assisted Language Use” (arXiv:2607.27134) builds a mathematical framework modeling authors and LLMs as coevolving distributions over linguistic features, and finds that widespread reliance on a small number of shared models can measurably reduce population-level variation in written language, a governance-adjacent concern distinct from the agent-performance questions the rest of this section covers. “On-Policy Distillation for LLM Safety: A Routing Approach to Template-Robust Realignment” (arXiv:2607.27081) addresses a narrower security problem: fine-tuned models that retain a malicious behavior planted in their training data can often be re-jailbroken by simply switching the system prompt template a defender did not anticipate, and the paper’s routing-based distillation approach maintains safety alignment without collapsing on an unseen prompt template, unlike the defenses it compares against.

Developer Tools:

API Design:

AI Development:

Agriculture Tech:

Research:

Follow @zircote for weekly roundups and deep dives on AI development, developer tools, and agriculture tech.