Anthropic reveals three cybersecurity incidents, DeepSeek relaunches its API, Copilot gets a makeover in VS Code

On July 31, 2026, Anthropic publishes a voluntary and detailed disclosure of three real incidents that occurred during its cybersecurity evaluations, where Claude models gained unauthorized access to production systems from a misconfigured test environment at a partner. DeepSeek emerges from two months of silence by bringing DeepSeek-V4-Flash back as an official API with sharply improved agentic scores, while GitHub publishes its monthly Copilot report in Visual Studio Code, marked by a complete redesign of the Agents window and the arrival of Git worktrees. Around these three topics, the expansion of the Open Secure AI Alliance to Cohere and Genspark, the first public statement from Hugging Face’s CEO on the July cyberattack, and several releases from Devin, Qwen, NVIDIA Research, and Google are also in the spotlight.

Anthropic reveals three real incidents discovered in its cybersecurity evaluations

July 30 — Anthropic publishes a voluntary and detailed disclosure of three incidents that occurred during its internal cybersecurity evaluations, echoing OpenAI and Hugging Face’s July 21 revelation, already covered. After this announcement, the company reviewed 141,006 evaluation runs that potentially had internet access, and identified three incidents (six runs in total) in which a Claude model reached the real internet from its third-party partner Irregular’s misconfigured test environment, even though the evaluation prompt explicitly stated that there was no internet access.

In each of the three capture-the-flag (CTF) exercises, the model treated the real systems it encountered as part of the simulation and gained unauthorized access to the production infrastructure of three separate organizations. The most striking case: Mythos 5 spotted the name of a Python package to install in a fake onboarding document, created a PyPI account, and then published a malicious package under that name — it remained online for about an hour, was downloaded and executed on 15 real systems, including that of a security company that automatically scanned it, before being neutralized.

The most revealing point is behavioral, not technical: when faced with similar clues that the target was real, Opus 4.7 continued its attack until it extracted several hundred lines of production data, while the most recent of the three internal research models, unable to reach its fictitious target, eventually recognized the situation on its own after scanning about 9,000 targets, and stopped its actions of its own accord.

Anthropic describes the incident as an operational failure rather than an alignment issue — the safeguards deployed on public models, absent during these evaluations, would have blocked this behavior. The company stopped all cyber evaluations as soon as the first suspicious transcripts were discovered on July 23, identified the three incidents the next day, and then notified the partner and the organizations concerned on July 27 — two of them had not detected the activity before being contacted. Anthropic is now working with METR on an independent review, and plans to publish a redacted version of the PyPI incident transcript within a week.

Incident observed	Model involved	Concrete outcome
Incident 1	Opus 4.7	Access to a production database; the model continued its attack despite signs that it was real
Incident 2	Mythos 5	Malicious PyPI package published, active for about an hour, executed on 15 real systems
Incident 3	Internal research model	About 9,000 targets scanned; the model recognized the real situation and stopped its attack on its own

Claude did what capture-the-flag exercises train cyber experts to do: look for ways to reach the flag. […] having been told in the system prompt that there was no internet access, Claude believed everything it initially encountered was part of the simulation, and treated the real systems it found as pieces of the exercise. — Anthropic, blog post

🔗 Full thread — @AnthropicAI on X

Hugging Face CEO breaks silence on July cyberattack

July 31 — In an interview on CNN, Clément Delangue, cofounder and CEO of Hugging Face, speaks publicly for the first time since the cyberattack documented in the technical report of July 27, already covered. He says that the attack came from “secret, unpublished proprietary models,” without providing further details on their origin, and that Hugging Face defended itself using an open model: NVIDIA’s quantized version of GLM 5.2, developed by Zai.org. Delangue turns this into a public policy argument: banning open models would primarily hurt cybersecurity defenders, startups, small businesses, and researchers who cannot afford a state-of-the-art lab and need affordable, controllable on-prem models to protect themselves. This statement is not an isolated event, but a notable factual addition to a case already underway since late July.

We got attacked by secret unreleased proprietary models and defended ourselves with an open model, more precisely the @nvidia quantized version of GLM 5.2 coming from @Zai_org. Banning any open model would hurt first cyber security defenders, startups, small companies, researchers and everyone who’s not a frontier lab and need on-prem affordable controlable models to compete and protect themselves. Let’s not do that! — @ClementDelangue on X

🔗 Full CNN interview

Open Secure AI Alliance expands to Cohere and Genspark

July 30 — Two new memberships in the Open Secure AI Alliance, the security coalition launched by NVIDIA on July 27 and already covered, are highlighted the same evening by their respective accounts. Cohere announces that it has joined the alliance alongside other industry leaders; the company joins Perplexity, already a founding member since the launch. Genspark, for its part, says it has joined NVIDIA, Microsoft, IBM, and Cognition within the same coalition. So this is not a new initiative, but the ongoing expansion of an alliance that already brings together nearly 70 companies in cloud, cybersecurity, and AI research — including Adobe, Cisco, Databricks, Docker, GitHub, Hugging Face, Microsoft, Mistral, Red Hat, Salesforce, and SAP — to develop open tools for securing AI agents. This double expansion, occurring in the same month as the Anthropic and Hugging Face incidents detailed above, takes on special significance: the industry is building a collective response at the very moment individual incidents are piling up.

NVIDIA’s original announcement had in fact presented the Hugging Face security incident as the alliance’s founding use case: closed AI tools, unable to distinguish attackers from defenders, had blocked the necessary forensic analysis, while an open model run internally by Hugging Face had made it possible to analyze more than 17,000 actions and contain the intrusion. Among the technical contributions already added to the alliance: the zero-trust identity framework SPIFFE/SPIRE led by HPE, the secure weights format Safetensors contributed by Hugging Face to the PyTorch Foundation, and NOOA, a new open source framework from NVIDIA Labs for agent harnesses.

🔗 Cohere joins the alliance

🔗 Genspark joins the alliance

DeepSeek relaunches its API after two months of silence with DeepSeek-V4-Flash-0731

July 31 — After an almost total silence since May 22, DeepSeek publishes two consecutive posts on its official account: DeepSeek-V4-Flash exits preview and becomes the official API, under the dated reference DeepSeek-V4-Flash-0731, with sharply improved agentic scores. The lab claims results that now far exceed those of its own larger model, V4-Pro-Preview — a notable reversal in which the fast variant outperforms the “Pro” variant across all communicated benchmarks, from Terminal Bench 2.1 to DSBench-Hard.

V4-Flash-0731 also natively supports the Responses API format and says it is “fully adapted for Codex,” a sign of an explicit effort to ensure compatibility with the ecosystem of third-party agentic tools — Claude Code, GitHub Copilot, and OpenCode are named in the official documentation as integrable without additional code. A second post specifies that this update keeps exactly the same architecture and model size as the preview: this is therefore a capability update rather than a new architecture, and it concerns only the V4-Flash API — the V4-Pro models (API, app, web) remain unchanged for now, with the official release of V4-Pro announced as imminent.

The official documentation (api-docs.deepseek.com) confirms the change right on its homepage, with no modification to the call method for existing integrations. Victor M, Head of Product at Hugging Face, launched a free public endpoint with no authentication for this new checkpoint the same day, relayed by the official @huggingface account. A community comparison shared by Together AI also highlights the model’s token efficiency against GPT-5.6 Luna. This is DeepSeek’s most significant move in nearly two months of silence.

Benchmark evaluated	V4-Flash-0731	V4-Flash Preview	V4-Pro Preview
Terminal Bench 2.1	82,7	61,8	72,1
Cybergym	76,7	38,7	52,7
DeepSWE	54,4	7,3	12,8
Toolathlon-Verified	70,3	49,7	55,9
DSBench-Hard	59,6	25,8	31,1

🔗 Official announcement — DeepSeek on X

Qwen launches Qwen-Audio-3.0-ASR-Flash, a specialized speech recognition model

July 31 — Qwen (Alibaba) launches Qwen-Audio-3.0-ASR-Flash, a new family of speech recognition models (ASR — Automatic Speech Recognition) within the Qwen-Audio 3.0 lineup. Unlike Qwen Audio 3.0 Realtime, the speech-to-speech model already covered on July 28, this variant specifically targets transcription: contextual consistency over long passages, improved recognition of domain vocabulary, support for custom hotwords, and polishing speech into structured transcriptions. In internal tests, Qwen reports a 95.36% recall rate on medical terms and 93.24% on industrial terms. Three variants are available immediately via Alibaba Cloud Model Studio, each with its own API documentation: a real-time streaming version, a version for recorded files (Filetrans), and a base version (Flash). This release confirms Alibaba’s sustained pace of specialized audio publications, just one month after the launch of the already top-ranked speech-to-speech Realtime model in its category — rather than a general overhaul of the lineup, it is a focused addition aimed at a specific professional use case: transcribing technical vocabulary.

Metric evaluated	Measured result
Recall for medical terms	95,36 %
Recall for industrial terms	93,24 %

🔗 Announcement — Qwen on X

GitHub Copilot in Visual Studio Code: July 2026 roundup

July 30 — GitHub publishes its release roundup for VS Code v1.127 to v1.131, released throughout July 2026. The Agents window (public preview) gets a complete redesign: a reworked editor panel for opening files and diffs alongside the conversation, add/remove counts per file, and a toggle between compact, inline, or side-by-side display. The most notable new feature: it is now possible to start Copilot, Claude, or Codex sessions in a Git worktree, with each session working in an isolated copy of the repository — multi-agent support that goes beyond the Copilot product alone. Sessions can be grouped, reordered via drag and drop, and each sub-agent now shows its model, elapsed time, and active tool call without losing track of the parent conversation.

Multi-chat sessions, whose foundation already existed since the June roundup covered in early July, gain dedicated support for Claude, the ability to “fork” a conversation at a given point to explore another path without losing the original context, and fully keyboard-based navigation. Business and Enterprise users can now track their AI credit usage directly in the Copilot status menu, and a ! prefix lets you launch a terminal command directly from a chat message.

On the editor and accessibility side: the modernized VS Code UI preview is enabled by default in Insiders, files can be opened directly from terminal diffs, the placement of integrated browser tabs is configurable, prompt files are being migrated to reusable skills, and there is an experimental feature for editing Markdown files directly in the Agents window with comments that an agent can act on. The general availability of Copilot Vision, mentioned in this same post, had already been announced in early July and is not a new item in this roundup.

Delivered feature	Concrete detail
Git worktrees	Copilot, Claude, or Codex sessions launched in an isolated copy of the repository
Multi-chat sessions and fork	Multiple exchanges per session, with the ability to fork a conversation at a given point
BYOK in the Agents window	User-provided models, previously limited to the editor, now also usable by agents
Built-in dictation	Optional cleanup of the transcription by Copilot, better screen reader control in the terminal

🔗 July roundup — GitHub Copilot in VS Code

Devin (Cognition) adds native iOS development support

July 31 — Cognition announces that Devin’s cloud agents now run on a true macOS environment, with Xcode, the iOS simulator, and the user’s signing setup, in addition to full computer use. This change removes a well-known bottleneck in iOS development — the need to have a physical Mac — and allows Devin to design, compile, run, and test native iOS apps end to end in the cloud, as shown in a demo where the agent builds a native iOS game and then plays and tests it itself. This announcement extends Cognition’s multi-OS strategy: the company had already added support for Windows in VMs and Android emulators, both in May 2026. With macOS/Xcode, Devin now covers the three major native development environments (Linux, Windows, macOS/iOS) from fully agent-managed cloud machines — without a developer needing to own the corresponding machine in order to ship a native app.

You can’t build iOS apps without a Mac, so we gave Devin one. Devin Cloud Agents now run macOS, with Xcode, iOS simulator, and your signing setup, all in a real macOS environment (with full computer use). In this demo, Devin builds a native iOS game, then plays and tests it. — @cognition on X

July 2026 Gemini Drop: avatar in images, new connected apps

July 31 — Google publishes its monthly Gemini Drops roundup for July 2026, listing six new features for the month. Three of them overlap with announcements already covered — contextual dictation on macOS and Gemini Spark’s global rollout — or fall outside the window, such as the launch of Gemini 3.6 Flash on July 21. The truly new items: the ability to insert yourself into a generated image using a personal avatar, without having to re-upload your photo each time; new app connections with Dropbox (file organization), Viator (activity booking), and Zillow (rental housing search), which join the existing integrations; and the rollout to all U.S. users of interest-based personalized image generation, previously limited to a small test. The exact names of the new connected apps were confirmed by a roundup thread posted the same day by the @GeminiApp account, consistent with the official post, and add to the already long list of third-party services that can be driven by the assistant in natural language.

🔗 Gemini Drop — July 2026

NVIDIA Research releases Spatial-IQ, a 3D spatial reasoning benchmark

July 31 — NVIDIA Research releases Spatial-IQ, a diagnostic benchmark for 3D spatial reasoning in multimodal models, focused on object counting — including partially hidden objects. Rather than a single global score, the task is broken down into nine distinct perceptual and cognitive subtasks, each scored separately, to pinpoint exactly where spatial reasoning fails. The gap with humans is striking: 82.1% human accuracy versus only 17.7% for the best general-purpose multimodal model tested as-is. NVIDIA also shows that training a model specifically on these subtasks yields a massive and measurable gain, rather than a misleading final score: Qwen2.5-VL-32B’s counting accuracy rises from 2.9% to 62.6% after this targeted training. The methodological value highlighted by NVIDIA goes beyond this single model: this breakdown into subtasks allows researchers to identify precisely where reasoning fails, and then verify that progress reflects a real composition of skills rather than a simple score boost. The paper, dataset, and code are released openly.

Measured topic	Score obtained
Human accuracy (counting with hidden objects)	82.1 %
Best general-purpose multimodal model (as-is)	17.7 %
Qwen2.5-VL-32B before targeted training	2.9 %
Qwen2.5-VL-32B after targeted training	62.6 %

🔗 Spatial-IQ — NVIDIA Research

Suno adds natural-language prompt-based cover art generation

July 31 — Suno adds natural-language prompt-driven visual cover art generation (cover art), directly integrated into the song and playlist publishing flow. Creators can now describe what they want to see instead of choosing from generic visuals or importing an external image, with the stated goal that every published track should have an image worthy of it. The feature is illustrated by Suno with a concrete example, the title “ORBITING YOU,” whose cover is generated directly from a text description rather than chosen from a library of predefined visuals. It fits into a broader trend among generative audio platforms to directly integrate the visual production associated with a track, rather than leaving it to third-party tools. Previously centered on audio generation, the platform is thus extending its reach across the entire publishing process, from composition to the final visual presentation.

🔗 Announcement — Suno on X

Briefs

Two network outages reduce Claude availability — Two separate incidents within 24 hours caused elevated errors or reduced availability for some users on July 30, caused by multiple network outages that reduced service capacity while traffic was being rerouted. Capacity restored according to @ClaudeDevs, who recommends following status.claude.com for any further developments. 🔗 source
Replit and Kanz set a Guinness World Record — 14,075 builders gathered in a single live session with Replit Agent to set the record for the largest AI-assisted video course, the result of the livestream teased the day before. 🔗 source
Together AI details the resource model for Dedicated Model Inference — Request routing between deployments is now based on capacity, calculated per ready replica, rather than fixed percentages; scaling automatically adjusts each deployment’s share, and not-ready replicas receive no traffic. A detailed article by Mitali Meratwal, published on July 28, describes the underlying three-primitive architecture (endpoints, deployments, configs). 🔗 source
Sakana AI reveals the name of its foundation model, Namazu — An in-depth interview with Sota Omura, head of product development, looks back at the strategy behind four launches in one year (Chat, Marlin, Fugu, Translate) and defends a philosophy of not relying on a single model, with Marlin and Fugu positioned as multi-model orchestration products rather than direct competitors to foundation labs. 🔗 source
Antigravity CLI moves to version 1.1.9 — Expansion of slash commands and skills in print mode, non-blocking MCP loading on interactive startup, session-wide permission memory, and seven stability fixes for hooks and MCP authentication. 🔗 source
Glanceboard, a vibe-coded app with Gemini 3.6 Flash and Nano Banana — A creative technologist at Google builds an open source application that every morning displays, on an e-ink screen, an illustration of his children dressed according to the day’s weather, generated from the family calendar. The code and details of the hardware used are published on GitHub, with a suggestion to rebuild it via Google Antigravity. 🔗 source
Gemini Robotics ER 2: new demo on a Franka FR3 Duo dual arm — A Google DeepMind researcher presents 20 minutes of uninterrupted real-time tool preparation, with emergent recovery behaviors; this demo complements the July 30 launch, and does not introduce a new model. 🔗 source
Enterprise teams model policy targeting in public preview — New granularity for AI model governance at the enterprise team level (enabled, disabled, or optional), in addition to the organization level; access is evaluated according to the least restrictive policy, and rollout begins gradually on August 3. 🔗 source
Runway adds MiniMax H3 to its platform — The model joins Runway’s multi-model catalog, alongside the other frontier models already available on the same platform. 🔗 source
OpenAI’s CFO publishes an essay on intelligence abundance — Sarah Friar cites unprecedented scale figures: more than one billion active users and more than two million business customers across all OpenAI products, with 50% more daily messages and about twice as many types of tasks covered six months after signup. A striking number on the developer side: Codex now accounts for 99.8% of the output tokens generated internally each week at OpenAI. 🔗 source
Cohere signs the EU Code of Good Practice for transparency of AI content — The company becomes one of the first in the world to sign this voluntary code tied to Article 50 of the AI Act, after having already signed the Code for General-Purpose AI Models. 🔗 source

What It Means

The security of autonomous agents is emerging as the week’s main thread. After OpenAI and Hugging Face’s disclosure on July 21, Anthropic is, in turn, voluntarily publishing the details of three incidents in which Claude models compromised real systems from a misconfigured evaluation environment at a partner — the company frames this as an operational failure, not an alignment problem, and is bringing in METR for an independent review. The behavioral contrast between the models involved is the real signal to take away: faced with the same clues that a target was real, Opus 4.7 persisted in its attack while the newest research model stopped on its own. Hugging Face CEO Clément Delangue adds to the record by revealing that the July attack came from unpublished proprietary models and that the defense relied on an open model, GLM 5.2. In this context, the expansion of the Open Secure AI Alliance to Cohere and Genspark — nearly 70 members since its launch on July 27 — takes on particular significance: the industry is building a collective response at the very moment when individual incidents are piling up.

Open model labs are taking back the initiative. DeepSeek is emerging from two months of silence with DeepSeek-V4-Flash-0731, whose agentic scores now surpass its own larger model, and native compatibility with Codex and the Responses API that is aimed directly at third-party agent tool ecosystems rather than just internal use. Qwen is expanding its audio lineup with an ASR model specialized in medical and industrial domain vocabulary, while GLM 5.2 (Zai.org) is being cited as a defense tool in a real-world cyberattack — the best accidental illustration of Delangue’s point: open models are also security infrastructure, not just a cheaper alternative to closed models. Three distinct labs (DeepSeek, Qwen, Zai.org) are publishing or being cited in the same month, a sign that competition in open models, for a time overshadowed by closed releases from Anthropic and OpenAI, is picking up speed again.

Code agent tooling keeps becoming more industrialized. GitHub is broadening in VS Code the ability to launch Copilot, Claude, or Codex sessions in isolated Git worktrees, with fine-grained tracking for each sub-agent — support that goes beyond its own product to directly include its competitors. Devin, for its part, is removing the last hardware constraint limiting its scope by giving its cloud agents a true macOS environment with Xcode and the iOS simulator. In both cases, the movement is the same: moving the full development environment — machine, tools, operating system — onto cloud resources entirely controlled by the agent, rather than remaining dependent on a human’s workstation.

Benchmarks also remind us of the current limits of models. NVIDIA Research’s Spatial-IQ highlights a still massive gap between humans and models on a task that is seemingly simple — counting objects in three dimensions, including partially hidden ones: 82.1% human accuracy versus 17.7% for the best general-purpose multimodal model. The real result is not just that gap, but the proof that it is not inevitable: by isolating and training each sub-skill separately, NVIDIA multiplies the accuracy of the same model on the counting task by more than twenty. Enough to temper this week’s announcements (DeepSeek, Qwen, Copilot) with a useful reminder — agentic benchmarks are improving quickly, but some basic perceptual capabilities remain largely untapped.