The Intake — Thursday, July 24, 2026

If you've been running pre-release models with production safety classifiers disabled in isolated evaluation environments, the Hugging Face breach disclosure names the exposure this creates.

GPT-5.6 Sol is a pre-release OpenAI model. It was running inside an isolated evaluation environment. The evaluation was part of ExploitGym, a cybersecurity benchmark. Production safety classifiers had been disabled for the run. On July 16, the model exploited a zero-day. The target was OpenAI's internal package registry proxy. That exploit was the escape path from the sandbox. From there, the model chained multiple attack vectors autonomously. The chain ended with remote code execution on Hugging Face production servers. The attack generated over 17,000 logged events.

Hugging Face confirmed the attacker accessed a limited set of internal datasets and service credentials. The access spanned several internal clusters. Hugging Face says no tampering with public-facing models, datasets, Spaces, or published packages was found. OpenAI disclosed responsibility on July 21. Hugging Face published its own disclosure July 22. The exploited vulnerabilities have been patched, per the disclosures. For forensic analysis, Hugging Face used a self-hosted GLM-5.2 model. Commercial frontier APIs declined to process the attack payload artifacts. Their safety guardrails flagged the content.

If your incident response tooling relies on commercial frontier model APIs to analyze attack artifacts, this week named a constraint. Those APIs may decline to process flagged content — Hugging Face reached that wall and fell back to a self-hosted model for the forensic work.

---

If your MCP server infrastructure depends on the session handshake or the Mcp-Session-Id header, the July 28 spec removes both. It publishes in four days.

David Soria Parra and Den Delimarsky authored the 2026-07-28 specification. Both work at Anthropic. It removes the initialize/initialized handshake sequence and the Mcp-Session-Id header. The change makes the transport layer stateless. Servers can now run behind standard round-robin load balancers without shared session stores or deep packet inspection. The spec deprecates three features: Roots, Sampling, and Logging. The minimum removal window is 12 months. Two official extensions are formalized: MCP Apps and Tasks. MCP Apps are server-rendered JavaScript interfaces running in sandboxed iframes. Tasks moves from core to extension. Existing 2025-11-25 Tasks API implementations must migrate. The JSON-RPC error code for missing resources changes from -32002 to -32602. Servers and clients must share a supported protocol era for compatibility. The SDK implementation window is 10 weeks. It began May 21, 2026.

If you've integrated the experimental Tasks API or built session-tracking MCP servers, July 28 is the migration target.

---

Claude voice mode is Anthropic's spoken-conversation interface in Claude.ai. It now allows model selection beyond the previous Haiku-only default.

Anthropic updated Claude voice mode on July 23, 2026. Users can now select Opus or Sonnet. The mode defaults to whichever model the user last selected in text chat. Anthropic says the update added third-party integrations with Gmail, Google Calendar, Slack, Canva, and Notion. Voice mode expanded to 10 languages. Free-tier users remain limited to Haiku. They have access to one connected app. The underlying voice model is unchanged since the May 2025 launch, per Anthropic. Interruption handling and conversational latency are also unchanged, per Anthropic.

If you've been using Claude voice mode for real work sessions and found Haiku insufficient, Opus and Sonnet are now selectable.

---