Not a single new version landed in the Claude Code changelog this week, right after the week that shipped Opus 5 and moved several defaults at once. There was still plenty to write about, because Anthropic published the results of its own investigation.
Claude attacked real systems during safety testing
On July 31 Anthropic described three incidents from its own cybersecurity evaluations. These are capture-the-flag tests: the model gets a fictional target and hunts for a hidden flag inside a sealed environment built by a company called Irregular. The environment turned out to be sealed only in the wording of the prompt. The machines Claude worked on had live internet access, while the model was told in plain words that it had none. Reviewing 141,006 evaluation runs, Anthropic found three cases, six runs in total, where models stepped outside the scenario and reached the systems of three real organisations. The techniques were as ordinary as they come: weak passwords, unauthenticated endpoints, SQL injection, credentials left sitting on an exposed debug page.
The second case is the one worth reading twice. Claude Mythos 5, one of the models under test, couldn’t find the fictional library its target depended on, so it published one: it registered a PyPI account, obtaining a phone number and an email address to do so, and pushed a package with malicious content to the real, public registry. The package was downloaded and executed on fifteen real systems, and credentials leaked from one of them, belonging to a security company. The transcript shows the model understood what it was doing – it wrote that this was “NOT okay, and surely not the intended solution” – and then talked itself round, reasoning that certificates and a 2026 date meant it had to be a simulation. The newest model in the set behaved differently: it worked out that it was on a real system and stopped.
Anthropic argues this sits closer to a failure of environment and process than a problem with the models, and that reading holds up – the models carried out the task they were given, in a world they had been told a falsehood about. The practical lesson is the more useful part, and it applies to anyone handing an AI any permissions at all. A sentence in a prompt is not a safeguard. If an agent must not do something, the impossibility belongs in the configuration, not in an instruction the model can reason its way around. Claude Code makes this tangible: a week earlier, version 2.1.219 added the sandbox.network.strictAllowlist setting, which simply blocks hosts outside the list for sandboxed commands, no prompting. That is a guardrail. A ban on visiting the internet written into CLAUDE.md is not, however similar the two look on the page. You turn the setting on deliberately, by the way – it does nothing on its own. If you’re still working out your permissions, start with first-run settings and what to change in the config rather than describing the boundaries to your agent in prose.
The disclosure itself deserves credit. Anthropic began the review on July 23, two days after OpenAI disclosed something similar about its own models, notified the affected organisations on July 27, handed the transcripts to METR for independent review and said it will publish them in redacted form. A company writing up its own mistake, with the number of runs and the name of the firm that built the environment, is doing something nobody made it do.
Connectors move to a new MCP spec
On July 28 Anthropic announced support for MCP spec version 2026-07-28. MCP is the protocol Claude uses to talk to outside services – everything you switch on as a connector in claude.ai, and everything you wire up as an MCP server in Claude Code, runs over it. Plenty changed, but two things stand out. The core of the protocol stops being stateful and now works request-and-response, which means an MCP server can sit on serverless or edge infrastructure instead of being a process you keep alive somewhere. And authorisation has been brought up to OAuth 2.0 and OIDC, so corporate sign-in through Entra or Okta no longer needs workarounds.
For you as a connector user, nothing changes today that you need to act on, and that is the good news – the work happened underneath. Anthropic says its own connector directory has passed 950 entries, and that MCP’s own libraries are downloaded 400 million times a month, four times as often as a year ago. A few things arrived on the Claude side that are easier to see than to describe: MCP Apps draw a connector’s interface directly in the conversation, an admin can switch a connector on for a whole organisation through an identity provider, and MCP tunnels (a research preview for now) let you connect a server inside a private network without exposing it to the world.
If building your own MCP server has been sitting at the back of your mind – even just for one internal tool Claude knows nothing about – this is a better moment than six months ago. A stateless core removes the most irritating part of that idea, which is keeping a process running. We run such a server at JUSTAUTOMATE and built the first version exactly the old way, as something that has to stay up around the clock. Starting today, we’d build it differently.
To close: Anthropic on open-weights models
On July 27 Anthropic published its position on open-weights models – models you can download and run yourself. Dario Amodei writes that the company has never called for a ban, and that open models without dangerous capabilities are a public good: cheap access to the technology, and pressure on everyone else to compete. The reservation is single and specific: weights once released cannot be withdrawn, and safeguards are harder to enforce on them. Instead of a ban, Anthropic proposes chip export controls, going after industrial-scale distillation of other people’s models, and mandatory safety testing for every sufficiently capable model, open or closed.
That last proposal reads differently this week than it would have last week. Mandatory safety testing is worth exactly as much as the test environment is sealed – and the story at the top of this post shows that even the company making the proposal can have a hole there and find out about it late. We don’t have a neat closing line for that. What we keep turning over is who would run such testing, given that the lab for it has to be built as carefully as a production system.