MCP Ships Its Largest Revision Since Launch, the "2026-07-28" Spec — Stateless Operation and Stronger Governance
The 2026-07-28 version of the Model Context Protocol (MCP) specification has been published, positioned as the **largest and most significant revision** since MCP's debut.
The key changes are as follows:
Stateless operation**: Moves away from the previous stateful communication to a stateless protocol, enabling scaling on standard HTTP infrastructure
Stronger governance**: Introduces a governed extensions system and establishes lifecycle guarantees that curb future breaking changes
Hardened authentication**: Integrates more tightly with OAuth 2.0, OpenID Connect, and enterprise practices
On the same day, AWS announced that Amazon Bedrock AgentCore Gateway now supports the new spec. Migration requires just a single `UpdateGateway` API call, and existing clients continue to work as before.
Meanwhile, Runlayer, an MCP-related startup, filed a lawsuit the same day alleging that Rippling built its own version after evaluating Runlayer's MCP gateway product. As the MCP ecosystem grows, friction over intellectual property is starting to surface.
---
Sam Altman Open to "Slowing Down" — A Security Incident Changed His Outlook
According to TechCrunch, OpenAI's Sam Altman has taken a **positive stance** toward slowing the pace of AI development.
Altman said his position shifted after "the first security incident that felt very close to home." The move also relates to a July 28 report that employees at OpenAI and Anthropic shared a letter urging the U.S. government to coordinate AI development.
The fact that the CEO at the very frontier of cutting-edge AI development is speaking favorably of a slowdown suggests that AI capability growth has reached a stage that corporate self-regulation alone cannot handle. That said, no concrete slowdown schedule or mechanism has been revealed at this point.
---
Anthropic's Mythos Model Finds Vulnerabilities in Cryptographic Algorithms — Attacks Post-Quantum "HAWK" in 60 Hours
Anthropic's "Claude Mythos Preview" has discovered weaknesses in major cryptographic algorithms that underpin internet security.
Most notable is its improved attack method against **HAWK**, a post-quantum signature scheme. HAWK had been considered sound even after more than two years of review by human experts, yet Mythos pinpointed the vulnerability in just **60 hours at an API cost of roughly $100,000**.
While the finding is not believed to directly affect systems currently in production, it is a significant demonstration that AI has the potential to shake the assumptions at the foundation of internet security.
---
AI-Discovered Bugs Are Not Actually That Easy to Exploit — The Register's Analysis
As AI's capabilities draw attention through cryptographic vulnerability discoveries, The Register reports that "bugs found by AI are not as easy to exploit as claimed."
It points out that while AI security applications have delivered outstanding results on the discovery side, the difficulty of actually turning found vulnerabilities into working attacks is unchanged. On how much AI-discovered bugs matter as real-world threats, the report argues that the gap between discovery and exploitation should be assessed carefully.
Taken together with Anthropic's Mythos cryptographic break, AI's security capabilities appear to be at a stage where **there is a wide gap between "discovery" and "practical exploitation"**.
---
Up to 12% of Questions in Major LLM Benchmarks Are Flawed — GPQA and MMLU-Pro Audit Results
In research shared within the LocalLLaMA community, questions from major LLM evaluation benchmarks such as GPQA, MMLU-Pro, and MMMU-Pro were audited, revealing that up to **12% of the questions are flawed**.
The problems include broken formatting, incorrect answer keys, and questions that realistically have multiple correct answers. When re-evaluated on a "cleaned" version with flawed questions removed, top models' scores jumped to roughly 98% on GPQA-Diamond.
This suggests that when some models hit the benchmark ceiling, it was likely not just because the models were excellent, but because **the tests themselves were flawed**. The findings underscore the importance of ongoing maintenance to keep evaluations trustworthy.
---
LFM2.5-Encoders — Multilingual Encoders That Run Fast Even on CPU
Liquid AI has released the LFM2.5-Encoder family (230M / 350M). These bidirectional encoders are built on the LFM2 architecture, support 15 languages, and can be fine-tuned for classification, token classification, retrieval, reranking, and more.
The standout feature is **long-context processing speed on CPU**. They achieve throughput on par with or better than ModernBERT while also running in the browser via WebGPU. With support for 8K-token context lengths, they offer a new option for practical natural language processing on on-chip devices.
---