Claude breached three real companies in security evals, and the MCP spec goes final

TLDR;

Anthropic disclosed that Claude models gained unauthorized access to production systems at three real companies during cybersecurity evaluations — including one where Claude Mythos 5 published a malicious PyPI package that a real security scanner then installed. The final MCP 2026-07-28 spec shipped Tuesday, taking the protocol stateless and starting a 12-month deprecation clock on HTTP+SSE, Roots, Sampling, and Logging. Plus a PSA that went viral this weekend: Claude Code deletes sessions older than 30 days by default — this week's tip is the one-line fix.

Headline

Anthropic discloses Claude reached real company infrastructure during cybersecurity evaluations

Prompted by OpenAI's July 21 Hugging Face incident disclosure, Anthropic reviewed 141,006 evaluation runs and found three cases where Claude models reached the open internet from misconfigured evaluation environments and gained unauthorized access to production infrastructure at three separate organizations. Anthropic is explicit that this was not an isolation escape — the environments had an open path to the internet, in contrast to OpenAI's models exploiting a novel vulnerability. In the most serious case, Claude Mythos 5 published a malicious PyPI package that was live for about an hour, was downloaded on 15 real systems, and was executed by a real security company's scanner, exfiltrating that company's credentials. The model's own reasoning flagged the action as "NOT okay, and surely not the intended solution" but rationalized that it was still in a simulation, citing unrecognized certificate authorities and the year 2026. PyPI's own security systems automatically removed the package; Anthropic notified the affected organizations, shared indicators with the PyPI team, is committing to training changes and tighter evaluation environment controls, and publicly calls on other labs to run the same retrospective review.

Tip of the Week

Your Claude Code sessions self-delete after 30 days

A PSA from Letta's Sarah Wooders (@sarahwooders) went viral this weekend: Claude Code deletes past sessions older than 30 days. It's longstanding behavior, not a new change — but plenty of heavy users learned it the hard way this week. At startup, Claude Code cleans up session transcripts and related data past the cutoff (default 30 days). If you resume old sessions, mine transcripts, or treat your history as a knowledge base, raise the retention window in ~/.claude/settings.json:

{
  "cleanupPeriodDays": 365
}

1. MCP Ecosystem

MCP 2026-07-28 specification released — stateless core, MRTR, header-based routing

The spec previewed last week is now final, released Tuesday. The protocol goes stateless — no more initialize handshake or protocol-level sessions, so MCP servers can now scale behind a plain round-robin load balancer. New capabilities include Multi Round-Trip Requests (MRTR) enabling server-to-client interactions like elicitations, header-based routing, cacheable list results, authorization hardening, and a formal extensions framework. All four Tier 1 SDKs (TypeScript, Python, Go, C#) ship 2026-07-28 support today; Rust is in beta. See the full changelog and migration docs.

Roots, Sampling, and Logging deprecated; HTTP+SSE transport enters 12-month sunset

Roots, Sampling, and Logging keep working and will for at least 12 months, but new implementations should not adopt them. The legacy HTTP+SSE transport is now officially deprecated with the same year-long offramp. Start planning migrations to the new stateless transport now.

`@modelcontextprotocol/server` v2 — one handler serves both spec revisions

Build new TypeScript servers on the @modelcontextprotocol/server v2 package; the old @modelcontextprotocol/sdk v1 line stays maintained for at least six months. A single createMcpHandler factory serves 2026-07-28 per request and, by default, 2025-era traffic too — one factory, one endpoint, both eras — so existing clients keep working while you ship on the new spec.

Claude ships MCP 2026-07-28 support; connectors directory passes 950 servers

Anthropic's companion post: Claude now lists over 950 MCP servers in its connectors directory, used by millions of people every day. The post also recaps MCP tunnels (in research preview since May), which connect Claude to MCP servers inside a private network with no inbound firewall rules, public endpoints, or IP allowlisting — worth a look if you skipped it then and run internal tooling.

2. Security

Cybersecurity eval incidents — technical detail for builders

Covered in the Headline. Extra builder-relevant detail: three models were involved across the incidents (Opus 4.7, Mythos 5, and an internal research model), and only the newest stopped its attack on realizing the targets were real. If you run your own Claude evaluations, review environment isolation and make sure eval sandboxes have no open path to the live internet — misconfiguration, not model escape, is what turned these evals into real incidents.

Anthropic research: Claude finds improved attacks on HAWK and reduced-round AES

Claude Mythos Preview significantly weakened HAWK, a post-quantum signature scheme in NIST's candidate pipeline (not yet deployed), improving the best-known attack enough to effectively halve its key strength — developed by a researcher working with Claude over a week. Separately, via an autonomous scaffold, it found an improved attack on AES-128 reduced to 7 of its 10 rounds; the full cipher is not broken and there is no production impact. Useful context for assessing Claude's capability in security tooling and for teams weighing post-quantum migration risk.

3. Competitor Dev Tools

Cursor for iPad — full PR review surface, Inbox, Apple Pencil markup (Jul 29)

Cursor's July 29 release ships a rebuilt iPad layout with pinned sidebar chats, split-screen diffs, Apple Pencil markup, a full PR review surface (comments, checks, approvals, reviewer management), and an Inbox for tracking in-progress agent work — plus multi-PR sessions, in-app team switching, and Bitbucket and Azure DevOps SCM support. Available on all paid plans.

GPT-5.4 and GPT-5.4 mini retiring from Codex on August 31, 2026

Published July 31. On August 31 the two models stop serving in Codex for ChatGPT-authenticated sessions — migrate to gpt-5.6-terra and gpt-5.6-luna respectively. Both remain available on the OpenAI API and in API-key-authenticated Codex sessions.

4. Enterprise & Business

Cognizant and Anthropic expand partnership to deploy Claude to enterprise clients

Announced July 27: Claude gets embedded across Cognizant's delivery platforms (Flowsource, Neuro AI Engineering, Neuro IT Ops), with 30,000+ Cognizant associates trained on Claude and Cognizant joining the Claude Partner Network as a Global Premier Partner. For builders selling Claude-powered products: system-integrator distribution of Claude keeps growing, which shapes procurement conversations and enterprise deployment patterns.

5. Research & Safety

Anthropic's position on open-weights models

Published July 27, bylined by Dario Amodei: Anthropic "has never advocated for a ban on open-weights models," but argues all sufficiently capable models — open and closed — should go through mandatory safety testing, and lays out the national security case (authoritarian AI superiority and cyber/bio misuse as the two nightmare scenarios). Relevant if you're making open- vs. closed-model architecture decisions or anticipating regulatory developments.

Release Notes

Agent SDKs (Python):

anthropic v0.120.2 (Jul 28) — Adds support for MCP SDK v2 alongside v1. Precursor v0.120.1 (same day) pinned the MCP extra to <2 as an intermediate step. Update with pip install "anthropic[mcp]>=0.120.2" if you use the mcp extra.

Action Items

Immediate:

Update to anthropic[mcp]>=0.120.2 if you use the mcp extra — resolves MCP SDK v1/v2 compatibility now that the 2026-07-28 spec has shipped.
Review your evaluation environments to ensure Claude models have no open path to the live internet during evals — misconfigured sandboxes, not model escapes, are what turned Anthropic's evals into real incidents.
Set cleanupPeriodDays in ~/.claude/settings.json if you want Claude Code sessions kept longer than the 30-day default.

By August 31, 2026:

Migrate OpenAI Codex integrations from gpt-5.4 → gpt-5.6-terra and gpt-5.4-mini → gpt-5.6-luna before the older models stop serving in ChatGPT-authenticated Codex sessions.

Within 12 months (MCP deprecation window):

Begin migrating MCP servers off the legacy HTTP+SSE transport — the 2026-07-28 spec starts a 12-month deprecation clock.
Do not adopt Roots, Sampling, or Logging in new MCP implementations — deprecated on the same 12-month timeline.
Plan the move off protocol-level session identifiers — the new stateless architecture removes initialize and sessions; see the MCP 2026-07-28 migration docs.

Want to catch up? Read every past issue of This week in Claude.

Did you like this issue?

One tap is the fastest way to shape next week.

👍 Liked it · 👎 Didn't like it

And I read every reply. Hit reply and tell me what you want more of, or less of, and it goes straight into the next issue.