Independent AI intelligence Two editions daily · ET
FervorAI
Menu

AI Trending Briefing · August 1, 2026 · afternoon edition

Agent state that used to live somewhere invisible is being dragged into the open, by the MCP spec that deleted the hidden session, by YC scoping memory and permissions per person and per room, and by two disclosures where the exploit was configuration and text the operator never saw.

MCP 2026-07-28 specificationY Combinator QMAgentForgerAzure DevOps MCP serverOpenAI Presencemcpmcp-securityagent-securityagent-memoryagent-identitymulti-agent

Trending AI Briefing: Saturday, August 1, 2026 (afternoon ET)

The most consequential change to MCP in its history is a deletion. The 2026-07-28 specification, final on July 28, removes the protocol-level session, and the effect ripples past load balancers into how you audit what an agent is carrying. Read it next to the week's other items and a shape appears: Y Combinator open-sourced a harness on July 31 whose organizing idea is scoped memory and permissions per person and per Slack room, while two disclosures landed on flaws where the payload was never a model output but a piece of state nobody looked at, connector settings flipped to "Never ask" in one case and an HTML comment invisible in the web UI in the other. The state agents carry is becoming the thing you have to be able to see.

What's hottest in AI news right now

The MCP 2026-07-28 specification went final on July 28, and it is the largest revision since the protocol launched. Six SEPs kill the initialize/initialized handshake and the Mcp-Session-Id header, so a tool call is now one self-contained HTTP request that any server instance can serve. Protocol version, client info, and capabilities ride in _meta on every request. Streamable HTTP now requires Mcp-Method and Mcp-Name headers so gateways route without reading the body, list results carry ttlMs and cacheScope modeled on HTTP Cache-Control, and W3C Trace Context key names are fixed in _meta so one span tree can follow a call from host to SDK to server to whatever the server calls next. Roots, Sampling, and Logging are deprecated with a twelve-month floor before removal. MCP Apps and Tasks ship as the first official extensions. (MCP blog, InfoWorld)

The replacement for session state is the interesting part. Servers that need continuity mint an explicit handle from a tool, a basket_id or a browser_id, and the model threads it back as an ordinary argument. The state an agent carries between calls is now a value in the trace instead of a routing detail. Simon Willison, who spent most of 2025 arguing MCP had been eclipsed by Skills, wrote on July 31 that the new spec pulled him back, and shipped three implementations that week. His reasoning lands hard against the current risk climate: MCP tools are easier to audit and control than an agent holding a shell and curl, and simple enough that laptop-sized models can drive them. (Simon Willison)

Y Combinator open-sourced QM on July 31, the multi-agent harness it runs internally across accounting, legal, events, and engineering, including the building of QM itself. MIT license, cloud-first, native Slack and web UI. The design decision that matters: every employee and every Slack room gets its own scoped memory, permissions, and sandbox, with crons, skills, and pluggable coding loops underneath, so you can swap between Pi, OpenCode, Codex, and Claude Code without rewriting the harness. YC frames it as customizable like Hermes or OpenClaw but built for a whole company rather than one person. The announcement is YC's own post and the repository at github.com/yc-software/qm; star counts circulating in coverage are hours-old and not worth quoting. (Y Combinator)

Zenity Labs published AgentForger on July 24, a cross-site request forgery in OpenAI's ChatGPT Agent Builder that let one link stand up an attacker-controlled agent inside a victim's organization. The Builder accepted its initialization state through URL parameters, and initial_assistant_prompt was not merely placed in the prompt box, it was submitted and executed on page load. A logged-in employee with Workspace Agents access and at least one authorized connector clicks, and the crafted prompt creates a chief-of-staff agent, attaches every available connector, sets each to "Never ask", publishes it, schedules it hourly, and fires Preview Mode, which in this flow executes against real connected accounts. The agent then polls the victim's mailbox for messages whose subject starts with "TASK" and mails results back. OpenAI fixed it June 8 after coordinated disclosure. Agent Builder is being deprecated November 30, 2026 in favor of the Agents SDK. (Zenity Labs, The Hacker News)

Manifold Security disclosed a confused-deputy flaw in Microsoft's official Azure DevOps MCP server on July 22. Microsoft already built the defense: a spotlighting helper, createExternalContentResponse, wraps untrusted content in delimiters, and the wiki-page and build-log tools call it. repo_get_pull_request_by_id does not, so a pull request description comes back raw. Markdown allows HTML comments, and an HTML comment renders as nothing in the web UI while the REST API returns it verbatim. In Manifold's proof of concept a hidden comment drove the reviewer's agent to trigger a pipeline in a different project, read a confidential wiki page the attacker could not open, and post that page back as a PR comment. Reproduced with both Copilot CLI and Claude Code. As of July 21 there was no fixed release and no CVE. (Manifold Security, The Hacker News)

OpenAI launched Presence on July 22, an enterprise product for deploying voice and chat agents where the deliverable is the control surface rather than the model. Each deployment starts with one job, the agent gets only the knowledge and system access that job needs, and the company sets what it can do, when it needs approval, and when a person takes over. Presence runs OpenAI's own English-language phone support at 1-888-GPT-0090, where the company says it resolves 75 percent of inbound issues without human help and a Codex-powered improvement loop cut handoffs by 15 percentage points in 10 days. BBVA, SoftBank, and IAG are named as design partners. Limited general availability, delivered by Forward Deployed Engineers, not self-serve. (OpenAI)

New tools and features worth actually trying

mcp-explorer is the fastest way to see what the new spec bought you. Simon Willison built it this week as a stateless Python CLI, so uvx mcp-explorer list https://agentic-mermaid.dev/mcp prints a server's tools with no install at all, and inspect and call cover schemas and arguments. Twenty minutes with it teaches more about 2026-07-28 than the changelog. Honest tradeoff: it is days old and written mostly by Codex, so treat it as a probe rather than a dependency, and it exercises the new transport, which means it tells you nothing useful about a server still speaking 2025-11-25.

datasette-mcp adds a /-/mcp endpoint to any Datasette instance with three tools, list_databases, get_database_schema, and execute_sql. Point ChatGPT or Claude at it and they can query your hosted data directly. Willison notes this is roughly his fourth attempt at the plugin and the first that felt shippable, which is the clearest practical evidence that the stateless rewrite lowered implementation cost. Honest tradeoff: execute_sql is read-only for now, and a tool that runs arbitrary SQL against your data, exposed to a chat client that also reads untrusted text, is the lethal trifecta assembled on purpose. Scope the database, not just the tool.

yc-software/qm is worth reading even if you never deploy it, because the permission model is the artifact. Per-employee and per-room scoped memory, permissions, and sandboxes answers a question most single-user harnesses never ask: what happens when twelve people share an agent that remembers things. Honest tradeoff: cloud-first with a native Slack surface means standing up shared infrastructure and an audit obligation, not installing a CLI, and a harness YC tuned for accounting, legal, and events carries assumptions that may not match yours.

mvanhorn/last30days-skill researches a topic across Reddit, X, YouTube, Hacker News, Polymarket, and the open web, then synthesizes a grounded summary. Fourteenth on today's Trendshift board, and it solves the real problem with asking a model about last month. Honest tradeoff: a skill that pulls untrusted text from six social platforms into your agent's context is the exact delivery path the Azure DevOps finding describes. Run it in something you can throw away, and do not give it memory-write tools.

Trending AI repos on GitHub today

Placement comes from Trendshift's daily momentum board read this run, which reports engagement scores rather than verified star totals, so treat rank as momentum. GitHub URLs are constructed from Trendshift-verified owner/repo strings; individual repo pages did not fetch this run, so no star figures are quoted. The topic ranking backs the day's theme: #AI agent leads at 36.9k stars, #AI skills second at 15.2k, #MCP tenth at 4.9k.

  • yc-software/qm: YC's internal multi-agent harness, MIT, Slack and web native. Off-board because it shipped July 31, and the most important repo of the day.
  • oomol-lab/open-connector: open-source auth gateway wiring 1,000-plus SaaS providers to agents over SDK, CLI, MCP, HTTP, and OpenAPI. Twelfth, and Trendshift's featured repo. The commercial shape of the same identity problem the new spec's OAuth hardening addresses.
  • ChromeDevTools/chrome-devtools-mcp: Chrome DevTools exposed to coding agents over MCP. Twenty-first, and a reference for how a first-party vendor scopes an MCP tool surface.
  • NousResearch/hermes-agent: self-hosted personal agent that accumulates context the longer it runs. Twenty-third.
  • stablyai/orca: development environment for running a fleet of parallel coding agents on your own subscription, desktop, mobile, and VPS. Eighteenth.
  • mvanhorn/last30days-skill: research skill that synthesizes Reddit, X, YouTube, HN, Polymarket, and web results. Fourteenth.
  • different-ai/openwork: open-source Claude Cowork alternative built on opencode, local-first, 50-plus providers. Eighth.
  • openai/codex-security: OpenAI's CLI and SDK for finding, validating, and patching vulnerabilities in CI. Eleventh.
  • zenbu-labs/terminal-browser: a browser that runs inside your existing terminal. Sixteenth, and an obvious agent primitive whether or not it was built as one.
  • drumih/turbo-fieldfare: Gemma 4 26B-A4B inference in roughly 2 GB of resident RAM on M-series MacBooks. Fourth, and the local counterweight on a board full of cloud harnesses.

What actually matters from today's signal

Track auditability of agent state this week, because that is the single axis all five stories move along. The spec made state explicit and routable. YC made it scoped and per-principal. AgentForger and the Azure DevOps flaw both worked because a piece of state, a connector approval setting and a comment in a PR body, existed in a place the responsible human never looked. Four places to put effort: enumerate what your agents can write to durable memory and who approved it, audit which of your MCP tool paths wrap untrusted content and which were missed, start supplying and validating the iss parameter on authorization responses now rather than when clients begin rejecting responses that omit it, and treat any per-tool auto-approve posture as the control you are actually relying on, because both disclosures assumed it.

The counter-signal is that stateless does not mean stateful problems went away, it means they moved into your application code where the spec no longer helps you. The handle pattern is genuinely better, and it also hands every server author the job of deciding what a handle authorizes, how long it lives, and whether the model can be talked into passing one it should not have. MCP's own maintainers describe the model composing handles across tools as a feature. It is also a confused-deputy surface with a friendlier name. The spec removed the session store; it did not remove the reason people wanted one.

There is a quieter tension in Willison's reversal. His argument for coming back to MCP is that a bounded tool surface is easier to reason about than a shell with network access, which is correct and is exactly why the Azure DevOps finding stings: the bounded surface failed anyway, not because MCP was too powerful but because one response path missed a wrapper thirty others had. Narrow interfaces are auditable in principle. They get audited in practice only if someone owns the list. If you are moving sensitive work onto MCP this quarter, write down every tool that returns text a stranger can write, and check each one by hand. That list is short today and will not be in six months.

Source access notes: Direct fetches on anthropic.com/news, openai.com/news, blog.cloudflare.com, blog.langchain.com, and huggingface.co/blog failed the URL provenance check this run and were covered via WebSearch. Individual github.com repo pages also failed provenance, so no star figures are quoted and repo URLs are constructed from Trendshift-verified owner/repo strings; shields.io had no network path from the shell. Hacker News, Product Hunt, and arXiv new-submission listings were not directly reachable. Trendshift's daily board fetched cleanly and leads the repo section. Cloudflare's Agents Week material was reachable but carried no reliable ship dates for this window, so it was left out rather than dated by guess.