CISA has added CVE-2026-55255, an access-control flaw in Langflow's visual agent-building framework, to its Known Exploited Vulnerabilities catalog. The insecure direct object reference in the /api/v1/responses endpoint allows authenticated users to invoke other users' flows, and attackers have already exploited it to steal credentials from deployments.

Source: AI Agent Store

ICML 2026 opened July 6 in Seoul with 23,918 submissions and unprecedented focus on agentic AI, with 'agentic AI' appearing in at least 60 of 247 workshop proposals. Accepted workshops include 'Agents in the Wild' and 'Statistical Frameworks for Uncertainty in Agentic Systems' focused on safety and governance.

Source: AI Agent Store

Industry analysis published July 5, 2026 shows Agent Zero's v1 line has transformed open-source agent frameworks from demo-style chats to a plugin-first, Git-backed project model with inspectable skills and per-project isolation, enabling real team workflows.

Source: AI Agent Store

Pydantic AI v2 shipped stable on June 23, 2026 with a harness-first redesign that bundles tools, hooks, instructions, and model settings into composable capability units. Q2 2026 (April–July) delivered more shipped framework features than any previous quarter.

Source: Alice Labs

Microsoft unified Semantic Kernel and AutoGen into Microsoft Agent Framework (MAF) 1.0 on April 3, 2026. The official successor to AutoGen brings production primitives including durable state, subagents, and pluggable backends that were community recipes one year ago.

Source: Shakudo Blog

OpenAI publicly launched GPT-5.6 on July 9 after a delay prompted by U.S. government concerns about national security risks. The launch marks a significant shift in how frontier AI releases are treated as policy and security events.

Source: TechStartups

GPT-5.6 Sol Ultra reportedly proved the Cycle Double Cover Conjecture using 64 parallel subagents in under an hour. The model became available globally on July 9 with ChatGPT Work and API access.

Source: The AI Career Lab

OpenAI received government approval to launch GPT-5.6 on July 9, introducing Sol, Luna, and Terra models for global users following regulatory clearance.

Source: Dataconomy

CVE-2026-50656 (CVSS 7.8) is a privilege escalation issue in the Microsoft Malware Protection Engine that provides scanning, detection, and cleaning capabilities for antivirus and antispyware software. The flaw was disclosed by security researcher Chaotic Eclipse, describing it as a race condition that could be abused to spawn a shell with SYSTEM-level privileges. The issue was remediated in Microsoft Malware Protection Engine version 1.1.26060.3008.

Source: The Hacker News

CISA added CVE-2026-45659 SharePoint Server RCE to KEV following confirmed exploitation, requiring U.S. agencies to patch by July 4, 2026. The vulnerability (CVSS 8.8) is a case of remote code execution from deserialization of untrusted data, addressed by Microsoft in May 2026 for SharePoint Server Subscription Edition, 2019, and Enterprise Server 2016. Microsoft acknowledged it had initially forgotten to report the vulnerability's existence.

Source: The Hacker News

Microsoft's record-setting CVE releases came in June with over 200 reported CVEs, including 116 for Windows 11 and 104 for Windows 10. A new zero-day vulnerability called RoguePlanet (CVE-2026-50656) was announced by researcher Nightmare-Eclipse as a Microsoft Defender flaw, with proof-of-concept code posted on GitHub that can result in a System privilege shell.

Source: Help Net Security

FortiBleed is a sustained campaign where compromised Fortinet firewalls are being systematically used to deploy ransomware across multiple organizations, with 74,000 stolen credentials circulating and at least 12 confirmed ransomware infections. CVE-2026-46817 (CVSS 9.8) allows an unauthenticated attacker with network access via HTTP to completely compromise Oracle Payments, presenting a serious situation for organizations running Oracle EBS.

Source: Threat-Modeling.com

June 2026 established a new record with 200 vulnerabilities, creating an extraordinary deployment challenge. July 2026 is expected to see 100-140 vulnerabilities with Kerberos RC4 enforcement reaching full deployment deadline for Phase 2 hardening. Microsoft's July 2026 Patch Tuesday arrives on July 14, 2026.

Source: Zecurit

Visual Studio Code 1.128 was released on July 8, 2026. The release includes richer Agent sessions with multi-chat Claude workflows, quick chats, and read-only subagent transcripts, while Chat gets generally available image and PDF support. It also adds browser tab placement controls and OS-level keyboard shortcuts.

Source: Microsoft Official

This changelog covers VS Code v1.123 through v1.127, shipped throughout June and early July 2026. Updates include parallel sessions, clearer cost visibility, Marketplace model discovery, and sharper Autopilot behavior. Features support for 1M context windows with compatible Anthropic and OpenAI models for bigger codebases and longer conversations.

Source: GitHub Changelog

AWS launched EC2 G7 instances accelerated by NVIDIA RTX PRO 4500 Blackwell Server Edition GPUs, delivering up to 4.6x AI inference performance and up to 2.1x graphics performance compared to G6 instances. AWS Continuum for code vulnerabilities is available in gated preview, automatically discovering, prioritizing, and remediating security risks.

Source: AWS News Blog

AWS launched Amazon Quick—an AI assistant for work with a desktop app and expanded Amazon Connect into four agentic AI solutions for supply chain, hiring, customer experience, and healthcare. AWS and OpenAI brought the latest OpenAI models to Amazon Bedrock in limited preview, including GPT-5.5 and GPT-5.4.

Source: AWS News Blog

Amazon Bedrock Agents (launched November 2023) is transitioning to Amazon Bedrock Agents Classic, with no new customer access starting July 30, 2026. Multiple AWS services are moving to maintenance mode with updates provided to customers.

Source: AWS News Blog

Services moving to maintenance will no longer be accessible to new customers starting July 30, 2026. This includes several legacy AWS services and features.

Source: AWS Official Announcement

After a 19-day global shutdown triggered by US export controls on June 12, Anthropic restored access to its Fable 5 and Mythos 5 models on July 1, 2026. The company deployed a new safety classifier and jailbreak framework developed with Amazon, Microsoft, and Google to address government concerns about potential security vulnerabilities.

Source: Al Jazeera / Multiple sources

On July 2, 2026, Anthropic began preliminary discussions with Samsung Electronics to manufacture a custom AI accelerator. The company has hired specialized silicon engineers and is defining chip specifications, aiming to reduce reliance on Nvidia and diversify its hardware stack.

Source: TechCrunch

On July 7, 2026, Anthropic announced it is moving its Claude Cowork agent to the cloud, making it accessible from multiple devices and enabling task completion even when devices are offline. Beta access begins with Max subscription users, with expanded access planned for other tiers.

Source: NBC News

Anthropic introduced a beta reflection dashboard feature allowing users to track, visualize, and review their Claude usage patterns, set quiet hours, and receive insights on intentional AI use. The feature is available on web and desktop for Free, Pro, and Max users with Memory enabled.

Source: Anthropic Official Updates

On July 3, 2026, Anthropic released enhanced admin controls for Claude Enterprise, adding richer analytics, model-level entitlements, and spend alerts to give enterprise customers better control and visibility.

Source: Build Fast with AI