Tenet Security’s DEF CON 34 talk (Aug 9) shows how poisoned Cloudflare, Datadog, and Sentry logs can hijack Claude Code with a 90% success rate under Cloudflare’s own recommended config, exposing 15,000+ organizations. It’s the same trust-boundary flaw as June’s Agentjacking — now three platforms wider, and the firewall never sees it happen.
NVIDIA open-sourced NOOA (NVIDIA Object-Oriented Agents), an Apache-2.0 alpha framework that collapses an entire agent into one Python class — methods are actions, docstrings are prompts, type annotations are enforced contracts. NVIDIA’s own benchmark numbers (82.2% SWE-bench Verified) aren’t yet independently reproduced.
Meta released Muse Glimmer on August 10 — a 30B-parameter, Apache 2.0 agentic model distilled from the closed Muse Spark, small enough to run on a single consumer GPU. It’s built for always-on local agents: tool use, multi-step reasoning, and local coding, entirely offline.
Starting August 14, 2026, auto mode becomes the default permission mode for new Claude Code sessions on Pro, Max, and Team plans. Anthropic’s own study found human reviewers caught only 13.6% of dangerous commands versus auto mode’s 89%, and cites 0/720 successful prompt-injection attempts — numbers independent commentators want verified before taking at face value.
Meta shipped Muse Code, a terminal coding agent powered by Muse Spark 1.2, on August 5. It has persistent background agents, an append-only event log, and a price list with two columns: $1.25/$4.25 per million tokens, or $0.10/$0.20 if you grant Meta the right to train on your prompts and completions. The second column is the actual product.
GitHub shipped Kimi K3 into Copilot’s model picker on August 6 — $3/$15 per million tokens, hosted by GitHub on Fireworks AI, rolling out across every major Copilot surface — the second Moonshot AI model generation Copilot has adopted in five weeks after Kimi K2.7 went GA July 1, underscoring that Copilot is now competing on model breadth rather than owning a frontier model of its own.
At Black Hat USA on August 5, Novee Security researcher Elad Meged presented a coordinated look at agentic-coding-tool flaws in Claude Code, Gemini CLI, and OpenAI Codex — CVE-2026-54316, CVE-2026-12537, and an unpatched OpenAI workflow gap, all already fixed except OpenAI’s, and all traced to the same root cause: a value marked safe by one part of the harness that a later part trusted too far.
v2.1.224 ships cross-session SendMessage/ListAgents so Claude Code sessions on the same machine or across a fleet can message each other directly, plus self-hosted runners for Team/Enterprise, zip-based plugin installs, and a removed 200-subagent spawn cap — infrastructure aimed squarely at running many agents at once rather than one agent at a time.
A beta spotted on aggregator sites but absent from Anthropic’s official Claude Code changelog turns out to be real: mid-conversation tool changes, documented directly on the Claude Developer Platform, let you add or remove tools mid-session via tool_addition/tool_removal blocks without invalidating the prompt cache — a beta introduced with Opus 5, also available on Fable 5, Mythos 5, and Opus 4.8.
v2.1.223 (Aug 6) closes four more permission and sandbox gaps on top of v2.1.221-222’s worktree isolation fix — a hidden-command Bash bypass, a workflow sandbox escape via dynamic import(), a bypassPermissions policy gap, and invisible-Unicode command padding. Three releases, three straight days, all fixing the same category of problem: agent actions escaping the boundaries meant to contain them.