Three days of Claude Code releases (June 22–25) added credential sandboxing that blocks agent commands from reading your secrets, a CLI-native MCP login flow for headless environments, /rewind recovery from before /clear, and a 37% CPU reduction during streaming. Here’s what each change means in practice.
In a concentrated ten-day window in mid-June, Anthropic opened its Seoul office (10x APAC revenue growth, NAVER and Samsung SDS deployments), announced a Global Premier partnership with TCS empowering 50,000 engineers with Claude, and inked a multi-year alliance with DXC Technology where 95%+ of code is already generated by Claude before human review. The enterprise infrastructure play is accelerating.
Anthropic briefed the White House and U.S. Senate on June 24 that Alibaba’s Qwen AI lab ran a seven-week campaign using roughly 25,000 fraudulent accounts to execute 28.8 million API exchanges with Claude — the largest known distillation attack on any AI lab to date. The campaign targeted Claude’s software engineering and agentic reasoning capabilities. The timeline retroactively explains the June 12 Fable 5 export ban.
Adversa AI disclosed two new attack classes in May 2026: TrustFall (one-click RCE via malicious .mcp.json files affecting Claude Code, Cursor, Gemini CLI, and GitHub Copilot) and SymJack (symlink-hijack RCE across six agents including Codex and Grok Build). A real-world worm — Miasma — was found exploiting TrustFall in a production Microsoft Azure repository.
Anthropic updated its privacy policy to require government ID and a live selfie from flagged Claude users, processed by Persona — a vendor backed by Founders Fund, which also holds Anthropic equity. Effective July 8, the change is widely read as groundwork for a US-only Fable 5 restoration path after the June 12 export ban.
Anthropic launched Claude Tag in research preview on June 23, 2026 — an always-on AI teammate that lives inside Slack, responds to @mentions, and proactively intervenes in conversations without being asked. It’s the most ambitious signal yet that Anthropic is building toward workplace infrastructure, not just developer tooling.
A new attack class called ‘agentjacking’ exploits Sentry’s MCP server to inject malicious instructions into AI coding agents. Disclosed in June 2026, the attack achieves an 85% exploitation rate against Claude Code, Cursor, and Codex — and Sentry has declined to fix it at the root.
Z.AI’s GLM-5.2, released June 13 under MIT license, scores 62.1% on SWE-bench Pro — beating GPT-5.5 at 58.6% while costing roughly one-sixth as much. The model lands within 3 points of Claude Opus 4.8 on FrontierSWE and MCP-Atlas benchmarks, and Z.AI has publicly forecast open-sourcing a Fable-class model before year-end.
Anthropic published an 80-page model specification for Claude in January 2026, released under CC0. Unlike prior rule lists, it teaches Claude why to behave — distinguishing hard prohibitions from adjustable defaults, explaining the priority order when values conflict, and granting operators genuine control over model behavior. Six months in, its fingerprints are visible everywhere from CLAUDE.md to the Fable 5 controversy.
Anthropic’s Workload Identity Federation (WIF) is now generally available: Claude API access with short-lived OIDC tokens from AWS IAM, GCP, Azure, GitHub Actions, Kubernetes, or Okta — no static API keys to create, rotate, or leak. Each agent gets its own identity, role, and audit trail. Here’s what changes and how to migrate.