The AI Engineering Brief

Issue #002 — 2026-07-13

What changed in AI engineering, July 6 – 13, 2026. Curated for senior engineers going AI-native. Every item sourced.

1. AWS puts Bedrock Agents in maintenance mode — it's "Agents Classic" now

In its June 30 product-lifecycle update, publicized in the July 6 AWS Weekly Roundup, AWS renamed Amazon Bedrock Agents (launched November 2023) to "Amazon Bedrock Agents Classic" and moved it to Maintenance: no new customers from July 30, 2026. The same update sends Amazon Kendra and Amazon Q Business to Maintenance as well. Meanwhile Claude Sonnet 5 became available on AWS (announced June 30), and AgentCore — GA since AWS Summit New York, per AWS's Bedrock documentation — is the designated successor for agent workloads.

Why it matters: a 2.5-year-old flagship service just got the Classic suffix. If Bedrock Agents is in your architecture, existing workloads keep running, but new builds belong on AgentCore — start the migration conversation before your next design review, not after. And note the pattern: in the agent era, AWS is willing to retire AI services faster than its usual decade-long deprecation etiquette.

Source: aws.amazon.com/blogs/aws/aws-weekly-roundup-claude-sonnet-5-on-aws-amazon-workspaces-for-ai-agents-aws-service-availability-updates-and-more-july-6-2026

2. Two weeks to MCP 2026-07-28 — and it breaks things

The next Model Context Protocol specification goes final on July 28, and it is the largest revision since launch: the protocol core becomes stateless (the initialize handshake and Mcp-Session-Id are removed), Mcp-Method and Mcp-Name headers become required on Streamable HTTP, Tasks moves from experimental core to an extension with a reworked lifecycle, roots/sampling/logging are deprecated, and the missing-resource error code changes from -32002 to standard -32602. The release candidate has been stable since May 21; Tier 1 SDKs are expected to ship support within the validation window.

Why it matters: this is the migration deadline you knew was coming. If your MCP server leans on protocol sessions for state, or your client matches the literal -32002, or you shipped against the experimental Tasks API, you have two weeks of calm left to do this on your own schedule. The upside is real: stateless MCP servers run behind a plain round-robin load balancer with no sticky sessions and no shared session store.

Source: blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate

3. Claude Code week 28: a built-in browser, a /doctor that operates, and a telling safety list

Claude Code's July 6–10 releases (v2.1.202–206) gave the desktop app a sandboxed built-in browser — Claude can read and click through docs, designs, and dev-server previews, with safety classifiers reviewing actions on external sites — and turned /doctor from a read-only report into a fix-it checkup that flags unused skills, MCP servers, and plugins against their context cost. The quieter list is the interesting one: auto mode now blocks tampering with session transcripts, asks before running rm -rf on a variable it can't resolve, and background-task notifications now explicitly state that no human input occurred, "preventing fabricated in-transcript approvals from being acted on." Separately, the 50% higher weekly usage limits run through July 19.

Why it matters: each of those guardrails is a fossil of a real failure mode — transcript tampering, unresolved-variable deletion, agents inventing their own approvals. If you run any agent harness, read that list as a free incident report and check which of the three your own setup would have caught.

Sources: code.claude.com/docs/en/whats-new/2026-w28 · helpnetsecurity.com/2026/07/13/claude-code-weekly-limits-promotion-extended

4. Google's managed agents get background execution and remote MCP

On July 7, Google expanded Managed Agents in the Gemini API (Interactions API): background: true runs long tasks server-side and returns an ID to poll instead of holding an HTTP connection open, agents can now call remote MCP servers directly from their sandbox, custom client-side functions mix with built-in tools, and network credentials can be rotated mid-session without losing sandbox state.

Why it matters: Anthropic, OpenAI, and Google have now converged on the same managed-agent primitives — server-side execution, detachable sessions, and remote MCP as the enterprise integration surface. Two practical takeaways: your internal APIs increasingly need an MCP endpoint to be reachable by any of the three ecosystems, and credential rotation for agents is becoming a platform feature — stop hand-rolling it.

Source: blog.google/innovation-and-ai/technology/developers-tools/expanding-managed-agents-gemini-api

5. China issues a "backdoor" security alert over Claude Code

On July 8, a cybersecurity platform operated by China's industry ministry (MIIT) warned of a serious security "backdoor" risk it says it identified in Anthropic's Claude Code. Anthropic's models are not officially available in China, but the tooling circulates anyway, and it's one of the first times a Chinese government body has publicly flagged a Western coding agent as a security threat. Anthropic rejected the "backdoor" characterization within days: engineer Thariq Shihipar and a company spokesperson said the flagged mechanism was a March 2026 anti-abuse experiment (checking device time zone to curb reseller abuse and distillation by banned regions/labs), not a backdoor, and said stronger mitigations have since landed and the code was slated for removal.

Why it matters: two separate lessons. Geopolitically, agentic dev tools are now inside the perimeter of state-level scrutiny — if you operate teams or subsidiaries in China, expect this to surface in procurement and audit questionnaires. Technically, strip the politics and the underlying concern is legitimate for every agentic CLI regardless of vendor: a tool with shell access and network egress is an attack surface, and the answer is the sandboxing and permissioning discipline you'd apply to any privileged automation — not vendor trust.

Sources: reuters.com/legal/litigation/china-issues-backdoor-security-alert-over-anthropics-claude-code-2026-07-08 · scmp.com/news/china/article/3359901/anthropic-hits-back-after-china-warns-claude-code-backdoor-risks

6. EU AI Act: the omnibus moved the high-risk deadlines — August 2 didn't move

The Digital Omnibus on AI cleared its final hurdles: the European Parliament approved it on June 16 (423–57) and the Council gave final adoption on June 29. Formal entry into force is pending publication in the Official Journal — expected before the August 2, 2026 high-risk-obligations deadline, but not yet confirmed as published as of July 15. High-risk AI system obligations shift from August 2, 2026 to December 2, 2027 (stand-alone systems) and August 2, 2028 (AI embedded in regulated products); watermarking and machine-readable labelling of AI-generated content is due December 2, 2026 for systems on the market before August 2, 2026. What did not move: most remaining AI Act provisions still start applying on August 2, 2026 — three weeks out — including the start of Commission enforcement powers over general-purpose AI models.

Why it matters: "the AI Act got delayed" is only true for the high-risk bucket. If your compliance work went on the shelf when the delay headlines hit, check which bucket your systems are actually in — the GPAI and transparency clocks are still running, and enforcement capacity arrives August 2.

Sources: europarl.europa.eu/news/en/press-room/20260611IPR45207/ai-act-ep-approves-simplification-measures-and-nudifier-app-ban · consilium.europa.eu/en/press/press-releases/2026/06/29/artificial-intelligence-council-gives-final-green-light-to-simplify-and-streamline-rules

Want the discipline behind these calls, not just the headlines? The curriculum covers agent architecture on Bedrock and Cloudflare end to end — see aiarch.dev/curriculum, or work through the free sample lesson at aiarch.dev/sample.