Newsletter · free
The AI Engineering Brief
Issue #002 — 2026-07-13
What changed in AI engineering, July 6 – 13, 2026. Curated for senior engineers going AI-native. Every item sourced.
1. AWS puts Bedrock Agents in maintenance mode — it's "Agents Classic" now
In its June 30 product-lifecycle update, publicized in the July 6 AWS Weekly Roundup, AWS renamed Amazon Bedrock Agents (launched November 2023) to "Amazon Bedrock Agents Classic" and moved it to Maintenance: no new customers from July 30, 2026. The same update sends Amazon Kendra and Amazon Q Business to Maintenance as well. Meanwhile Claude Sonnet 5 became available on AWS (announced June 30), and AgentCore — GA since AWS Summit New York, per AWS's Bedrock documentation — is the designated successor for agent workloads.
Why it matters: a 2.5-year-old flagship service just got the Classic suffix. If Bedrock Agents is in your architecture, existing workloads keep running, but new builds belong on AgentCore — start the migration conversation before your next design review, not after. And note the pattern: in the agent era, AWS is willing to retire AI services faster than its usual decade-long deprecation etiquette.
Item 2 below was published on 2026-07-13 stating the MCP release candidate's contents as settled fact, and claiming the RC "has been stable since May 21." Both were wrong, and we have corrected them in place rather than silently.
The 2026-07-28 revision was not published as of this correction: modelcontextprotocol.io/specification/2026-07-28 returned 404 and the versioning page still named 2025-11-25 as current. The RC was not stable either — its changelog moved at least three times after May 21 (2026-06-12 renumbered draft error codes, plus edits on 06-17 and 07-16), and the RC release note says in terms that "this specification is not final. Changes may be introduced between the RC and the final release."
The original item also omitted the compatibility story, which made the revision sound more breaking than it is. That is added below. We also replaced this item's headline, which read "Two weeks to MCP 2026-07-28 — and it breaks things." The RC's compatibility model means it does not.
We publish this correction in full because a brief that states drafts as facts is worth less than one that says what it does not yet know.
Second correction — 2026-07-28. The revision published on schedule, and the compatibility model above survived into the final text: the Legacy / Modern / Dual-era taxonomy, the published compatibility matrix, and the at-least-twelve-month deprecation window (earliest removal 2027-07-28) are all in the released spec. Two things below were still wrong. The server/discover probe that falls back to initialize is stdio-only — on Streamable HTTP, where most readers are, the documented mechanism is to attempt a modern request and inspect the body of a 400 before falling back. We stated the stdio mechanism as if it were general. And the era asymmetry was missing: a legacy server keeps working, but a legacy client against a modern-only server fails outright, because legacy clients have no fall-forward mechanism. Both are fixed in place below. One thing the item did not anticipate: the spec's own versioning page still names 2025-11-25 the current protocol version, so a server that speaks only the older revision is conformant today.
Third correction — 2026-08-03. The last sentence above has expired, and it expired within days of being written. The versioning page now reads verbatim "The current protocol version is 2026-07-28" (verified 3 Aug 2026, following the redirect to /docs/2026-07-28/learn/versioning). The conclusion still holds but no longer for the reason given: 2025-11-25 is now Final — which the spec defines as a past, complete revision that will not change, distinct from Deprecated and from Removed — and a server speaking only that revision still serves clients that request it, because every request declares its own protocol version in _meta and the server accepts or rejects each one independently. We are leaving the earlier sentence visible rather than editing it away: it was true when written, the pointer flipped underneath it, and the useful lesson for a reader is that "current" on this spec is a moving pointer worth re-checking rather than quoting from a write-up.
2. Two weeks to MCP 2026-07-28 — the largest revision since launch
The next Model Context Protocol specification is scheduled to publish on July 28, and its release candidate is the largest revision since launch. In the RC: the protocol core becomes stateless (the initialize handshake and Mcp-Session-Id are removed), Mcp-Method and Mcp-Name headers become required on Streamable HTTP, Tasks moves from experimental core to an extension with a reworked lifecycle, roots/sampling/logging are deprecated, and the missing-resource error code changes from -32002 to standard -32602. The RC is explicit that it is not final and that changes may land before release; Tier 1 SDKs are in beta against it, and their maintainers still recommend the stable releases for critical workloads.
Why it matters: this is the migration you knew was coming, and the calm part is now. If your MCP server leans on protocol sessions for state, or your client matches the literal -32002, or you shipped against the experimental Tasks API, do it on your own schedule rather than on publication day. The upside is real: stateless MCP servers run behind a plain round-robin load balancer with no sticky sessions and no shared session store.
What it does not do is strand you. The RC defines a Legacy / Modern / dual-era compatibility model — a legacy client talking to a dual-era server still gets an initialize handshake and the negotiated older revision — and the deprecated features (roots, sampling, logging) stay fully functional through a documented deprecation window of at least twelve months. Detecting which era a server speaks is transport-specific: on stdio a client probes with server/discover and falls back on any error that is not a recognised modern error, while on Streamable HTTP it attempts a modern request and inspects the body of a 400 Bad Request before falling back. Your existing server does not stop working on July 28 — though the reverse does not hold, since a legacy client reaching a modern-only server has no fall-forward mechanism.
Sources: blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate · modelcontextprotocol.io/specification/draft/basic/versioning (draft, not final; compatibility model, checked 2026-07-22) · modelcontextprotocol.io/specification/versioning (current revision, checked 2026-07-22)
3. Claude Code week 28: a built-in browser, a /doctor that operates, and a telling safety list
Claude Code's July 6–10 releases (v2.1.202–206) gave the desktop app a sandboxed built-in browser — Claude can read and click through docs, designs, and dev-server previews, with safety classifiers reviewing actions on external sites — and turned /doctor from a read-only report into a fix-it checkup that flags unused skills, MCP servers, and plugins against their context cost. The quieter list is the interesting one: auto mode now blocks tampering with session transcripts, asks before running rm -rf on a variable it can't resolve, and background-task notifications now explicitly state that no human input occurred, "preventing fabricated in-transcript approvals from being acted on." Separately, the 50% higher weekly usage limits run through July 19.
Why it matters: each of those guardrails is a fossil of a real failure mode — transcript tampering, unresolved-variable deletion, agents inventing their own approvals. If you run any agent harness, read that list as a free incident report and check which of the three your own setup would have caught.
Sources: code.claude.com/docs/en/whats-new/2026-w28 · helpnetsecurity.com/2026/07/13/claude-code-weekly-limits-promotion-extended
4. Google's managed agents get background execution and remote MCP
On July 7, Google expanded Managed Agents in the Gemini API (Interactions API): background: true runs long tasks server-side and returns an ID to poll instead of holding an HTTP connection open, agents can now call remote MCP servers directly from their sandbox, custom client-side functions mix with built-in tools, and network credentials can be rotated mid-session without losing sandbox state.
Why it matters: Anthropic, OpenAI, and Google have now converged on the same managed-agent primitives — server-side execution, detachable sessions, and remote MCP as the enterprise integration surface. Two practical takeaways: your internal APIs increasingly need an MCP endpoint to be reachable by any of the three ecosystems, and credential rotation for agents is becoming a platform feature — stop hand-rolling it.
Source: blog.google/innovation-and-ai/technology/developers-tools/expanding-managed-agents-gemini-api
5. China issues a "backdoor" security alert over Claude Code
On July 8, a cybersecurity platform operated by China's industry ministry (MIIT) warned of a serious security "backdoor" risk it says it identified in Anthropic's Claude Code. Anthropic's models are not officially available in China, but the tooling circulates anyway, and it's one of the first times a Chinese government body has publicly flagged a Western coding agent as a security threat. Anthropic rejected the "backdoor" characterization within days: engineer Thariq Shihipar and a company spokesperson said the flagged mechanism was a March 2026 anti-abuse experiment (checking device time zone to curb reseller abuse and distillation by banned regions/labs), not a backdoor, and said stronger mitigations have since landed and the code was slated for removal.
Why it matters: two separate lessons. Geopolitically, agentic dev tools are now inside the perimeter of state-level scrutiny — if you operate teams or subsidiaries in China, expect this to surface in procurement and audit questionnaires. Technically, strip the politics and the underlying concern is legitimate for every agentic CLI regardless of vendor: a tool with shell access and network egress is an attack surface, and the answer is the sandboxing and permissioning discipline you'd apply to any privileged automation — not vendor trust.
Sources: reuters.com/legal/litigation/china-issues-backdoor-security-alert-over-anthropics-claude-code-2026-07-08 · scmp.com/news/china/article/3359901/anthropic-hits-back-after-china-warns-claude-code-backdoor-risks
6. EU AI Act: the omnibus moved the high-risk deadlines — August 2 didn't move
The Digital Omnibus on AI cleared its final hurdles: the European Parliament approved it on June 16 (423–57) and the Council gave final adoption on June 29. Formal entry into force is pending publication in the Official Journal — expected before the August 2, 2026 high-risk-obligations deadline, but not yet confirmed as published as of July 15. High-risk AI system obligations shift from August 2, 2026 to December 2, 2027 (stand-alone systems) and August 2, 2028 (AI embedded in regulated products); watermarking and machine-readable labelling of AI-generated content is due December 2, 2026 for systems on the market before August 2, 2026. What did not move: most remaining AI Act provisions still start applying on August 2, 2026 — three weeks out — including the start of Commission enforcement powers over general-purpose AI models.
Why it matters: "the AI Act got delayed" is only true for the high-risk bucket. If your compliance work went on the shelf when the delay headlines hit, check which bucket your systems are actually in — the GPAI and transparency clocks are still running, and enforcement capacity arrives August 2.
Sources: europarl.europa.eu/news/en/press-room/20260611IPR45207/ai-act-ep-approves-simplification-measures-and-nudifier-app-ban · consilium.europa.eu/en/press/press-releases/2026/06/29/artificial-intelligence-council-gives-final-green-light-to-simplify-and-streamline-rules
Want the discipline behind these calls, not just the headlines? The curriculum covers agent architecture on Bedrock and Cloudflare end to end — see aiarch.dev/curriculum, or work through the free sample lesson at aiarch.dev/sample.
← Back to The AI Engineering Brief
Subscribe to the Brief — free.
This is the newsletter, not the membership waitlist — request an invite here →