MCP's 2026-07-28 spec goes stateless — what breaks now and what's on a 12-month clock
MCP goes stateless; Codex's 5-hour cap returns today; Copilot drops two Gemini models Thursday; Claude finds new crypto attacks on its own.
The Model Context Protocol's biggest rewrite since launch went final this week — the stateless core, with several features removed outright and three more on a twelve-month deprecation clock. OpenAI reset Codex and ChatGPT Work usage limits again and says the temporarily-lifted five-hour cap comes back today. Anthropic says its research model found new attacks against a post-quantum signature scheme and a reduced-round version of AES, entirely on its own. And GitHub's Copilot drops two Gemini models from every surface in two days. The daily pulse of AI coding tools — what shipped, what matters, what's next.
The protocol every agent depends on finishes its rewrite
MCP's 2026-07-28 spec goes stateless — what breaks now and what's on a 12-month clock
The Model Context Protocol — the plug standard AI coding agents use to reach external tools — dropped its initialize handshake and session header; per the spec's own blog, "any request can land on any instance behind a plain round-robin load balancer." No sticky sessions, no shared storage — the setup self-hosted MCP servers needed before.
What breaks on upgrade: ping, logging/setLevel, and SSE stream-resume are removed, and a new server/discover RPC is mandatory. What's on a clock: Roots, Sampling, and Logging are deprecated — "they'll keep working for at least twelve months" — along with Dynamic Client Registration, superseded by Client ID Metadata Documents (a client publishes its own registration data at a URL instead of registering with each server). The removals break your build today; the deprecations put a clock on code you already shipped.
David Soria Parra (Lead Maintainer) and Den Delimarsky (Lead Maintainer)
Changelog: modelcontextprotocol.io/specification/2026-07-28/changelog · Discussion: Hacker News (124 points). One oddity as we publish: the spec's own versioning page still lists 2025-11-25 as current, even though the new pages are live.
Two usage-limit stories, two vendors
OpenAI resets Codex usage limits again — Tibo says the 5-hour cap returns today
Tibo Sottiaux, OpenAI's Codex lead, says efficiency fixes should make GPT-5.6 Sol usage "last around 18% longer" and that OpenAI has "not reduced usage on any subscription plans" — the drain was Sol working harder (more tool calls, code mode, parallel work), and it hit power users on hard tasks far more than the median user. If you've been running long Codex sessions assuming no 5-hour wall since the July 12 lift, it's back today.
Hello people of Sol! I've reset usage limits for all ChatGPT Work and Codex users. Together with that, a quick update on GPT-5.6 Sol usage limits.
— Tibo (@thsottiaux) July 29, 2026
Over the past few weeks, many of you have told us that Sol was using your Codex limits faster than expected. To be clear, we have…
GitHub drops Gemini 2.5 Pro and Gemini 3 Flash from every Copilot surface in two days
Announced July 2, effective Thursday July 31: Copilot Chat, inline edits, ask and agent modes, and code completion all lose both models. GitHub's advice: switch to Gemini 3.1 Pro or Gemini 3.5 Flash — Enterprise admins may need to enable the replacements in their Copilot model policy first. A config default that moves: anything pinned to the old model names breaks silently on Thursday.
Allison
Anthropic's research team, not its product team
Anthropic says Claude found new attacks on a post-quantum cipher and AES, without human help
Using an internal model called Claude Mythos Preview, Anthropic reports a practical key-recovery attack on HAWK-256 — a post-quantum signature scheme under NIST review, deployed nowhere — cutting the expected attack cost from 2⁶⁴ to 2³⁸ operations, plus a 200–800x speedup on an existing attack against a reduced 7-round version of AES-128 (the full 10-round cipher is unaffected). Each finding cost roughly $100,000 in API spend; HAWK's authors were notified in June, with disclosure coordinated to the public NIST mailing list. Not a coding-tool release — but when someone tells you "Claude broke a cipher," this is what actually happened, and what didn't: nothing deployed is affected.
That's Wednesday. If the MCP migration breaks something real in your stack, reply — what breaks in practice beats what the changelog says should. And if someone forwarded you this, subscribe here.
Also worth your time
Show HN: Formally verified 3D CSG — trust 93 lines of spec, not 1,000 lines of AI code — the AI wrote ~1,000 lines of implementation plus 60,000 lines of Lean 4 proofs; the proof checker verifies all of it against a 93-line human-readable spec, so nobody reads either pile to trust the result. (111 points; repo)
OpenAI is retiring Atlas, its browser, on August 9 — browser-agent capability moves into ChatGPT and Codex directly. Bookmarks, tabs, and history don't migrate automatically; export before the cutoff.
The New Way is human-curated — a person picks every story. The summaries are written with AI (Claude) and reviewed before we hit send.
