Five verified moves this week, and a team of one can act on each before the weekend. The two coding CLIs most founders actually run — Claude Code and OpenAI's Codex — spent the week doing the same unglamorous thing at the same time: closing the gaps that let an agent do something you didn't authorize. Claude Code patched three separate ways an agent could slip its leash. Codex started scrubbing your secrets out of its own transcript. Underneath both, the new stateless MCP spec stopped being a document and became a dependency. The week's one genuine "watch" is a Chinese open-weight model that may or may not have shipped its weights by the time you read this. And the corrections desk has three headlines to take off your radar. Every item below is dated and sourced; each carries the one line that changes what you do next.

1. Claude Code shipped five releases in five days — three of them close permission bypasses#

Between August 4 and August 8, Claude Code shipped five point releases, v2.1.222 through v2.1.226 (GitHub releases; CHANGELOG). Most of the surface area is security, and it lands in three distinct classes:

What it means: If you run agents unattended — background tasks, scheduled runs, anything that acts without you watching — this is a patch-this-week window, not a nice-to-have. Three separate bypass classes in five days is the same signal we flagged when the coding-agent CLIs hardened permissions earlier this month: the approval prompt was never a real security boundary, so the fixes that make the sandbox trustworthy are the ones that matter. Update, then contain the shell anyway — defense in depth is the whole game here. The new self-hosted runner is a bonus for the cost-conscious: it lets a solo builder point Claude Code at their own cheap compute instead of renting it.

2. Codex moved to the new MCP spec — and started redacting your secrets#

OpenAI's Codex 0.147.0 shipped on August 7 with a dense release (GitHub releases): support for the MCP 2026-07-28 protocol including paginated tool discovery, portable Agent Plugins searchable across local, personal, workspace, and remote catalogs, Cursor skill imports with conversation sync, an --approve-for-me auto-approval flag, and secret redaction in both displayed commands and conversation history. The prior build (0.146.1, Aug 5) had already tightened automatic-review defaults for cyber-capable models.

What it means: Upgrade for the secret redaction alone — a leaked API key that used to sit in your scrollback (and in any log or screen recording of it) now gets scrubbed at display time. That's the same instinct behind Claude Code's credential masking, arriving in the other camp the same week. The Cursor skill import is the quietly strategic bit: it lowers the switching cost between Cursor and Codex to near zero, so your accumulated skills stop being lock-in. And paginated discovery is the feature you won't need until your MCP tool catalog gets big — at which point you'll be glad it's there. If you're still deciding which terminal agent to standardize on, our Muse Code vs Claude Code vs Codex breakdown now has one more data point per contender.

3. Stateless MCP stopped being a spec and became a dependency#

The MCP 2026-07-28 revision — published July 28 — spent this week arriving in the tools you run, not just the changelog. Both Codex 0.147.0 (Aug 7) and Claude Code v2.1.225 (Aug 8, which fixed MCP OAuth server auth on macOS) moved on it (MCP spec). The core change is statelessness: the spec removes protocol-level sessions and the Mcp-Session-Id header and pushes method and tool names into HTTP headers, so a gateway can route and authorize a request without parsing its JSON body. Around that sit an Extensions framework (Tasks, MCP Apps, Enterprise Managed Authorization), authorization hardening (RFC 9207 issuer validation; a move off Dynamic Client Registration toward Client-ID Metadata Documents), and a formal 12-month deprecation policy.

What it means: The stateless transport lets a server that used to need sticky sessions and a shared session store sit behind a plain round-robin load balancer — the cheapest infrastructure a bootstrapped team runs. If you host an MCP server, that's a real simplification you can bank this quarter; our migration checklist is the fast path, and the Extensions, Apps, and Tasks breakdown covers what's new beyond statelessness. The one thing to put on your calendar: DCR is deprecated, so any new auth work should target CIMD, not the pattern you may have copied from a six-month-old tutorial.

4. The week's biggest watch: Qwen's first Max-scale open weights#

Alibaba's Qwen3.8-Max has been API-GA since August 3 — a reported 2.4-trillion-parameter mixture-of-experts model with roughly 95B active parameters, a 1M-token context, native text/image/video input, and pricing around $2/$6 per 1M tokens (DataCamp). The news is the promise attached to it: Alibaba committed to publishing open weights for Qwen3.8-Max, plus a smaller Qwen3.8-27B, on Hugging Face and ModelScope during the week of August 10 (Digital Applied). That would be the first open-weight release at "Max" scale. As of this writing, the repositories had not appeared and no license was named.

What it means: A Max-class open-weight model changes the self-host math for cost-sensitive builders — frontier-ish capability you can run on-prem instead of renting per token. But treat this as a watch, not a purchase: check the Qwen org on ModelScope and Hugging Face yourself this week, and do not build on the weights until the license is named — "open weights" and "you can build a business on it" are different sentences until you've read the terms. If you already keep an open-weight backend wired into your router — as we argued when pointing a coding agent at Kimi K3 — Qwen3.8-Max is a config line away the day the license clears.

5. Corrections desk: three headlines to take off your radar#

Three stories are making the rounds this week that a founder should not act on as fresh news:

What it means: The reason we run a corrections item is the same reason answer engines cite this desk: in a week where the real signal is permission hardening, the noise is recycled funding and unshipped models. Knowing which is which is the founder's edge.

The throughline: the two coding agents you rely on hardened the same weakness at the same time (items 1 and 2), the plumbing under them quietly got cheaper to run (item 3), a real open-weight option is one license-file away (item 4), and half of what looks like this week's news isn't (item 5). The job for a team of one is small and concrete: update Claude Code and Codex this week, turn secret redaction on, plan any new MCP auth around CIMD, keep one eye on the Qwen repo — and don't let a recycled headline set your roadmap. The decision underneath all of it — which coding tool to actually standardize on — is the one we ranked, by job, yesterday.