If you stepped away from the feed for a week, here is the whole state change in one paragraph: two frontier model families launched a day apart, the frameworks you already use shipped support for them almost immediately, one library you may be running got an urgent security patch, and the Model Context Protocol's biggest revision is now fourteen days out. The models are the headline. The framework support is the thing you can act on today. The patch and the cutover date are the two things you can't let slide.

Five items, each with the "so what" up front.

1. Grok 4.5 landed — an "Opus-class" coding model at a fraction of the price#

So what: a cheap frontier-tier coding model with day-one Cursor integration is a direct line item on your dev spend.

xAI shipped Grok 4.5 on July 8, its first model since the company went public and folded Cursor in. Musk described it as "Opus-class, but faster, more token-efficient and lower cost." Reported pricing lands at roughly $2 per million input tokens and $6 per million output — well under the $5/$25 that Anthropic's Opus tier has commanded. The pitch is agentic work, not chat: reports credit it with about 2× the token efficiency of comparable models, solving tasks in under half the steps, which matters more than the sticker price when your agent loops. It's live in Grok Build, in Cursor on all plans, and the xAI console — not yet in the EU. (We keep a running read on where it fits versus the incumbents in Grok 4.5 vs GPT-5.6 vs Opus 4.8 as a coding-agent backend.)

Pricing and efficiency figures here are from launch reporting; xAI's own pages were unreachable at press time, so treat the exact numbers as reported rather than confirmed.

2. GPT-5.6 went public as three tiers — Sol, Terra, Luna#

So what: the cheap tiers, not the flagship, are what reset high-volume agent economics.

On July 9, after a government-gated preview, OpenAI released the GPT-5.6 family in three tiers: Sol (flagship, reported $5/$30 per million), Terra (reported $2.50/$15, positioned at roughly GPT-5.5 performance), and Luna (reported $1/$6, the fastest and cheapest). The headline efficiency claim is a 54% token-efficiency boost and better prompt caching — a 90% discount on cached reads, with cache writes billed at 1.25× the uncached input rate. For an agent that replays a large system prompt every turn, that caching math often beats the per-token rate. The three-tier split is the real story for founders; we broke down which tier to actually pick in GPT-5.6 went public: the three-tier menu for founders.

Tier names and pricing are from launch reporting; OpenAI's announcement page was unreachable at press time.

3. The part you can act on: your framework already speaks both models#

So what: this is a config change, not a rewrite — if you route by model ID, you're one string away.

This is the item the launch coverage buried. Within the same week, the tools you build on shipped support:

If your stack routes models through a gateway or a config string, adopting either new model this week is a one-line change. That is the whole reason day-one framework support is worth more than the launch benchmark.

4. Patch now: Pydantic AI tool-call injection (GHSA-jpr8-2v3g-wgf9)#

So what: if you serve a Pydantic AI agent behind AG-UI or the Vercel AI adapter, this is a direct path to unauthorized tool execution.

On July 11, Pydantic AI published advisory GHSA-jpr8-2v3g-wgf9: a flaw in sanitize_messages in its UI adapters let a remote client trigger unintended tool calls with client-supplied arguments (moderate severity, CVSS 6.5). Affected ranges are >=1.88.0,<1.107.1 and >=2.0.0b1,<2.5.0; it's fixed in 1.107.1 and 2.5.0. Upgrade, then check that your guardrails live in before_tool_execute hooks rather than model-request hooks — the advisory's own guidance. This is a "patch this week" item, not a "next sprint" one. (Verified against the GitHub advisory.) While you're auditing tool-call handling, note that the approval APIs themselves moved this year — the 2026 tool-approval migration covers what got renamed.

5. The MCP clock: 2026-07-28 is two weeks out#

So what: if you host MCP servers, session-based code and three primitives need rework before the cutover.

The 2026-07-28 MCP spec is the largest protocol revision since launch, and the TypeScript SDK's 2.0.0 beta line (beta.4 shipped July 13) is already out to prepare for it. The big moves: stateless transport (run a server behind a plain load balancer, no sticky sessions), the Mcp-Session-Id header removed, new MCP Apps/Tasks, and the deprecation of Roots, Sampling, and Logging. If any of your server code assumes a session ID or leans on those three primitives, start the migration now — we walk the specifics in MCP deprecates Sampling, Roots, and Logging and the 2026 stateless spec changes. Two weeks is enough time if you start this week.

The through-line: the models make the headlines, but the founder-grade moves this week are unglamorous — flip a model ID to test the cheaper tier, run one pip install -U, and put the MCP cutover on your calendar for the 28th. The desk will keep the running comparisons updated as the pricing pages come back online and the benchmarks settle.