Claude Sonnet 5 Launch (June 30) #
- Introducing Claude Sonnet 5 (Anthropic) — Launched June 30 as the new default mid-tier model for Free/Pro plans. 1M token context window, 128k max output, adaptive thinking. Near-Opus performance at $2/$10 per million tokens (intro pricing through August 31, then $3/$15). The key positioning: Sonnet 5 can now do what only Opus could a few months ago — browser/terminal tool use, complex multi-step tasks without constant intervention.
- Anthropic launches Claude Sonnet 5 as a cheaper way to run agents (TechCrunch) — “cheaper way to run agents” framing confirms the strategic positioning: Sonnet 5 is the default agent execution model; Fable 5 is the planner/orchestrator.
Claude Code July 2026 Changelog #
- Claude Code changelog (Anthropic) — July 2026 updates: (1) subagents now run in background by default — Claude keeps working while they run, notified when finished; (2) new Notification hook (
agent_needs_input / agent_completed) fires for sessions needing input or finishing; (3) fixed hook events not streaming during SessionStart hooks in headless sessions; (4) fixed SessionStart/Setup/SubagentStart hooks silently hiding stderr on exit code 2 — now shown in transcript; (5) additional working directories now added to MCP roots. - Claude Code subagents: the 2026 production playbook (Totalum) — Background-by-default subagents pattern: orchestrator keeps working while workers run; each subagent gets its own context. The “lower-power model for implementation subagent” pattern (Simon Willison, July 3: “use your judgement to decide an appropriate lower power model and run that in a subagent”) is now the canonical cost-efficiency approach.
- Claude Code, Gemini CLI, GitHub Copilot Agents Vulnerable to Prompt Injection via Comments (SecurityWeek) — “Comment and Control” attack class: malicious PR titles / issue bodies / comments inject instructions into Claude Code Security Review, Gemini CLI Action, and GitHub Copilot Agent. Proactive (not reactive) — GitHub Actions auto-trigger on
pull_request, issues, issue_comment events; victim interaction not required. Claude Code: PR title directly interpolated into prompt with zero sanitization. Anthropic classified Critical (CVSS 9.4), awarded $100 bug bounty. - Comment and Control: Prompt Injection to Credential Theft (Aonan Guan) — Full research write-up. Attack runs entirely within GitHub: write malicious PR title → agent reads as trusted context → executes attacker instructions → exfiltrates credentials via PR comment or git commit. No external server required. Key distinction from June 25 PoC (indirect injection via repo content): that attack required opening an untrusted repo; this attack triggers on any PR or issue filed against a repo running these agents.
Fable 5 Restoration and Cybersecurity Classifier #
- Claude Fable 5 Extends By Five More Days (Forbes) — Bonus access extended through July 12 for Pro/Max/Team/Enterprise subscribers (up to 50% of weekly usage limits). After July 12: credit-based access at $10/$50 per million tokens.
- Redeploying Claude Fable 5 (Anthropic) — New cybersecurity safety classifier: blocks the reported jailbreak exploit in >99% of cases; also blocks some benign coding/debugging requests (falls back silently to Opus 4.8). Enterprise admins can now control model access and effort level settings per user.
Simon Willison #
- Simon Willison’s Weblog — claude-code (simonwillison.net) — July 3: “For all coding tasks use your judgement to decide an appropriate lower power model and run that in a subagent.” Rationale: implementation work rarely needs top-tier model; judgment and synthesis stay with the main loop. Using Claude Fable on iPhone to build sqlite-utils 4.0 stable — describes it as “truly science fiction” to turn a walk-idea into working tested documented code from phone prompts.
- Claude Code Timeline Viewer (simonwillison.net) — Tool to open a Claude Code session
.jsonl file and explore it as an interactive timeline. Useful for session auditing and understanding agent behaviour retrospectively.
- Best Claude Code Skills to Try in 2026 (Firecrawl) — Julius Brussee’s “Caveman” skill: cuts Claude Code output tokens by an average of 65% by stripping narration while keeping every technical fact and code block byte-for-byte intact. The most impactful cost-reduction technique found this cycle.
System Prompt Research #
- Piebald-AI/claude-code-system-prompts (GitHub) — Community project tracking all parts of Claude Code’s system prompt, 27 built-in tool descriptions, subagent prompts (Plan/Explore/Task), and utility prompts (CLAUDE.md, compact, statusline, WebFetch, Bash, security review, agent creation). Updated per version. Useful for understanding exactly what context Claude Code receives.
Cross-links #
- Team & Org Use of Claude Background-by-default subagents and the lower-power-model subagent pattern are directly relevant to team orchestration cost management.
- [permission-friction-quest] “Comment and Control” is a new attack vector distinct from the June 25 repo-content injection — GitHub PR/issue surface is different from untrusted repo content surface.
- Claude Integrations Enterprise-Managed Authorization (across Claude chat/Code/Cowork) is this week’s integration story.
- Emerging pattern: Two separate prompt injection attack classes in rapid succession (June 25 repo-content, July Comment and Control) signals that the attack surface of AI coding agents is being actively probed across multiple vectors simultaneously.
- Quality signal: The Piebald-AI system prompt tracker is the cleanest external resource for understanding Claude Code internals without relying on the source leak.
- Author to watch: Aonan Guan — published the most technically precise Claude Code security research this cycle.