The platform-building phase that started last week is accelerating. OpenAI shipped Codex CLI v0.146.0 with Agent Plugins, named sessions, thread forking, and remote Code Mode over WebSocket — 222 commits ahead of v0.145.0. They also quietly open-sourced the Codex Security CLI under Apache 2.0, putting an agent-based vulnerability scanner into developers’ hands for free. Anthropic answered with Claude Opus 5, a near-frontier model at half the price of Fable 5 that immediately became the default in Claude Code. And in the open-weight world, 32 Kimi K3 agents found 19 Redis zero-days in 90 minutes — a demonstration that agentic security research is no longer theoretical.

Here is our weekly breakdown of what matters across OpenAI’s models, the Codex ecosystem, and the broader competitive landscape.

1. Codex CLI v0.146.0 — Agent Plugins, Session Management, and Remote Execution

The July 29 release is the most structurally significant Codex CLI update since the multi-agent V2 stabilization in v0.145.0. It shifts Codex from a conversational terminal tool toward something closer to an agent operating system.

Agent Plugins 1.0. Codex now recognizes a root plugin.json manifest that describes reusable agent capabilities — portable metadata, direct skills under skills/, and MCP configuration in mcp.json. Plugins can be published at the workspace level, and Codex added marketplaces for Amazon Bedrock and Claude Code alongside its own. The architectural implication is significant: a plugin package can now travel between Codex, Claude Code, and Bedrock without per-host reconfiguration. What remains host-specific — hooks, permissions, UI elements — lives in a separate extension overlay within the same manifest. This is the first concrete step toward portable agent tooling across competing platforms.

Named sessions, pinned threads, and side conversations. /new and /clear now accept an optional session name. Important threads can be pinned for quick access, and ctrl-/ switches between side conversations without closing either the side conversation or the parent thread. Session state — sent messages, final responses, failed-turn errors, import time, and approval settings — persists across interruptions, replays, imports, and forks. The session is becoming a managed object rather than a scrollback buffer attached to one terminal window.

Thread forking with paginated history. Threads can now be forked with full paginated history, including temporary forks that don’t clutter the thread list. This enables parallel exploration of different approaches from a shared context — a workflow that previously required external orchestration.

Remote Code Mode over WebSocket. The Codex app-server can connect to a remote Code Mode host via ws:// or wss://. When the flag is omitted, it starts a local host as before. This separates the agent control plane from the code-execution plane, enabling thin-client setups where the local interface drives a heavier remote host. Teams that already provision cloud workstations no longer need a hand-built relay to reach them.

Proxy and MCP lifecycle fixes. Configured proxies are now honored across authentication, plugin downloads, MCP authorization, remote execution, and WebSocket connections. MCP connections stay live across auth and config changes — previously a source of silent reconnection failures. Executor-provided skills are now discoverable and readable from within the session, with warnings when context budget constraints force skill truncation.

2. Codex Security CLI — Open-Sourced Under Apache 2.0

OpenAI quietly published @openai/codex-security on GitHub and npm on July 28–29. Hacker News found it before the official announcement. The package is Apache-2.0 licensed and includes a CLI, TypeScript SDK, Dockerfile, and GitHub Actions workflows for CI integration.

What it does. Codex Security builds a repository-specific threat model, explores realistic attack paths, validates findings in an isolated sandbox, and proposes patches for human review. It supports full-repository scans, targeted path reviews, Git diff scanning, working-tree inspection, and bulk scans across many repositories via CSV input. Scan history persists in SQLite, enabling longitudinal finding tracking — a vulnerability detected on Monday keeps its identity when Friday’s scan revisits the same code path.

Outputs and CI integration. Completed scans generate report.md, findings.json, coverage.json, and a scan manifest. Export formats include SARIF, JSON, and CSV — meaning the results slot directly into GitHub Code Scanning, Azure DevOps, or any existing security dashboard. The --fail-on-severity flag returns a failing exit code when findings exceed a threshold, enabling use as a CI gate. Git hooks can scan staged changes before commit.

The catch. The client is open source; the brain is not. Running a scan still requires access to the Codex Security service on OpenAI’s side. The default model is gpt-5.6-sol at extra-high reasoning. Runtime requires Node.js 22+, Python 3.10+, and Codex Security access on your OpenAI account. The source code is public; the scanner backend remains gated to approved Enterprise, Business, and Education customers.

Commands at a glance:

  • scan — full repo, --path, --diff, or working-tree
  • bulk-scan — many repos from a CSV, with --workers for parallelism
  • scans list/show/rerun/match/compare — history and regression tracking
  • export --export-format sarif — structured output for security tooling
  • validate / patch — verify findings and generate proposed fixes
  • install-hook — pre-commit scan of staged changes

For engineering teams already invested in OpenAI’s ecosystem, this is a meaningful addition to CI/CD pipelines. For teams evaluating it against standalone SAST tools, the gated access and OpenAI model dependency are the key constraints.

3. ChatGPT Work — Enterprise Enrollment and Credit Incentive

OpenAI opened ChatGPT Work to enterprise customers with a credit incentive designed to drive adoption. Enterprise customers can enroll through August 21. Each teammate who tries Work for the first time within two weeks of enrollment gets up to $200 in credits, valid for 14 days. Existing customers contact their account team; new prospects reach out through OpenAI’s sales channel.

This is a customer acquisition play for the Work agent surface — not a pricing change. The credits are per-user, not per-organization, which means the incentive aligns with individual adoption rather than bulk procurement. For engineering leads evaluating ChatGPT Work as a productivity tool, the 14-day credit window is a reasonable window to run a pilot with a real workflow end-to-end.

Assistants API — 26 days and counting. The August 26 shutdown is now less than four weeks away. No automated migration tool will ship. The Responses API plus Conversations API is the replacement, and it has reached full feature parity including deep research, MCP tool connections, and computer use. Azure OpenAI follows the same timeline. Microsoft’s Fabric Data Agent team recommends migrating to MCP rather than rebuilding against OpenAI’s Responses API directly — a signal that platform partners are already building around the post-Assistants landscape. Teams still on Assistants API should treat this as a P0 migration with a hard deadline.

4. Anthropic — Claude Opus 5 and the Coding Stack

Anthropic shipped Claude Opus 5 on July 24, and it immediately became the default model in Claude Code across both Claude Max and Claude Pro plans. The pitch is direct: near-Fable-5 intelligence at half the price.

Pricing and positioning. Opus 5 costs $5/$25 per million input/output tokens — identical to Opus 4.8 and half of Fable 5’s $10/$50. The Artificial Analysis Intelligence Index scores Opus 5 at 61, one point above Fable 5 and two above GPT-5.6 Sol. On Frontier-Bench v0.1 (agentic coding), Opus 5 more than doubles Opus 4.8’s score. On CursorBench 3.2 at max effort, it lands within 0.5% of Fable 5’s peak at half the cost per task. On ARC-AGI-3, it scores three times the next-best model.

Effort dial. A five-level effort ladder (low, medium, high, xhigh, max) defaults to adaptive. At low effort, Opus 5 scores 62.8% on a composite benchmark at $2.55 per task — competitive with Opus 4.8 at max effort ($62.3% at $5.77). Fast mode runs at $10/$50, roughly 2.5× faster, available as a research preview on the Claude API.

System prompt reduction. Anthropic published new context-engineering guidance showing that cutting Claude Code’s system prompt by over 80% produced no measurable drop in coding-eval performance. This is a signal for agent developers: verbose system prompts carry a real token cost, and aggressive trimming may be safe.

Claude Code v2.1.219. Shipped July 24 alongside Opus 5. The /fork command now creates a proper background session (own row in claude agents) while the old in-session subagent path becomes /subtask. Session-wide caps remain at 200 web searches and 200 subagents. MCP auto-backgrounding for long-running calls is preserved. Claude Sonnet 5’s promotional pricing ($2/$10 per million tokens) runs through August 31, after which it moves to $3/$15.

5. Competitive Landscape — Agentic Security, Parallel Swarms, and MCP’s Statelesss Future

Kimi K3 — 32 Agents Find 19 Redis Zero-Days

Security researcher Chaofan Shou deployed 32 parallel Kimi K3 sub-agents against the Redis codebase. The agents autonomously cloned the repository, built custom fuzz harnesses, debugged crashes in GDB, and produced working proof-of-concept exploits — finding 19 previously unknown vulnerabilities in approximately 90 minutes, including an authenticated RCE chain built in 27 minutes.

Redis shipped seven security patch releases on July 23. The underlying bugs are confirmed real; the 19-zero-day count and 27-minute timeline are self-reported and not independently verified. A joint UK AISI and US CAISI study published the same day found Kimi K3 scored 32.2% on ExploitBench versus 76.2% for unnamed US frontier models, adding appropriate context to the headline.

The implication for security teams: agentic vulnerability discovery is now demonstrably possible with open-weight models at a scale that matters. The gap between frontier proprietary models and open-weight alternatives for security tasks remains real but is narrowing fast enough to merit evaluation.

xAI — Grok Build Workflows at 1,024 Parallel Agents

xAI’s Grok Build gained a Workflows orchestration layer. A single plain-language request is decomposed into phases, each assigned to parallel sub-agents. Default concurrency is 128 agents, scaling to 1,024 for the largest jobs. Independent “skeptic” agents verify findings before consolidation. Workflows are saved as reusable slash commands in .grok/workflows/.

The underlying grok-build-0.1 model is priced at $1/$2 per million input/output tokens — aggressively cheap. Access requires SuperGrok ($30/month) or X Premium+ ($40/month), with 1,024-agent runs requiring SuperGrok Heavy ($300/month). xAI also launched free Grok 4.5 add-ins for Excel, Word, and PowerPoint on July 20, expanding their surface area into Office workflows.

MCP Specification — Largest Revision Since Launch

The 2026-07-28 MCP specification revision shipped as the largest protocol change since MCP launched. Key changes: the protocol core is now stateless — the initialize/initialized handshake and Mcp-Session-Id header are removed. Every request carries its protocol version and client capabilities in _meta. Multi Round-Trip Requests (MRTR) replace server-initiated requests. MCP Apps (server-rendered HTML UIs in sandboxed iframes) is now an official extension. The extensions framework uses reverse-DNS identifiers with independent versioning. Authorization hardens toward OAuth 2.0 and OpenID Connect. A formal deprecation policy requires a minimum 12-month window.

Microsoft shipped MCP C# SDK v2.0 implementing the new spec, with backward compatibility for v1 code. For teams building MCP servers, the stateless core means ordinary HTTP infrastructure can now route MCP traffic — no session affinity required. This is a meaningful operational simplification for load balancers, CDNs, and API gateways.

Google — Gemini 3.5 Pro: Fourth Miss Imminent

Gemini 3.5 Pro has now missed three consecutive release windows — the original June target, a leaked July 17 date, and the broader July window. Google’s model catalog still lists no gemini-3.5-pro entry. The company has quietly stopped naming target dates, and reports indicate it has begun pretraining Gemini 4 instead. Prediction markets now place the release in late July to early August with meaningful odds of another miss. Google’s competitive position in the frontier model race continues to erode.

Final Thoughts

This week the agent platform layer took concrete shape. Codex CLI v0.146.0’s Agent Plugins make tooling portable across platforms — a first for the coding agent ecosystem. Codex Security CLI puts agentic security scanning into developers’ hands, even if the brain remains gated. Opus 5’s pricing puts frontier-level coding intelligence at $5/$25, halving the cost ceiling for teams that standardize on Anthropic. And the MCP spec’s stateless core simplifies the infrastructure story for every agent platform that depends on it.

Three actions for engineering leaders this week: First, evaluate Codex CLI v0.146.0’s Agent Plugins against your team’s reusable tooling — the cross-platform manifest format is the first credible portability story for agent skills. Second, if you have an OpenAI Enterprise or Business account with Codex Security access, run a scan against a production repository and compare findings against your existing SAST pipeline. Third, if you haven’t started the Assistants API migration, you have 26 days — start now.

The agentic security era arrived this week. Whether it’s 32 Kimi K3 agents finding Redis zero-days or Codex Security scanning your CI pipeline, the message is the same: the time horizon for vulnerability discovery is compressing, and the tools to participate are increasingly accessible.

Follow the conversation on X.