MCP 2026-07-28 final spec ships, Claude breaks a post-quantum standard, voice gets extended thinking

The MCP 2026-07-28 specification published on July 28 as the final release — the largest update to the protocol since its launch in November 2024. The three headline changes: a stateless core replacing the session-based architecture (MCP servers can now deploy on serverless and edge infrastructure without session stores), hardened OAuth 2.0 and OIDC authorization aligned with production login standards, and versioned extensions that formalize MCP Apps (server-shipped interactive HTML UIs) and Tasks (long-running background work with poll and subscribe) as independently versioned packages. MCP monthly SDK downloads surpassed 400 million — a 4x increase this year — cementing its position as the industry standard for connecting AI agents to applications.

Anthropic published 'Bringing MCP 2026-07-28 to Claude' on the same day the spec shipped, announcing rolling support across Claude products. The stateless core, standardized extensions, and hardened auth reduce complexity for server builders: servers can now deploy on standard HTTP infrastructure without managing session state, MCP Apps enables embedded UI in connectors, enterprise-managed auth removes per-user setup friction, and private network tunnels reach internal systems without public endpoints. MCP server developers can submit to Claude's connector directory once their server is updated to the new spec.

Anthropic's security research team used Claude Mythos Preview to derive an end-to-end key-recovery attack against HAWK-256, a lattice-based post-quantum signature scheme under consideration for NIST standardization. The attack exploits a previously unused symmetry in the lattice behind the signature scheme and approximately halves the block size required in lattice reduction to recover an equivalent secret key. Anthropic's released implementation gives an expected runtime of about 3 hours 42 minutes on a 96-core server. On July 29, the HAWK team withdrew HAWK from NIST's additional post-quantum signature standardization process after confirming Anthropic's results. Anthropic also reported a 200- to 800-fold speedup on a meet-in-the-middle attack on 7-round AES-128. Neither result affects production systems.

Anthropic shipped extended thinking in voice mode, letting Claude reason through hard problems before speaking its response. When thinking is enabled, Claude works through the problem internally and then delivers a considered spoken answer rather than the first response that comes to mind. Available in the Claude iOS and Android apps by tapping the sound wave icon and enabling extended thinking in voice settings. Works with Sonnet 5 and Opus 5.

After weeks of rolling extensions, Fable 5's plan structure is now permanent. From July 20: Max and Team Premium plans include Fable 5 at up to 50% of weekly usage limits at no additional cost — this is a standing feature, not a promotion. Pro and Team Standard subscribers moved to usage credits at $10/$50 per MTok, softened by a one-time $100 credit automatically applied. Claude Code's 50% higher weekly limits continue through August 19, covering all Pro, Max, Team, and seat-based Enterprise users. Note: the bonus usage phase that ran through July 19 has ended, dropping regular limits back by roughly 33% — Fable 5 on Max and Team Premium draws from the now-normalized weekly limits.

As announced during the deprecation notice in June, fast mode for Claude Opus 4.7 was removed on July 24. Any request to claude-opus-4-7 with speed: 'fast' now returns an API error. Migrate to fast mode for Claude Opus 4.8 or Opus 5. The deprecation warning that appeared on stderr in print mode and in the interactive model picker has been removed now that the deadline has passed.

Two new beta features shipped on the Claude Platform: mid-conversation tool changes let you add, remove, or update tools between turns without starting a new session, useful for agentic workflows that need to progressively unlock capabilities. Automatic API fallbacks route requests to an alternative model when the primary model is rate-limited or unavailable, with the fallback model and reason reported in the response metadata. Both features require opting in via beta headers in the API.