Anthropic launches Claude For Legal with 20+ MCP connectors

Anthropic launched Claude For Legal with 20+ MCP connectors and 12 practice-area plugins, marking its deepest vertical product push yet. Google reframed Android from operating system to “intelligence system” with pervasive Gemini integration across phones, cars, and the new Googlebook laptops. Meanwhile, a surge of security research – five papers in a single day targeting MCP traffic, agent skill registries, and CI/CD agentic workflows – underscored that the attack surface is growing as fast as the capability surface.

Developer Tools #

Anthropic launches Claude For Legal with 20+ integrations and 12 practice-area plugins #

Anthropic / TechCrunch / Bloomberg / Fortune / Artificial Lawyer

Anthropic released its most expansive vertical product to date: Claude For Legal includes 20+ MCP connectors to existing legal software (DocuSign, Everlaw, Thomson Reuters CoCounsel, Box, Ironclad), 12 practice-area plugins covering M&A diligence, employment law, privacy, regulatory compliance, and litigation, plus a cross-app Microsoft 365 integration that embeds Claude across Word, Outlook, Excel, and PowerPoint as a single context-carrying agent. Freshfields, Quinn Emanuel, and Holland & Knight are already using it on live matters. This is the clearest signal yet that frontier labs see vertical SaaS displacement – not just API access – as the business model, and MCP is the integration layer making it possible.

Google introduces Gemini Intelligence for Android #

Google / TechCrunch / CNBC / Digital Trends

At the Android Show, Google announced Gemini Intelligence – a system-level AI layer that automates multi-step tasks across apps, fills forms using personal context, summarizes and compares web content in Chrome, and enables natural-language widget creation (“Create My Widget”). The Rambler feature polishes spoken dictation into professional text via Gboard. Rollout begins this summer on Samsung Galaxy and Google Pixel phones, expanding to watches, cars, glasses, and the new Googlebook laptops later in 2026. The framing shift from “operating system” to “intelligence system” positions Gemini as the orchestration layer for Android, directly competing with Apple’s on-device AI strategy ahead of WWDC.

Delta Channels: Evolving LangGraph’s runtime for long-running agents #

LangChain Blog

LangGraph introduced Delta Channels, a new checkpointing primitive that stores only state deltas between steps instead of full snapshots, with periodic full snapshots every K steps. Standard checkpointing grows at O(N-squared) complexity – a coding agent running 200 turns accumulates 5.3GB of checkpoint data. Delta Channels reduce that to 129MB, a 41x reduction, while preserving instant resume, full observability, and human-in-the-loop features. For teams running long-horizon agents in production, this addresses one of the most concrete infrastructure costs: the storage and I/O overhead of maintaining agent state across hundreds of steps.

Research & Papers #

When Reasoning Traces Become Performative: Step-Level Evidence that Chain-of-Thought Is an Imperfect Oversight Channel #

arXiv

Using a step-level Detect-Classify-Compare framework validated with Patchscopes, tuned-lens probes, and causal ablation, this paper shows that chain-of-thought traces desynchronize from the internal computation that determines the model’s answer – the visible reasoning steps become “performative” rather than faithfully reflecting the model’s actual decision process. This directly extends yesterday’s Hidden Error Awareness finding (which showed models internally know when their reasoning is wrong but express high confidence regardless) by demonstrating the mechanism: the trace and the computation diverge at identifiable steps. For anyone using CoT traces for oversight or auditing, this means the traces are an unreliable monitoring channel – internal probes are necessary to detect when the visible reasoning has decoupled from the actual computation.

A Formal Comparison Between Chain of Thought and Latent Thought #

arXiv

This paper formally proves that latent thought reasoning – operating directly in continuous latent space rather than generating intermediate tokens – admits strictly richer computations than chain-of-thought reasoning for equivalent computational budgets. While CoT is constrained to discrete linguistic representations at each step, latent thought can encode information in continuous embeddings that have no natural-language equivalent. For architecture designers, this is a theoretical foundation for the emerging class of “thinking” models that allocate compute in latent space rather than through verbalized reasoning steps, and it quantifies the expressiveness gap between the two approaches.

On Problems of Implicit Context Compression for Software Engineering Agents #

arXiv

LLM-based software engineering agents face a critical bottleneck: context length limitations cause failures on complex, long-horizon tasks. This paper tests the In-Context Autoencoder approach – encoding context as continuous embeddings rather than discrete tokens for denser information storage – and finds that while it works well on single-shot tasks, it degrades significantly on the multi-step reasoning chains that SWE agents actually require. The failure mode is specific: compressed representations lose the relational structure between code elements that agents need for cross-file reasoning. For teams building coding agents, this means context compression is not yet a viable substitute for better context management strategies like selective retrieval and hierarchical summarization.

Security #

MCPShield: Content-Aware Attack Detection for LLM Agent Tool-Call Traffic #

arXiv

As the Model Context Protocol becomes the dominant interface for LLM agents to invoke external tools, MCPShield introduces an attack detection framework that models each agent session as a graph – tool calls as nodes, sequential and data-flow dependencies as edges – and uses sentence-embedding features over argument payloads to detect anomalous patterns. The framework addresses a gap that has been largely ignored: while MCP adoption has accelerated through integrations like Anthropic’s legal connectors and IDE plugins, monitoring of MCP traffic for injection, exfiltration, or privilege escalation has lagged behind. For teams deploying MCP-connected agents, this provides the first structured approach to instrumenting the tool-call layer for security.

Comment and Control: Hijacking Agentic Workflows via Context-Grounded Evolution #

arXiv

Automation platforms like GitHub Actions and n8n are integrating LLM agents for code review and data synchronization, but this paper demonstrates that adversary-controlled inputs – such as GitHub issue comments – can manipulate these agents into credential exfiltration and unauthorized actions. The attack uses “context-grounded evolution,” iteratively refining malicious payloads using the same context the agent sees, making detection harder because the payloads are semantically consistent with legitimate workflow inputs. For teams running agentic CI/CD pipelines, this is a concrete and immediate threat: any workflow that passes user-controlled text (issues, PRs, commit messages) to an LLM agent without input sanitization is vulnerable.

Under the Hood of SKILL.md: Semantic Supply-chain Attacks on AI Agent Skill Registry #

arXiv

As AI agents extend capabilities through modular skill packages described by SKILL.md files, this paper demonstrates supply-chain attacks where malicious natural-language metadata in skill descriptions can manipulate which skills are admitted, surfaced, selected, and loaded by an agent. The attacks exploit the fact that skill registries rely on semantic matching – the agent reads and trusts the skill’s self-description – creating an attack surface analogous to dependency confusion in package managers but operating at the natural-language level. For anyone building or consuming agent skill ecosystems, this highlights that the SKILL.md/CLAUDE.md pattern, while powerful, needs integrity verification mechanisms that do not yet exist in most frameworks.

Funding & Business #

Vapi raises $50M Series B at $500M valuation after winning Amazon Ring #

Vapi / TechCrunch

Voice AI infrastructure startup Vapi raised a $50M Series B led by Peak XV Partners at a $500M valuation, after Amazon Ring selected it over 40 competitors to handle 100% of inbound customer calls. The company has processed over 1 billion calls, runs at 1-5 million calls daily, and claims “healthy” eight-figure ARR. The business model – low-latency voice infrastructure rather than an end-user product – emerged when the founders discovered that startups cared more about their voice pipeline than the AI therapist it originally powered. Vapi’s trajectory illustrates a pattern: the infrastructure layer beneath AI applications is generating faster revenue growth than the applications themselves.

Altman testifies in Musk v. OpenAI trial, denies nonprofit betrayal #

CNBC / NPR / Fortune / Axios

Sam Altman took the stand in the Musk v. OpenAI trial in Oakland, rejecting claims that OpenAI and Microsoft “stole a charity” and testifying that Musk never opposed the for-profit transition – “quite the opposite.” Under cross-examination, Altman defended the structural shift as the only viable path to raising capital for safe AGI development. The trial, now in its third week, could force structural changes to OpenAI’s governance; Musk is seeking Altman’s removal from leadership. Regardless of outcome, the testimony is establishing a public record of the internal negotiations that shaped OpenAI’s trajectory from nonprofit to capped-profit to the current for-profit conversion.

Anthropic warns investors against unauthorized secondary share platforms #

TechCrunch

Anthropic declared that stock sales through unauthorized platforms including Open Doors Partners, Unicorns Exchange, and Pachamama Capital are “void and will not be recognized on our books.” The company maintains strict transfer restrictions and prohibits SPVs from acquiring its stock. The warning reflects surging secondary-market demand for Anthropic shares and signals that the company is actively enforcing its cap table controls – a move that both protects existing investors and maintains Anthropic’s ability to choose its shareholder base as it approaches a potential future public offering.

Infrastructure #

NVIDIA and SAP embed OpenShell for secure enterprise AI agent execution #

SAP / NVIDIA Blog

SAP announced at Sapphire that it is embedding NVIDIA OpenShell – an open-source runtime for securely deploying autonomous AI agents – into SAP Business AI Platform as the security layer for all SAP AI agents, including custom agents built in Joule Studio. OpenShell provides isolated execution environments, policy enforcement at the filesystem and network layers, and infrastructure-level containment that guards against damage when agent logic fails. SAP engineers are codesigning OpenShell alongside NVIDIA and contributing back to the open-source project. For enterprise teams, this is notable because it makes agent sandboxing a platform primitive rather than an application-level concern, and the open-source approach means the containment model is auditable.

ExecuTorch: Practical labs for efficient edge AI on Arm CPUs and NPUs #

PyTorch Blog

PyTorch published a practical guide to running AI inference on constrained edge devices using ExecuTorch, covering deployment on Arm CPUs and NPUs through hands-on labs. ExecuTorch extends the PyTorch ecosystem to deliver local inference with hardware-specific optimizations for Arm’s compute and neural processing units. Combined with last week’s local-AI-as-norm discussion and the Needle project (below), this continues the signal that the edge inference toolchain is maturing from experimental to production-ready, with framework-level support rather than one-off implementations.

Open Source #

Needle: 26M parameter function-calling model runs at 6000 tok/s on consumer devices #

Cactus Compute / Hacker News

Cactus Compute open-sourced Needle, a 26M parameter model distilled from Gemini 3.1 Flash Lite using a novel “Simple Attention Network” architecture (cross-attention with gating, no MLPs). Pretrained on 200B tokens across 16 TPU v6e chips in 27 hours, then post-trained on 2B synthetic function-calling tokens in 45 minutes, Needle runs at 6000 tokens/second prefill and 1200 tokens/second decode on consumer hardware. The thesis: tool calling is fundamentally retrieval-and-assembly, not generation, and massive models are overkill for it. If validated in production, this suggests that the agentic stack could disaggregate – tiny specialist models handling tool routing on-device while frontier models handle reasoning in the cloud.

Other #

How open model ecosystems compound #

Interconnects (Nathan Lambert)

Lambert argues that approximately 80% of frontier model development costs stem from R&D rather than final training compute, and that open ecosystems reduce collective costs by sharing technical insights and avoiding duplicate research. Unlike open-source software where marginal distribution cost is near zero, open AI models require developers to bear most costs upfront – but the ecosystem compounds value through shared knowledge that reduces future iteration costs. The analysis provides an economic framework for why openness is not just ideologically motivated but financially rational for labs competing at scale, particularly for China’s open AI ecosystem where shared R&D has become a competitive strategy.

Threads to Watch #

Agent security research is outpacing deployment defenses. Five papers in a single day targeted the MCP tool-call layer (MCPShield), agent skill registries (SKILL.md attacks), CI/CD agentic workflows (Comment and Control), plus ExploitGym benchmarking AI agents as offensive tools and SkillSafetyBench evaluating safety under skill-facing attacks. This volume of concurrent security research on the same surfaces that Anthropic (MCP connectors for legal), SAP/NVIDIA (OpenShell), and LangChain (Delta Channels) are building on suggests the attack surface is being characterized faster than defenses are being deployed. The gap between “we shipped MCP integrations” and “we monitor MCP traffic for attacks” is where incidents will emerge.

Frontier labs are competing on vertical product, not just horizontal platform. Anthropic’s Claude For Legal with 12 practice-area plugins and 20+ MCP connectors is not an API – it is a vertical SaaS product targeting a $300B+ legal services market. Google’s Gemini Intelligence reframes Android itself as a vertical AI product for consumer workflows. Combined with yesterday’s DeployCo and Claude Platform on AWS, the pattern is clear: model capability is table stakes, and the differentiation is happening at the product and integration layers.

Chain-of-thought faithfulness research is converging on a concerning conclusion. Yesterday’s Hidden Error Awareness paper showed models internally know when reasoning is wrong but express high confidence. Today’s “Performative Reasoning Traces” paper shows the traces desynchronize from internal computation at identifiable steps. The formal CoT-vs-latent-thought comparison proves latent reasoning is strictly more expressive. Taken together, these results suggest that visible CoT is simultaneously the primary oversight mechanism for reasoning models and a provably imperfect one – a gap that probe-based monitoring and latent-space techniques will need to fill.

Sources Unavailable Today #

These sources could not be fetched today. Links point to their homepages so you can check them directly.

• Stanford HAI – scrape: content_truncated