📰 The Weekly Dose
Welcome back to the Weekly Dose: your 5-minute breakdown of the AI/ML news that matters when you’re building, evaluating, deploying, or operating AI systems.
This edition covers 25 July to 2 August 2026 only. No stale benchmark victory laps. No “this might be big someday” filler. Just the top five stories that changed how AI engineers, ML engineers, data scientists, and technical teams should think this week.
This week: Moonshot published the full weights behind its 2.8-trillion-parameter model, MCP rewrote its deployment assumptions around stateless infrastructure, Microsoft showed how specialised models can improve agent economics, Europe turned AI transparency into a production requirement, and GitHub and AWS reminded teams that managed AI services have expiry dates.
👍 If you enjoy this post, consider giving it a like. It’s free, takes just a second, and helps me understand which topics you’d like to see more of in future issues. Thanks 💛
Before continuing, don’t forget to check our latest issues:
The companion 💎Jupyter Notebook💎 with all the code plus additional analysis and visualisations will be sent to all paid subscribers tomorrow Monday! Not available afterwards!
Let’s begin!
1. Kimi K3 made “open weight” a data-centre problem
On 27 July, Moonshot AI completed the Kimi K3 rollout by publishing its full model weights and technical report. K3 is a natively multimodal mixture-of-experts model with 2.8 trillion total parameters, 104 billion activated per token, 896 experts and a one-million-token context window. Only 16 experts are selected for each token, and both the code and weights are available under the custom Kimi K3 Licence.
The operational requirements matter as much as the headline size. Moonshot uses MXFP4 weights and MXFP8 activations, provides deployment support through Transformers and vLLM, and recommends supernode configurations with 64 or more accelerators. Its API costs $0.30 per million cache-hit input tokens, $3 for uncached input and $15 for output, but its benchmark comparisons remain partly vendor-run and depend heavily on the agent harness used. Open weights provide control; they do not make a model this large cheap or local.
🫵 Why it matters to you: Kimi K3 gives teams another serious option for private deployment, post-training and provider-independent inference, but only if they have access to data-centre-scale infrastructure.
🤫 The subtext nobody says out loud: Open-weight models do not need to run on a laptop to pressure proprietary providers. They only need to be deployable by clouds, inference companies and large enterprises that can turn them into cheaper managed endpoints.
🛠️ Practical takeaway: Compare Kimi K3’s hosted API with self-hosting through your actual throughput, latency and privacy requirements. Review the custom licence and hardware footprint before treating “open” as synonymous with portable.
2. MCP went stateless—even if your application did not
On 28 July, the official MCP Go SDK shipped full support for protocol version 2026-07-28, putting the protocol’s largest rewrite since launch into a production implementation. The new wire protocol removes the initialize handshake and Mcp-Session-Id, sends client information through per-request metadata and introduces server/discover for capability negotiation. Any request can now reach any server instance rather than being pinned to the one that created its session.
That change allows remote MCP servers to run behind ordinary round-robin load balancers without sticky routing or shared protocol-session stores. The revision also standardises routing and tracing headers, adds cache controls for tool and resource lists, formalises MCP Apps and Tasks as extensions, and deprecates Roots, Sampling and Logging while preserving them during the transition. Official SDKs can negotiate down to earlier protocol versions, but implementations that assumed persistent sessions or matched old error codes still require testing.
🫵 Why it matters to you: MCP servers can now scale more like conventional HTTP services, but the removal of implicit session state changes how long-running tools, retries, approvals and application state must be designed.
🤫 The subtext nobody says out loud: MCP has moved beyond its “USB-C for AI” phase. It is now a real infrastructure standard—with version negotiation, breaking changes, extensions, deprecations and migration work.
🛠️ Practical takeaway: Test clients and servers against both the 2025-11-25 and 2026-07-28 protocols. Audit any dependency on session IDs, the old handshake, server-initiated calls or hard-coded MCP error values.
3. Microsoft made model routing part of the security architecture
On 27 July, Microsoft announced Project Perception, an agentic security system coordinating red-team agents that identify attack paths, blue-team agents that investigate and prioritise risk, and green-team agents that apply corrective actions. Rather than relying on one frontier model, Perception selects between frontier and specialised cyber models according to task quality, reliability, latency and cost, grounding them in shared context across identities, endpoints, applications, data and cloud systems.
Its first specialist model is MAI-Cyber-1-Flash, used inside Microsoft’s MDASH vulnerability-management agent team. Microsoft reports that the configuration scores 96% on CyberGym (12 points above Mythos) while reducing costs by almost 50% compared with its current MDASH setup. Those figures are vendor-reported and need independent validation; Project Perception enters public preview on 3 August.
🫵 Why it matters to you: The most economical agent architecture may combine small specialist models for frequent tasks with frontier models reserved for ambiguous or high-risk cases.
🤫 The subtext nobody says out loud: The moat may be less about training the smartest individual model and more about owning the telemetry, security context, evaluation harness and router that decide which model acts.
🛠️ Practical takeaway: Benchmark specialist-plus-frontier routing against a frontier-only baseline using successful remediations, false positives, latency and total cost. Keep automated corrective actions behind deterministic permissions and reversible controls.
4. AI transparency became a production requirement in Europe
From 2 August, Article 50 of the EU AI Act applies to providers and deployers of certain AI systems. Providers must inform people when they are directly interacting with AI (unless that is already obvious) and add effective, robust and interoperable machine-readable marks to generated or manipulated content. Deployers must also disclose emotion-recognition and biometric-categorisation systems, deepfakes, and AI-generated public-interest text published without meaningful human review or editorial control.
The grace period is narrow. Systems placed on the market before 2 August have until 2 December 2026 only for the machine-readable marking and detection requirement; the other Article 50 duties apply immediately, and previously generated content does not require retroactive labelling. National authorities can impose penalties of up to €15 million or 3% of worldwide annual turnover.
🫵 Why it matters to you: Compliance now reaches product interfaces, output schemas, metadata pipelines, media-processing workflows and audit logs, not only policies written by legal teams.
🤫 The subtext nobody says out loud: Content provenance is becoming part of the technical contract of an AI system. A label added at the final interface is not enough when metadata disappears during resizing, transcoding, exporting or downstream processing.
🛠️ Practical takeaway: Map where your organisation acts as an AI provider or deployer, then test disclosures and machine-readable markings throughout the full output lifecycle. Document any exemptions or grace-period assumptions rather than leaving them implicit.
5. The first generation of managed AI services started disappearing
On 30 July, GitHub Models was fully retired for all customers. Its playground, model catalogue, inference API, user interface and bring-your-own-key endpoints were removed, including for organisations with active usage. GitHub now directs model-access workloads towards Microsoft Foundry and AI-powered development workflows towards Copilot.
The same day, AWS stopped accepting new customers for several earlier AI services, including Amazon Bedrock Agents—now renamed Bedrock Agents Classic—Amazon Kendra and Amazon Q Business. Existing customers can continue using the products with AWS support, but AWS recommends moving agent workloads from Agents Classic to Bedrock AgentCore. This is maintenance mode rather than immediate shutdown, but it still changes which architecture new projects can adopt.
🫵 Why it matters to you: Managed model gateways, retrieval systems and agent runtimes are product dependencies with their own lifecycle risk, even when the models behind them remain available.
🤫 The subtext nobody says out loud: Vendors do not only compete by launching new AI layers. They can also consolidate workloads by retiring the older layer and directing customers towards the platform they want to become standard.
🛠️ Practical takeaway: Inventory the managed AI endpoints embedded in applications, notebooks and CI pipelines. Keep prompts, evaluations, tool schemas and routing logic exportable so a service retirement does not become an application rewrite.
💡 Our take
This week’s stories appear to pull in opposite directions.
Kimi K3 gives builders more control through downloadable weights. MCP makes agent integrations easier to scale across ordinary infrastructure. Microsoft packages multiple models and specialised agents into one security system. Europe requires more transparency about what AI systems generate and how they interact with users. Meanwhile, GitHub and AWS demonstrate how quickly managed abstractions can be retired or redirected.
The common pattern is this:
AI systems are becoming easier to connect, but harder to own.
The key signals from this week:
Open weights are not the same as accessible infrastructure. Kimi K3 is downloadable, but Moonshot recommends clusters with at least 64 accelerators for deployment.
Standards create migration work once they become successful. MCP’s stateless redesign simplifies horizontal scaling but removes assumptions on which existing implementations may depend.
Model routing is becoming a core systems capability. Microsoft’s security architecture explicitly selects models according to quality, latency, reliability and cost rather than defaulting every task to the frontier tier.
Provenance is moving into the production data model. Europe now expects disclosures and machine-readable markings to survive real deployment workflows.
Managed AI primitives have product-lifecycle risk. GitHub removed its complete Models service, while AWS placed several first-generation AI services into maintenance for new customers.
The architectural question is no longer:
Which model should we use?
The better questions are:
Which parts of the system do we genuinely own?
Can we move the prompts, evaluations, state and tool definitions elsewhere?
Does the protocol expose application state clearly enough to recover and retry?
Will provenance survive every transformation of the output?
What happens when the managed service beneath the workflow is retired?
📌 Your to-do list
Benchmark Kimi K3 as an operating decision. Compare its hosted API, third-party inference and self-hosting costs, including accelerator memory, interconnect, throughput and licence constraints.
Run an MCP migration test. Verify protocol negotiation, explicit application-state handling, multi-round-trip requests, tracing and compatibility with existing clients and servers.
Evaluate task-level model routing. Identify repetitive workloads where a specialist or cheaper model can handle most cases with a frontier fallback for difficult exceptions.
Audit Article 50 implementation. Review user disclosures, synthetic-content marking, deepfake labelling, output metadata retention and evidence of meaningful human editorial review.
Create an exit plan for every managed AI dependency. Record its owner, replacement service, data-export path, adapter boundary and maximum acceptable migration time.
See you next week.