Agent control, security, and model releases #73

July 10, 2026 — 3 min read

Today's Letter

AWS announced Claude Apps Gateway for AWS on July 8, 2026 as a self-hosted control plane for Claude Code and Claude Desktop.
It centralizes access control, policy enforcement, and spend management so teams do not need separate cloud credentials or manual settings on each developer machine.
The gateway is delivered inside the existing Claude Code CLI binary and runs as a stateless container with PostgreSQL for short-lived sign-in state and rate-limit counters.
It supports standards-compliant OpenID Connect identity providers, browser SSO, and short-lived tokens; removing a user from the IdP causes the session to expire within the configured token lifetime, one hour by default.
Admins can define managed settings by group, including allowed models, tool permissions, and default configuration applied automatically at sign-in.
Usage telemetry is exported through OTLP to destinations such as Amazon CloudWatch, Amazon Managed Service for Prometheus, or third-party platforms.
The gateway can route requests to Amazon Bedrock or Claude Platform on AWS, with optional failover across AWS Regions or multiple accounts.
Daily, weekly, and monthly spend caps can be enforced at the organization, group, or user level, blocking requests until limits reset or are raised.
Configuration is loaded from a single YAML file at startup, with secrets kept in environment variables and Bedrock deployments using the container IAM role instead of static credentials.

Source: aws.amazon.com

Tencent released the full Hy3 open-weight model under Apache 2.0, reversing the regional license limits attached to the April preview.
Hy3 uses a 295B-parameter MoE architecture with 21B active parameters, top-8 routing across 192 experts, and a 256K context window.
Tencent said the full release incorporated feedback from more than 50 internal product teams after the late-April preview.
In Tencent's blind human test, Hy3 scored 2.67 out of 4 versus GLM-5.1 at 2.51 across 312 valid comparisons.
Tencent's own benchmark appendix still showed GLM-5.2 ahead on coding tasks including SWE-bench Verified, SWE-bench Multilingual, and Terminal-Bench 2.1.
Tencent highlighted lower error rates versus the preview, with hallucination rate reduced from 12.5% to 5.4% and commonsense errors from 25.4% to 12.7%.
Cross-checking is limited, and the core performance and reliability figures are based on Tencent disclosures and a single trusted media report.

GitHub made innersource security advisories generally available for GitHub Advanced Security enterprise customers on July 8, 2026.
The feature lets enterprises publish internal security advisories with visibility limited to repositories owned by the same enterprise.
GitHub added a REST API endpoint for innersource vulnerabilities, including create, update, and withdraw operations.
After an advisory is created for a component, Dependabot can identify repositories inside the enterprise that use that component.
Notifications can include security alerts and version update guidance for affected internal repositories.
When a fixed version is available, Dependabot can open a pull request to upgrade vulnerable component versions.
The release extends GitHub's existing advisory workflow to private inner-source dependency management and supply chain response.

Source: github.blog

Cloudflare said ML-DSA will be the first signature scheme used in its post-quantum migration.
The company said RSA and ECC remain vulnerable to sufficiently advanced quantum computers.
ML-KEM already protects most traffic handled by Cloudflare against harvest-now-decrypt-later risk.
Cloudflare is targeting 2029 to become fully post-quantum secure across encryption and signatures.
ML-DSA was standardized by NIST in 2024 after an eight-year open international competition.
Cloudflare said ML-DSA is larger on the wire and cannot reuse many techniques used with RSA and ECC.
NIST moved nine post-quantum signature candidates into round 3, and a draft FN-DSA standard is expected soon.
Cloudflare said newer schemes will not be ready in time, so ML-DSA is the practical option for the first transition.

Source: blog.cloudflare.com

Jocoletter curates AI, software, and product trends for developers and builders.

#AWS #Cloudflare #GitHub #Tencent