AI Weekly Digest23–29 May 2026

Opus 4.8 launches May 28 with the following key changes over Opus 4.7: (1) 4x less likely to silently overlook defects in its own code. (2) Dynamic Workflows (research preview, Claude Code only): ask Claude to create a workflow and it orchestrates tens to hundreds of parallel subagents in the background, using existing test suites as success signals — target use case is codebase-scale migrations across hundreds of thousands of lines. (3) Mid-conversation system messages: you can now send role: "system" messages after a user turn in the messages array, preserving prompt cache compatibility. (4) stop_details now publicly documented on refusal responses — applications can route refusals to the correct next-step UX without parsing string heuristics. Opus 4.8 fast mode arrives at $10/$50 per MTok, 3x cheaper than previous Opus fast modes.

23,019 total vulnerabilities identified across 1,000+ open-source projects; 6,202 classified high or critical. Of 1,752 independently assessed by six security research firms, 90.6% (1,587) are confirmed true positives; 62.4% (1,094) confirmed high or critical severity. Anthropic projects roughly 3,900 confirmed high/critical issues in open source at current rates. Standout results: Cloudflare found 2,000 vulnerabilities (400 high/critical) with a false-positive rate better than human testers; Mozilla found 271 vulnerabilities in Firefox 150 — more than 10x the number found in Firefox 148 with Claude Opus 4.6. One banking partner used Mythos to detect and prevent a fraudulent $1.5M wire transfer. A critical wolfSSL flaw (CVE-2026-5194) was discovered in a library embedded in approximately 5 billion IoT and industrial devices. Anthropic is now partnering with the Open Source Security Foundation's Alpha-Omega project to help open-source maintainers process the patching backlog.

IT and security teams can now apply existing security and compliance tooling to Claude across the platform — covering policy enforcement, audit logging, and access controls. Integration guides available in Claude Docs under Claude Compliance API integrations.

Security-guidance plugin now available in the Claude Code plugin marketplace — install with /plugins. Detects approximately 25 high-risk vulnerability classes in real time including SQL injection, command injection, cross-site scripting, hardcoded API keys and secrets, insecure deserialisation, and improper input validation. When a risky pattern is detected, Claude prompts an inline fix in the same session. Internal data shows a 30–40% reduction in security-related PR comments since the tool was introduced. Enable the new /tui feedback toggle — Anthropic intends to make it default in Claude Code soon.

/usage now shows a per-category breakdown of what is driving your limits — skills, subagents, plugins, and per-MCP-server cost broken out separately. /diff detail view can now be scrolled with the keyboard (arrows, j/k, PgUp/PgDn, Space, Home/End). Markdown output now renders GFM task-list checkboxes (- [ ] / - [x]) as checkboxes. Enterprise setting added for Claude.ai cloud MCP connectors. Auto-mode classifier improved for detecting data exfiltration, particularly bulk transfers of repository contents. Security fix: rm -rf $HOME no longer bypassed when HOME has a trailing slash. Security fix: TMPDIR no longer resolves to different directories in sandboxed vs unsandboxed Bash commands within the same session. CLAUDE_CODE_SUBAGENT_MODEL now correctly applies to teammate processes spawned by Agent Teams.

Anthropic now leads US enterprise AI adoption: 34.4% share vs OpenAI at 32.3%, per third-party survey data. Claude Code is cited as the primary driver among engineering teams. Contributing factors: Claude Platform on AWS (GA May 11), PwC alliance (May 14), SpaceX compute deal (May 6).

Better handling of context switching within long conversations.

Improved reasoning stability during extended multi-step tasks.

Improved routing efficiency, reducing unnecessary model switching.

Improved ability to manage multi-stage projects involving research, drafting, and revision.

Improved source synthesis when analysing large volumes of information.

Improved project-level memory management and organisation.

More natural handling of interruptions and follow-up questions.

Expanded emphasis on team collaboration, shared workflows, and project-centric workspaces.

Production infrastructure successfully scaled following post-I/O traffic spike. Early developer benchmarks confirm 4x output token speed improvement. Standard API endpoint uptime at steady 99.9%.

gemini-3.1-flash-lite-preview permanently turned off May 25, 2026. All traffic must migrate to the GA model immediately.

Interactions API response schema migrated from outputs to steps. Breaking change — update all code that reads the outputs field. Required to support multi-stage agent workflows.

Rapid developer migration from Gemini CLI to Antigravity CLI underway. Legacy Gemini CLI workflows should be migrated now.

Promotional access for Match Writing Style and Match Doc Format in Google Docs expires June 1, 2026. Paid plan required after that date.

Project Genie sandbox access now rolling out to $200/mo AI Ultra subscribers. Interactive 3D environment construction from Google Street View data.

Live queries via MCP-based connectors at prompt time — instead of pre-indexed snapshots. Enabled by default in tenants. Partners: Canva, HubSpot, Linear, LSEG, Moody's, Notion, Google Calendar/Contacts. Admin staging available via Microsoft Entra ID groups.

Plan Mode: preview multi-step changes before they apply — guardrails for analysts before workbook edits. Python scripting: integrated runtime now live for advanced data manipulation in Excel.

Copilot call delegation workflow: answers calls, captures context, schedules follow-ups. AI usage policy updates recommended for enterprise deployments.

UI overhaul with chat-first workflows and liquid glass styling. Faster access to connectors and notebooks from mobile.

Purview DLP integration: blocked sensitive queries now redirect to M365 Copilot. Requires tuned DLP policies to take effect.

Opus 4.8 se lansira 28. maja sa sledećim ključnim promenama u odnosu na Opus 4.7: (1) 4x manja verovatnoća da tiho previdi nedostatke u sopstvenom kodu. (2) Dynamic Workflows (istraživački pregled, samo Claude Code): zatražite od Claudea da napravi workflow i on orkestrira desetine do stotine paralelnih subagenata u pozadini, koristeći postojeće test pakete kao signale uspeha — ciljna upotreba su migracije baze koda kroz stotine hiljada linija. (3) Sistemske poruke tokom razgovora: sada možete slati role: "system" poruke posle korisničkog okreta u nizu poruka, uz očuvanje kompatibilnosti keša. (4) stop_details je sada javno dokumentovan za odbijajuće odgovore — aplikacije mogu usmeravati odbijanja na odgovarajući sledeći korak bez parsiranja string heuristike. Opus 4.8 brzi režim dolazi po $10/$50 po MTok, 3x jeftinije od prethodnih Opus brzih režima.

Ukupno identifikovano 23.019 ranjivosti u više od 1.000 open-source projekata; 6.202 klasifikovano kao visoko ili kritično. Od 1.752 nezavisno procenjenih od strane šest bezbednosnih istraživačkih firmi, 90,6% (1.587) su potvrđeni pravi pozitivi; 62,4% (1.094) potvrđeno visoke ili kritične ozbiljnosti. Anthropic projektuje oko 3.900 potvrđenih visokih/kritičnih problema u open-source softveru pri trenutnim stopama. Istaknuti rezultati: Cloudflare je pronašao 2.000 ranjivosti (400 visokih/kritičnih) sa stopom lažnih pozitiva boljom od ljudskih testera; Mozilla je pronašla 271 ranjivost u Firefox 150 — više od 10x u poređenju s Firefox 148 uz Claude Opus 4.6. Jedan bankarski partner je koristio Mythos za otkrivanje i sprečavanje lažnog wire transfera od 1,5 miliona dolara. Kritična wolfSSL ranjivost (CVE-2026-5194) otkrivena je u biblioteci ugrađenoj u oko 5 milijardi IoT i industrijskih uređaja. Anthropic sada sarađuje sa Alpha-Omega projektom Open Source Security Foundation kako bi pomogao maintainerima open-source projekata u obradi zaostalih zakrpa.

IT i bezbednosni timovi sada mogu primeniti postojeće bezbednosne i usklađene alate na Claude na celoj platformi — pokrivajući primenu politika, revizorske zapise i kontrole pristupa. Uputstva za integraciju dostupna su u Claude Docs pod Claude Compliance API integracije.

Plugin za bezbednosno vođenje sada dostupan u Claude Code plugin marketplace-u — instalirajte sa /plugins. Detektuje oko 25 klasa ranjivosti visokog rizika u realnom vremenu uključujući SQL injection, command injection, cross-site scripting, hardkodovane API ključeve i tajne, nesigurnu deserijalizaciju i neodgovarajuću validaciju unosa. Kada se otkrije rizičan obrazac, Claude predlaže inline popravku u istoj sesiji. Interni podaci pokazuju smanjenje bezbednosnih PR komentara za 30–40% od uvođenja alata. Omogućite novi /tui feedback prekidač — Anthropic namerava da ga uskoro postavi kao podrazumevano u Claude Code-u.

/usage sada prikazuje raščlanjivanje po kategorijama onoga što pokreće vaša ograničenja — skills, subagenti, plugins i trošak po MCP serveru prikazani odvojeno. /diff detaljan prikaz sada se može skrolovati tastaturom (strelice, j/k, PgUp/PgDn, Space, Home/End). Markdown izlaz sada renderuje GFM task-list checkbox-ove (- [ ] / - [x]) kao checkbox-ove. Dodato enterprise podešavanje za Claude.ai cloud MCP konektore. Poboljšan auto-mode klasifikator za otkrivanje eksfiltracije podataka, posebno masovnih prenosa sadržaja repozitorijuma. Bezbednosna popravka: rm -rf $HOME više ne zaobilazi ako HOME ima trailing slash. Bezbednosna popravka: TMPDIR se više ne razrešava na različite direktorijume u sandbox i non-sandbox Bash komandama u okviru iste sesije. CLAUDE_CODE_SUBAGENT_MODEL sada ispravno primenjuje na teammate procese koje pokreće Agent Teams.

Anthropic sada vodi u korporativnoj primeni AI u SAD: udeo od 34,4% naspram OpenAI-ja sa 32,3%, prema podacima istraživanja trećih lica. Claude Code se navodi kao primarni pokretač među inženjerskim timovima. Faktori koji su doprineli: Claude Platform na AWS-u (GA 11. maja), PwC savez (14. maja), SpaceX računarski ugovor (6. maja).

Bolje rukovanje prelaskom konteksta u dugim razgovorima.

Poboljšana stabilnost zaključivanja tokom dugih višefaznih zadataka.

Poboljšana efikasnost rutiranja, smanjujući nepotrebno prebacivanje modela.

Poboljšana sposobnost upravljanja višefaznim projektima koji uključuju istraživanje, izradu nacrta i reviziju.

Poboljšena sinteza izvora pri analizi velikih količina informacija.

Poboljšano upravljanje memorijom na nivou projekta i organizacija.

Prirodnije rukovanje prekidima i pratećim pitanjima.

Prošireni naglasak na timsku saradnju, zajedničke tokove rada i projektno orijentisane radne prostore.

Produkcijska infrastruktura uspešno skalirana posle naglih porasta saobraćaja sa I/O konferencije. Rani benchmark-ovi programera potvrđuju 4x ubrzanje generisanja izlaznih tokena. Uptime standardnog API endpoint-a stabilno na 99,9%.

gemini-3.1-flash-lite-preview trajno ugašen 25. maja 2026. Sav saobraćaj mora odmah migrirati na GA model.

Šema odgovora Interactions API-ja migrirana sa outputs na steps. Breaking change — ažurirajte sav kod koji čita polje outputs. Neophodno za podršku višefaznih agentnih tokova rada.

Brza migracija programera sa Gemini CLI na Antigravity CLI u toku. Nasleđeni Gemini CLI tokovi rada treba odmah migrirati.

Promotivni pristup za Match Writing Style i Match Doc Format u Google Docs-u ističe 1. juna 2026. Nakon tog datuma potreban je plaćeni plan.

Pristup Project Genie sandbox okruženju sada se uvodi pretplatnicima AI Ultra paketa od $200/mes. Izgradnja interaktivnih 3D okruženja iz Google Street View podataka.

Živi upiti putem MCP-zasnovanih konektora u trenutku upita — umesto prethodno indeksiranih snimaka. Podrazumevano omogućeno u zakupcima. Partneri: Canva, HubSpot, Linear, LSEG, Moody's, Notion, Google Calendar/Contacts. Administratorsko postupno uvođenje dostupno putem Microsoft Entra ID grupa.

Plan Mode: pregled višestepenih promena pre primene — zaštitne mere za analitičare pre izmena radne sveske. Python skriptovanje: integrisano runtime okruženje sada aktivo za naprednu manipulaciju podacima u Excel-u.

Tok rada delegiranja Copilot poziva: odgovara na pozive, prikuplja kontekst, zakazuje nastavke. Preporučuju se ažuriranja politike korišćenja AI za korporativna uvođenja.

Obnova korisničkog interfejsa sa tokovima rada koji stavljaju chat u centar i liquid glass stilom. Brži pristup konektorima i sveskama sa mobilnog uređaja.

Integracija Purview DLP: blokirani osetljivi upiti se sada preusmeravaju na M365 Copilot. Zahteva podešene DLP politike da bi stupilo na snagu.