Issue 27

4 July 2026

Hi there,

Microsoft announced an enterprise AI engineering business. Anthropic restored access to two models, and GitHub introduced new controls for both tracking work and observing Copilot agent sessions.

Industry

1. Microsoft forms a Frontier Company deployment business

In its 2 July announcement, Microsoft describes a new operating business for enterprise AI engineering and change management. TechCrunch reports a $2.5 billion investment and 6,000 industry and engineering specialists. Microsoft calls its model broader than conventional forward-deployed engineering; its commercial terms will matter as much as its headcount.

Artificial Intelligence

2. Anthropic restores access to Fable and Mythos

Anthropic’s 30 June post says the export controls on Fable 5 and Mythos 5 were lifted. Fable access was set to return globally on 1 July; Mythos access was restored to a limited set of US organisations following government approval on 26 June. Neither statement implies unrestricted Mythos access.

Microsoft

3. Microsoft’s June security roundup arrives on 30 June

The dated primary-source roundup describes Codename MDASH, a multi-model vulnerability scanning system, among other Defender, Entra and Purview updates. Microsoft’s examples describe a product announcement, not independently verified detection efficacy.

4. Partner certifications shift towards AI-era criteria

In the Microsoft Partner Center June announcements, the 30 June entry describes several retiring specialisation certifications and replacement AI-focused criteria, including AI-103 replacing AI-102. Verify designation-specific transition dates before planning a renewal.

Development

5. GitHub issue fields are generally available

GitHub’s 2 July changelog makes typed issue metadata available to organisations across supported plans and says the fields can be read or written through the GitHub MCP server. That makes work tracking more queryable, but also makes the agent’s write permissions worth reviewing before it fills in fields on its own.

6. GitHub previews streaming Copilot agent sessions

For eligible GitHub Enterprise Cloud customers, the 2 July public preview exposes session data including prompts, responses and tool calls by stream or API across Copilot clients. This is a visibility feature, not proof that all users’ sessions are logged by default: administrators must enable it, and prompt data deserves a retention and privacy decision.

7. GitHub adds a cap on included AI credits per cost centre

A 2 July changelog describes pools for included Copilot AI credits, separately from a budget for metered usage after the shared pool is exhausted. At publication, configuration was via REST API; GitHub said UI management would follow. That distinction matters to enterprise chargeback and to teams assuming an included pool is unlimited.

Information Security

8. SharePoint RCE enters the known-exploited conversation

A 2 July report identifies CVE-2026-45659 as a SharePoint Server flaw exploitable by an authenticated Site Member without user interaction and says CISA listed active exploitation. Check Microsoft’s advisory and CISA’s catalogue for affected versions and the exact remediation deadline.

Coming up

July (estimated): npm v12 is expected to introduce more restrictive dependency defaults; check the actual release before changing CI.

Until next week, Julian

How this is made

Throughout the week I stumble across a mildly unreasonable number of interesting things, and I forward them instantly to the friend or colleague I think might care – sometimes to their delight, sometimes to their annoyance, and often with no context at all. Heartbeat is the attempt to do that a little better.

Every Friday a small agent I built, Honoka, looks through the places where those links tend to leak out: my private email, work email, Matrix, Mastodon, WhatsApp, Apple Messages, Signal, and the faint imprints on the platen of my Olympia typewriter (still not an API, tragically). It sorts, filters, groups and summarises the week, then hands me a draft.

Honoka is guided by a private corpus of things I have written over the last fifteen years, so it can get closer to how I sound in more-or-less official emails and public notes. I still take a pass by hand: remove things, change sentences, check links, argue with the judgement. Whether that is enough is, frankly, the experiment. Every issue has one item written entirely by hand. If you can reliably spot it, hit reply and judge.