Week 31

Enterprise AI Weekly: July 27 – August 1, 2026

By Attila · Aug 1, 2026 · 17 min read

Last updated: Aug 15, 2026

Four very different kinds of deadline landed this week. A protocol most IT teams have never configured but increasingly depend on published a breaking rewrite. Microsoft put audited numbers behind eighteen months of Copilot messaging. CISA added three actively exploited network-edge vulnerabilities in five days, one of them a password shipped inside the product. And the EU’s amended AI Act entered into force on Monday, moving the deadline everyone prepared for while leaving the one most organizations ignored exactly where it was. Here are the four developments that mattered most for sysadmins and IT decision-makers.

1. The Model Context Protocol Goes Stateless — and Hardens Its Authorization Model

What happened: On July 28 the Model Context Protocol project published its 2026-07-28 specification, the largest revision since MCP began. The headline change is architectural: MCP moves from a bidirectional stateful protocol to a request/response stateless one. The initialize/initialized handshake is gone, and so is the Mcp-Session-Id header on the Streamable HTTP transport. Each request now describes itself, carrying the protocol version, client identity, and capabilities in _meta. Servers that genuinely need state across calls are expected to mint an explicit handle from a tool and have the model pass it back as an ordinary argument, rather than hiding state in the transport layer. Two related changes serve the same goal: requests must now carry Mcp-Method and Mcp-Name HTTP headers so gateways, rate limiters, and proxies can route and meter traffic without parsing JSON bodies, and tools/list, prompts/list, resources/list, and resources/read now return ttlMs and cacheScope fields so clients can cache them. Multi Round-Trip Requests replace server-initiated requests that used to require a held-open stream: the server returns resultType: "input_required", and the client retries the original call with the answers in inputResponses.

The authorization work is the half that matters most to anyone running this in an enterprise. RFC 9207 issuer validation is now required, so clients must validate the iss parameter before redeeming an authorization code; credentials are bound to the issuing authorization server and cannot be reused across servers; and an application_type parameter resolves the localhost-redirect problems that desktop and CLI clients hit. Dynamic Client Registration is formally deprecated in favor of Client ID Metadata Documents, though it keeps working for now — the spec also introduced a formal deprecation policy with a twelve-month minimum window, currently covering Roots, Sampling, Logging, and the legacy HTTP+SSE transport. Tasks graduated out of the experimental core into a governed io.modelcontextprotocol/tasks extension. All four Tier 1 SDKs — TypeScript, Python, Go, and C# — support the spec, with Rust in beta. Anthropic said the same day that it is bringing the spec to Claude alongside MCP Apps, enterprise-managed authentication for provisioning connectors organization-wide, observability dashboards for published connectors, and a research preview of MCP tunnels for reaching servers on private networks, noting that MCP has passed 400 million monthly SDK downloads — a fourfold increase this year.

Why it matters to sysadmins and IT decision-makers: This is the week MCP started behaving like infrastructure rather than a developer convenience, and the changes are aimed squarely at the people who have to operate it. A remote MCP server that previously needed sticky sessions, a shared session store, and a gateway willing to inspect request bodies can now sit behind a plain round-robin load balancer, be routed on an HTTP header, and be scaled or restarted without dropping client state. If your organization is running internal MCP servers — and the download numbers suggest more teams are than have told you — this removes most of the awkward reasons they were exempted from your normal load-balancing, autoscaling, and observability patterns. The trade is a real migration: anything that depended on session identifiers has to move to explicit handles, and the twelve-month deprecation window on Roots, Sampling, Logging, and the legacy HTTP+SSE transport is a planning input worth putting on a roadmap now rather than discovering when a client stops connecting.

The authorization changes deserve attention from whoever owns identity. Binding credentials to the issuing authorization server and mandating issuer validation closes token-reuse and mix-up paths that are exactly the sort of thing that gets ugly when an agent holds credentials to several systems at once, and the shift from Dynamic Client Registration to Client ID Metadata Documents changes how clients get registered in the first place — worth checking against whatever your identity provider expects. The genuinely useful administrative feature here is enterprise-managed authentication for connectors: the ability to provision MCP connectors centrally for an organization is the difference between governed integrations and every team wiring up its own. That is the same discipline this newsletter keeps arriving at from different directions — inventory what is already connected, give each connector an owner, and put its credentials on the same review cycle as everything else. A stateless, header-routable protocol makes that easier than it was last week; it does not do it for you.

2. Microsoft’s Q4 Puts Numbers Behind the Copilot Pitch

What happened: Microsoft reported its fiscal fourth quarter on July 29, and for once the AI story came with audited figures instead of adjectives. Revenue was $90.0 billion, up 18% (17% in constant currency); Microsoft Cloud revenue was $59.3 billion, up 27%; operating income was $40.6 billion, up 18%; and net income was $35.8 billion, up 31% on a GAAP basis. Azure and other cloud services revenue grew 43%, and Azure revenue passed $100 billion for the first time across the fiscal year. The number aimed at IT buyers was Microsoft 365 Copilot reaching over 30 million paid seats. CFO Amy Hood also said the company is encouraged by take-up of the Microsoft 365 E7 license, with millions of seats sold — E7 being the $99-per-user-per-month “frontier suite” that went on sale May 1 and bundles Microsoft 365 E5, Microsoft 365 Copilot, Agent 365, and the Entra Suite, components that price out at roughly $124 per user per month bought separately.

Two details underneath the headline numbers are worth holding onto. Capital expenditure including finance leases hit $41 billion in the quarter, up 69% year over year, with roughly two-thirds of it going to short-lived assets like CPUs and GPUs; Hood said Microsoft is extending the assumed useful life of its office and data center buildings from 15 years to 25, and that more future data center capacity will show up as operating leases rather than finance leases. On the product side, Satya Nadella used the call to confirm the consolidation Microsoft has been trailing all summer, describing Copilot as evolving “from chat to Cowork to Autopilots” and saying the company is bringing those pieces together — including code — into a single app for both consumer and business customers, sometime this year. As the Office 365 for IT Pros team pointed out in its own read of the results, 30 million paid Copilot seats is a real number that still represents well under a tenth of Microsoft’s total Microsoft 365 paid seat base.

Why it matters to sysadmins and IT decision-makers: The seat figure is the one to reason from, in both directions. Thirty million paid seats means Copilot is no longer a pilot you can defer discussing — your peers are deploying it, and Microsoft now has the revenue to keep pushing. But the same figure means the overwhelming majority of Microsoft 365 users still do not have a paid Copilot seat after three years of promotion, which is useful context the next time a renewal conversation implies you are the last holdout. The more actionable item is E7. A bundle that folds Copilot, Agent 365, and the Entra Suite into your E5 baseline at a headline discount is genuinely attractive if you were going to buy all four, and an expensive way to acquire three products you had not budgeted for if you were not. Price it against your actual deployment plan rather than the list-price comparison, and check what the agent and security components consume beyond the seat price — capacity-metered services inside a per-seat bundle are where these deals stop being simple.

The capex and accounting details are not trivia; they are the pressure behind everything else you are being sold. A 69% jump in quarterly capital spending, two-thirds of it on hardware that depreciates fast, is the arithmetic driving the whole industry’s hunt for cheaper inference — the same pressure that has shown up in this newsletter for weeks as vendors quietly change which model answers your prompts. Extending building life from 15 to 25 years and shifting leases off the balance sheet are legitimate accounting choices, but they also flatter the reported cost of the AI build-out, so read “AI is profitable” claims with that in mind. For planning purposes, the practical read is that per-seat AI pricing is unlikely to fall much while this spending continues, consumption meters will keep appearing alongside seats, and the coming single Copilot app means the thing you are licensing, governing, and supporting is about to change shape again. Ask your account team what the merge does to your existing seats, admin controls, and data boundaries before it lands, not after.

3. Three Actively Exploited Network-Edge Flaws in Five Days

What happened: CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog between Monday and Wednesday, and all three were in the network infrastructure that sits at the perimeter. On July 27 it added CVE-2026-16812, a maximum-severity (CVSS 10.0) operating-system command-injection flaw in Arista’s VeloCloud Orchestrator On-Prem that lets an unauthenticated attacker reach privileged internal functionality and execute arbitrary code on the orchestrator host. Arista acknowledged the flaw was externally discovered and known to be actively exploited; affected builds are VCO 5.2.x before 5.2.3.14, 6.1.x before 6.1.3.4, 6.4.x before 6.4.2.4, and 7.0.x before 7.0.0.1, and researchers published three attacker IP addresses (8.19.75.217, 206.72.242.124, 206.72.242.162). Federal agencies were given until July 30 — a three-day clock.

The same July 27 batch added CVE-2025-68686 in Fortinet FortiOS SSL-VPN. At CVSS 5.3 it looks minor, and in isolation it is: it lets a remote attacker bypass a patch that was meant to stop malicious symbolic links from persisting, but only after they have already obtained filesystem-level access through a separate vulnerability. Fortinet fixed it back in February 2026; the federal deadline is August 10. Then on July 29 CISA added CVE-2026-20316 in Cisco Secure Firewall Management Center — a use-of-hard-coded-password flaw (CWE-259) rated CVSS 8.9 that lets an unauthenticated remote attacker log into the FMC web interface using a built-in static account that ships with the product. The account is low-privilege, but it exposes configuration data, security policies, and event logs, and Cisco rated the security impact High specifically because that foothold can be chained with other FMC flaws to escalate. Affected trains run from 7.0.0 through 10.0.1; Cisco confirmed exploitation in the wild and published hot fixes for each affected branch through its Software Center. The federal remediation deadline was August 1.

Why it matters to sysadmins and IT decision-makers: This is the second consecutive week that a firewall’s own management plane has turned up on the KEV catalog under a different vendor’s name, and the pattern is now the story. SD-WAN orchestrators, VPN concentrators, and firewall managers are the systems that define what everything else is allowed to do, they are frequently reachable from networks they should not be, and they are patched on the slow cadence reserved for things nobody wants to reboot. The Cisco entry is the one to act on first, because a hard-coded password is a category of flaw your controls cannot compensate for: there is no password policy, rotation schedule, or complexity rule that helps when the credential ships inside the software. Apply the hot fix, and treat any exposure window as an information-disclosure incident rather than a patching task — assume policies, configuration, and event logs were readable and review them accordingly.

The other two carry lessons worth generalizing. VeloCloud shows how little time you now get: added Monday, federal deadline Thursday, with a CVSS 10.0 unauthenticated path to code execution on the box that orchestrates your WAN. If your change process cannot move an emergency patch to an internet-reachable orchestrator inside a week, that gap is the finding, not the CVE. The FortiOS entry is the subtler one and the easiest to wave away at CVSS 5.3 — it is a persistence mechanism, not an entry point, which means its presence in your environment implies someone already got in another way. Patching it is necessary but insufficient: on any FortiOS appliance that went unpatched since February, hunt for unexpected symbolic links and treat the device as suspect rather than assuming the update settled it. Low-severity flaws that exist to help an attacker stay are exactly the ones that get deprioritized by CVSS-driven patch queues, and exactly the ones that turn a contained incident into a resident one.

4. The EU’s AI Omnibus Takes Effect — and August 2 Still Arrives

What happened: The Digital Omnibus on AI, which amends the EU AI Act (Regulation 2024/1689), was published in the Official Journal on July 24 and entered into force on Monday, July 27. Its most-reported effect is a delay: stand-alone high-risk systems under Annex III — the category covering AI used in employment, education, credit assessment, law enforcement, and critical infrastructure — move from August 2, 2026 to December 2, 2027, and high-risk AI embedded in products regulated under Annex I sectoral safety legislation moves to August 2, 2028. That is a substantial reprieve for anyone who had been building a high-risk conformity programme against a deadline now sixteen months further out.

What the Omnibus did not move is the part that applies to far more organizations. The Article 50 transparency obligations still take effect on August 2, 2026, and they apply to in-scope systems regardless of when they were first placed on the market. In practice that means: telling people they are interacting with an AI system unless it would be obvious to a reasonably well-informed, observant, and circumspect person; marking artificially generated or manipulated audio, image, video, and text in a machine-readable, detectable format to the extent technically feasible; informing individuals exposed to emotion-recognition or biometric-categorization systems; disclosing deepfaked image, audio, or video content, with a carve-out for artistic and creative work; and disclosing AI-generated or manipulated text published to inform the public on matters of public interest, unless the content underwent human review and a person or entity holds editorial responsibility for it. The machine-readable marking requirement comes with one concession: systems already on the market before August 2 have until December 2, 2026 to comply, while anything launched on or after August 2 must comply immediately. The Omnibus also added new prohibited practices covering AI systems that generate non-consensual intimate imagery or child sexual abuse material, applying from December 2, 2026. Penalties for Article 50 breaches run to €15 million or 3% of total worldwide annual turnover, whichever is higher — and the Act reaches providers placing systems on the EU market regardless of where they are established, and providers and deployers outside the EU whose system output is used in the Union.

Why it matters to sysadmins and IT decision-makers: The risk this week is a specific and predictable misreading: “the EU delayed the AI Act” is what most people took from the Omnibus headlines, and it is wrong in the way that costs money. The high-risk regime was delayed. The transparency regime was not, it lands tomorrow, and it applies to the mundane deployments almost every organization now has rather than the exotic ones most compliance programmes were scoped around. If you run a customer-facing chatbot on an EU-facing site, publish AI-assisted content, generate synthetic images or audio for marketing, or operate anything that classifies people biometrically, you are in scope — and the extraterritorial reach means a US or UK organization serving EU users does not get to sit this out.

The practical work is smaller than a compliance programme but larger than nothing, and it is mostly discovery. Find where AI-generated output is reaching people in the EU — support bots, website assistants, generated marketing assets, automated content — and confirm each has the disclosure it now needs. Check that your generative tooling actually emits machine-readable provenance markings rather than assuming the vendor handles it, because “to the extent technically feasible” is a question you should be putting to suppliers in writing, and the December 2 grace period applies only to systems already on the market. Where AI-assisted text is published on matters of public interest, the editorial-responsibility exemption is available but conditional: it requires genuine human review and a named owner, which is worth documenting now rather than reconstructing later. And take the sixteen-month high-risk reprieve as scheduling relief, not cancellation — December 2027 is a comfortable runway only for organizations that keep working, and the AI inventory you build for transparency compliance this week is the same inventory the high-risk assessment will need.

The Week in Summary

The through-line this week is that enterprise AI’s plumbing, economics, and rules all moved at once, and each moved toward being someone’s operational responsibility. MCP dropped sessions for a stateless core, which turns AI tool connections into something your existing load balancers, gateways, and identity controls can actually handle — and hands you a migration and a twelve-month deprecation clock in exchange. Microsoft put audited numbers behind the Copilot story: 30 million paid seats and a $100 billion Azure, funded by a 69% jump in quarterly capital spending that explains precisely why every vendor is hunting cheaper inference and why per-seat AI pricing is not about to soften. The E7 bundle is the concrete decision most IT buyers will face from it.

The security news was the same lesson from three directions in five days. An SD-WAN orchestrator with a CVSS 10.0 unauthenticated path to code execution, a firewall manager shipping a hard-coded account, and a low-severity FortiOS flaw whose only purpose is helping an intruder persist — none exotic, all in the perimeter gear that decides what everything else may do. Two consecutive weeks of firewall management planes on the KEV catalog is not a coincidence; it is where attackers are looking.

Three things worth doing before next week: confirm your Article 50 exposure today, because the EU transparency obligations apply from August 2 regardless of the high-risk delay, and the disclosure gaps are usually in customer-facing bots and published content rather than anywhere your compliance team has been looking; patch Cisco Secure FMC, Arista VeloCloud Orchestrator, and FortiOS now, treating the FMC exposure as information disclosure and any long-unpatched FortiOS appliance as potentially already compromised; and inventory the MCP servers and connectors already running in your environment before the stateless migration makes it easier for more of them to appear without anyone registering them.

Next edition publishes August 8.

More Enterprise AI Weekly coverage:

Enterprise AI Weekly: July 13–18, 2026 — Week 29
Enterprise AI Weekly: July 20–25, 2026 — Week 30
Enterprise AI Weekly: August 3–8, 2026 — Week 32
Enterprise AI Weekly: August 10–15, 2026 — Week 33