Who contributed to AI Agents on July 31, 2026?

13 developers shipped this update, including github-actions[bot], ccurme, langchain-oss-model-profiles[bot], jkennedyvz, mdrxy, openhands-release-bot[bot], FraterCCCLXIII, and hieptl, and 5 more.

What were the notable AI Agents updates?

fix(openai): redact MCP `authorization`, langchain-core==1.5.3, and feat(anthropic): add `user_profile_id` convenience attribute.

AI Agents

LangChain, OpenHands, Cline, and LlamaIndex - agent frameworks and coding agents

Pick a date

Topics: AI Agents AI / ML Full archive →

The Wire · Showcase

LANGCHAIN PATCHES CREDENTIAL LEAK IN MCP TOOLS; OPENHANDS SHIPS 1.8.0

By RepoJournal · Filed 07:02 UTC on July 31, 2026 · About AI Agents

13 people shipped this

github-actions[bot] @github-actions[bot] 1 cited

ccurme @ccurme 1 cited

langchain-oss-model-profiles[bot] @langchain-oss-model-profiles[bot] 1 cited

jkennedyvz @jkennedyvz 1 cited

openhands-release-bot[bot] @openhands-release-bot[bot] 1 cited

FraterCCCLXIII @FraterCCCLXIII 1 cited

hieptl @hieptl 1 cited

neubig @neubig 1 cited

saoudrizwan @saoudrizwan 1 cited

minh2416294 @minh2416294 1 cited

arafatkatze @arafatkatze 1 cited

mdrxy @mdrxy

abeatrix @abeatrix

LangChain's ChatOpenAI was leaving MCP tool credentials exposed in traces and callbacks, a regression now fixed before wider adoption.

The most urgent story: LangChain plugged a credential bleed in its OpenAI integration where MCP tool authorization fields were reaching LangSmith traces and configured callbacks [1]. The fix redacts both `headers` and `authorization` while preserving them in the actual OpenAI payload, with regression tests covering callback leakage. This matters because MCP tools are becoming standard infrastructure for agent work, and credential handling failures compound fast.

In parallel, LangChain shipped langchain-core 1.5.3 [2] with a fallback to `LANGSMITH_API_KEY` for gateway authentication, addressing a configuration gap. The team also added `user_profile_id` as a convenience attribute for Anthropic integrations [3], reducing boilerplate in agent chains. Model profile data refreshed automatically [4], with Poolside Laguna models removed from OpenRouter as deprecated.

OpenHands released v1.8.0 [5] with MCP server enable/disable controls and fixes for disabled skill context leakage. The team shipped domain-neutral extension-manifest hosting [7], PostHog telemetry identity alignment for Cloud users [8], and backend chooser UI compaction [6]. Cline landed multi-file diff rendering fixes [10], diff preview legacy parity [9], and reasoning-effort selectors for xAI, Z AI, and Moonshot [11].

Across all three desks: 61 commits, 52 PRs, and 8 releases in 24 hours. The credential fix in LangChain is the only breaking issue; everything else is additive or UX polish.

Action items

→ If you deploy ChatOpenAI with MCP tools and LangSmith tracing enabled, upgrade to langchain-core 1.5.3 before your next agent deployment langchain-ai/langchain [immediate]
→ Review your MCP tool credential handling in callbacks if you have custom telemetry wired to ChatOpenAI langchain-ai/langchain [plan]
→ If running OpenHands, pull v1.8.0 for MCP server management and disabled skill fixes OpenHands/OpenHands [plan]
→ Cline users: update for multi-file patch diff accuracy and reasoning model support across xAI, Z AI, and Moonshot cline/cline [monitor]

References

[1] fix(openai): redact MCP `authorization` ↗ langchain-ai/langchain
[2] langchain-core==1.5.3 ↗ langchain-ai/langchain
[3] feat(anthropic): add `user_profile_id` convenience attribute ↗ langchain-ai/langchain
[4] chore(model-profiles): refresh model profile data (#39141) langchain-ai/langchain
[5] v1.8.0 ↗ OpenHands/OpenHands
[6] feat(backends): compact Cloud vs Agent-server add-backend chooser ↗ OpenHands/OpenHands
[7] feat: add a domain-neutral extension-manifest host ↗ OpenHands/OpenHands
[8] fix: identify PostHog users with Cloud identity ↗ OpenHands/OpenHands
[9] Show edited file after the diff preview closes (legacy parity) ↗ cline/cline
[10] fix(vscode): show per-file diff for multi-file apply_patch ↗ cline/cline
[11] fix(vscode): show catalog-driven reasoning effort selector for xAI, ZAI, and Moonshot ↗ cline/cline

Quick answers

What shipped in AI Agents on July 31, 2026?: LangChain's ChatOpenAI was leaving MCP tool credentials exposed in traces and callbacks, a regression now fixed before wider adoption. In total, 61 commits, 52 pull requests, and 8 releases landed.
Who contributed to AI Agents on July 31, 2026?: 13 developers shipped this update, including github-actions[bot], ccurme, langchain-oss-model-profiles[bot], jkennedyvz, mdrxy, openhands-release-bot[bot], FraterCCCLXIII, and hieptl, and 5 more.
What were the notable AI Agents updates?: fix(openai): redact MCP `authorization`, langchain-core==1.5.3, and feat(anthropic): add `user_profile_id` convenience attribute.

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

ai-agents 54 shipped

AI Agents Aug 5

HITL APPROVAL GATES STOP SILENTLY FAILING OPEN, AIOHTTP FIXES REDIRECT LEAKS ACROSS LANGCHAIN STACK

LangChain plugged a critical security hole in human-in-the-loop middleware where invalid configurations silently disabled approval gates, while simultaneously patching a cascade of aiohttp vulnerabilities that leak headers across origin boundaries.

ai-agents 121 shipped

AI Agents Aug 4

LANGCHAIN PLUGS RESOURCE LEAK, CLINE ADDS CONTEXT-WINDOW RECOVERY

LangChain fixed a critical event-loop leak in streaming tracers that was breaking Python 3.14+ tests, while Cline shipped context-window overflow detection and recovery across its SDK.

+10

ai-agents 73 shipped

AI Agents Aug 3

LANGCHAIN LOCKS DOWN TOOL ARGUMENT HANDLING, CLINE HARDENS RELEASE PIPELINE

LangChain shipped a burst of tool-handling fixes overnight that close injection gaps in subclasses, while Cline moved desktop signing secrets behind gated environments and killed notification spam.

ai-agents 26 shipped

Elsewhere on the wire

Local LLMs Aug 6

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.

+10

llms 240 shipped

@CachyOS Aug 6

WIKI TRANSLATION ROLLBACK CHAOS, MIRROR STACK HOLDING STEADY

CachyOS wiki maintainers are caught in a revert loop over German translations while the status infrastructure logs 55 commits without incident.

infra 57 shipped

Elixir & Phoenix Aug 6

ELIXIR BUMPS ZIZMOR SECURITY SCANNER TO 1.28.0

The Elixir repo updated its CI security action overnight, pulling in the latest zizmor static analysis tooling.

elixir 1 shipped

@dotnet Aug 6

DOTNET FOUNDATION PULLS iOS METRICS INTO FOCUS AS RUNTIME HARDENS HTTP PARSING

Performance team fixed iOS size reporting to measure only distributable packages, while runtime clamped down on RFC 9112 compliance for chunked encoding.