Weekly collection of AI engineering news that I found interesting. Filtered from about 50 search results, narrowed to what actually matters if you build things.

Claude Code is getting its own ecosystem

The Claude Code community is building fast. LobeHub now has a skills marketplace where people share reusable agent definitions and MCP configs. VoltAgent published an awesome-agent-skills repo. Someone built a visual guide to the whole system.

The pattern I see: people stop treating it as a chatbot and start treating it as a platform. Skills, hooks, agents, commands. A Reddit thread asking “what’s your secret sauce?” got a long list of MCP servers people use daily. Context7 for docs, Playwright for browser testing, custom hooks for pre-commit validation. Sounds familiar.

Constellation Research says Claude Code hit $2.5B annualized revenue in February 2026. Eight of the Fortune 10 are enterprise customers. The CLI tool that lives in your terminal is turning into real business.

MCP security is the conversation now

Multiple articles this week about the security risks of connecting AI agents to real tools. Trend Micro published a state of AI security report that focuses on prompt injection through MCP tool outputs. The attack: embed hidden instructions in a document or web page that an agent processes via MCP. The agent follows those instructions instead of yours.

A practitioner’s guide on AI agent security risks argues that the directness that makes coding agents powerful is exactly what makes them dangerous on production systems. When your agent has admin rights, prompt injection becomes a real attack vector, not a theoretical one.

Runlayer’s MCP blog covers specific attack scenarios: malicious MCP servers, tool-level exploits, data exfiltration through tool responses. The fix isn’t to avoid MCP. It’s least-privilege access, behavioral detection, and treating every tool output as untrusted data.

This matches my own setup. My permission hook auto-denies destructive commands. A separate hook scans tool output for leaked secrets. Trust the architecture, not the agent.

Multi-agent systems are going mainstream

Google released ADK Python, a code-first toolkit for building multi-agent systems. It’s optimized for Gemini but works with other models. The interesting part: it supports A2A (Agent-to-Agent) communication alongside MCP for tools. Two protocols, one for tools, one for agent coordination.

A deep dive on AWCP from arXiv proposes a “workspace delegation protocol” for agents that need deep engagement with a codebase. Instead of giving an agent one tool at a time, you give it a workspace and let it figure out the tool chain. Closer to how humans work on a project.

The practical takeaway: if you’re running multiple agents on the same project, you need coordination. Shared task lists, message passing, workspace isolation. The tools exist now. Whether they’re ready for production is a different question.

Prompt engineering is splitting into two disciplines

The old “prompt engineering” (write better instructions) is becoming “context engineering” (design what information the model sees). An Intuition Labs article makes the distinction: prompts are what you ask, context is everything else. System instructions, tool outputs, RAG results, conversation history. Getting the context right matters more than getting the prompt right.

Meanwhile, chain-of-thought prompting keeps getting refined. A paper on ASCoT (Adaptive Self-Correction Chain-of-Thought) addresses a known problem: reasoning chains that start strong but fall apart in later steps. Their fix adds a position-aware verification step that catches errors before they compound.

For practical work, the shift is clear. System prompts for constraints and persona. Context engineering for everything else. The 2026 advice: spend less time perfecting your prompt, more time perfecting what your agent knows before it starts working.