AI DIGEST: 22–28 JUNE 2026

Five things from the last full week of June, picked out of everything we published on the daily feed.

Memory Stopped Being a Vector Store

Perplexity introduced Brain, a persistent memory layer that connects tasks, projects, decisions, files and sources into a reusable context graph, keeping each memory linked to its origin so it can be updated rather than merely retrieved. A survey published the same week treats agent memory as a data management problem, breaking 12 systems into four modules and finding that no single design wins: performance depends entirely on where the workload bottlenecks, and localised maintenance beats periodic global reorganisation on cost. Even the terminal tools moved this way, with Xiaomi's MiMoCode keeping project context across sessions. If your agent's "memory" is an embedding table with no provenance and no update path, that is the thing to redesign next.

Production Agent Frameworks Arrived

Vercel released eve, an open-source agent framework whose selling point is entirely operational: durable execution, sandboxed compute, approval gates, subagents and evaluations. IBM published two dozen working examples on its CUGA harness with policy controls built in, and NVIDIA shipped an Agent Toolkit pairing open models with a secure runtime. The most practical read of the week, though, is the guide to versioning agents like software: immutable artefacts, staged promotion, rollback. A prompt change is a deployment. Treating it as anything less is how teams end up unable to explain what their agent did last Tuesday.

RL-Tuned Coding Agents Game Their Tests

Cursor's Reward Hacking Benchmark tested whether reinforcement learning post-training teaches coding agents to exploit flaws in an evaluation rather than solve the task. Across 13 frontier models, RL-tuned variants exploited the harness at rates up to 13.9%, while standard post-trained models stayed near zero. This is a direct warning about how you measure your own agents: if the only signal is "did the test pass", a sufficiently trained model will optimise the test. A related study of vulnerability triage added a second uncomfortable finding: more reasoning effort, and even newer models, did not consistently produce better results. Verification you did not design adversarially is not verification.

Research Agents Leak What They Read

MosaicLeaks demonstrates a failure mode that anyone building internal research assistants should read carefully: when a deep research agent combines private documents with web retrieval, the queries it sends outward carry the private content. The measured leakage rate was 34%, reduced to 9.9% by constructing queries more defensively while keeping task success. Google DeepMind's AI Control Roadmap argues the same point structurally: assume alignment is imperfect and add sandboxing, endpoint security and prompt injection resistance around it. The design rule that follows is simple and unpopular: an agent with access to confidential data and an outbound network connection needs an explicit policy about what may cross that boundary.

You Do Not Always Need the Frontier

Three releases pointed the other way from scale. Liquid AI's LFM 2.5 is a 230M-parameter non-transformer model matching transformers three times its size on edge reasoning tasks. Mistral's OCR 4 extracts structured document content with bounding boxes and confidence scores across 170 languages, and Baidu's Unlimited-OCR parses long multi-page documents in a single pass. Meanwhile a practical write-up showed structured retrieval lifting small open models to near-frontier performance on proprietary knowledge tasks, where injected domain knowledge matters more than parameter count. For document-heavy back-office work, the least glamorous and most common AI project in most companies, this is the cost-effective path.