1. Poolside Releases Laguna M.1 225B Mixture-of-Experts Model
Poolside has released Laguna M.1, a 225B parameter Mixture-of-Experts model optimized for agentic coding and long-horizon tasks. Released under the Apache 2.0 license, the model activates 23B parameters per token and supports a 262,144-token context window. Laguna M.1 features native support for interleaved thinking between tool calls and delivers strong performance on coding benchmarks, scoring 74.6% on SWE-bench Verified and 49.2% on SWE-bench Pro.
- • Laguna M.1 is a 225B total parameter MoE model with 23B active parameters per token, released under the Apache 2.0 license.
- • The model features 70 layers (3 dense SwiGLU, 67 sparse MoE) with 256 experts and top-k=16 routing.
- • It supports a 262,144-token context window using RoPE with YaRN.
- • The model includes native support for interleaved thinking between tool calls, which can be toggled per request.
- • It scores 74.6% on SWE-bench Verified, 63.1% on SWE-bench Multilingual, and 49.2% on SWE-bench Pro.
Developers have access to a highly capable, open-weights coding model with native support for interleaved thinking and a 262k context window.
2. LFM2.5 Multilingual Embedding and ColBERT Models Released
Liquid AI has released two new 350M parameter retrieval models: LFM2.5-Embedding-350M, a dense bi-encoder, and LFM2.5-ColBERT-350M, a late interaction retriever. Designed as drop-in replacements for existing RAG pipelines, both models deliver best-in-class multilingual accuracy across 11 languages. Thanks to the underlying LFM2 backbone, they maintain high inference speeds comparable to much smaller models while facilitating fast indexing and cross-lingual retrieval.
- • LFM2.5-Embedding-350M is a dense bi-encoder designed for multilingual retrieval across 11 languages.
- • LFM2.5-ColBERT-350M is a late interaction retriever storing one vector per token, utilizing MaxSim for cross-lingual matching.
- • Both models are 350M parameters and designed as drop-in replacements in existing RAG pipelines.
- • The models offer best-in-class multilingual accuracy for their size, with inference speeds comparable to smaller models due to the LFM2 backbone.
Developers can upgrade their RAG pipelines with highly accurate, fast multilingual retrieval models that support 11 languages at a compact 350M parameter size.
3. North Mini Code 1.0 Receives 4-Bit Quantization and Ollama Support
CohereLabs has released a 4-bit quantized version of its North Mini Code 1.0 model on Hugging Face. This quantization reduces the memory requirement to approximately 20 GB, allowing developers to run the model locally on standard hardware like a Mac. The model is now fully supported on Ollama and other llama.cpp-based runtimes, and remains accessible via the OpenRouter API.
- • CohereLabs released a 4-bit quantized version of the North Mini Code 1.0 model on Hugging Face.
- • The 4-bit quantized model requires approximately 20 GB of memory to run on local hardware.
- • North Mini Code 1.0 is now supported on Ollama and other local runtimes built on llama.cpp.
- • The model is also available for access via the OpenRouter API.
Developers can now run the North Mini Code 1.0 model locally on standard hardware like a Mac with only 20 GB of memory.
4. Critical Vulnerabilities Disclosed in LiteLLM, Langflow, and Microsoft Copilot
A series of critical security disclosures has targeted popular AI developer tools. Obsidian Security revealed a three-CVE chain in the LiteLLM gateway that allows low-privilege users to execute remote code and access provider API keys, while a separate command-injection vulnerability in LiteLLM's MCP test endpoints has been added to the CISA KEV list. Additionally, Langflow's path traversal vulnerability (CVE-2026-5027) is reportedly under active exploitation, and Microsoft 365 Copilot was found vulnerable to a data exfiltration chain named SearchLeak.
- • Obsidian Security disclosed a three-CVE chain (CVE-2026-47101, CVE-2026-47102, CVE-2026-40217) in the LiteLLM gateway allowing remote code execution and provider key access.
- • LiteLLM also faced a command-injection vulnerability (CVE-2026-42271) in its MCP test endpoints, added to the CISA KEV list with a June 22 remediation deadline.
- • Langflow CVE-2026-5027, a path traversal vulnerability allowing unauthenticated remote code execution, is under active exploitation by MuddyWater.
- • Varonis disclosed SearchLeak (CVE-2026-42824), a critical exfiltration chain in Microsoft 365 Copilot Enterprise Search.
- • A supply-chain attack involving the Mini Shai-Hulud worm compromised 32 Red Hat Cloud Services npm packages on June 1.
Developers using LiteLLM or Langflow must patch their instances immediately to prevent remote code execution and unauthorized access to provider API keys.
5. Anthropic Launches Claude Code Artifacts for Interactive Workspaces
Anthropic has updated its terminal-based developer tool, Claude Code, with support for Artifacts. Available to Claude Team and Enterprise subscribers, the feature allows developers to render terminal session outputs into live, interactive, and shareable HTML webpages. These stateless, self-contained pages (up to 16 MiB in size) update in real-time as the AI agent works. To maintain enterprise security, Anthropic enforces a strict Content Security Policy that blocks all external network requests, keeping the generated workspaces secure and private by default.
- • Anthropic has introduced Artifacts for Claude Code, available to Claude Team and Enterprise subscribers.
- • The feature transforms terminal session work into live, interactive, and shareable HTML webpages.
- • Webpages update in real-time as the AI agent works, accessible via a persistent URL.
- • Artifacts are stateless, self-contained HTML pages with a maximum rendered size of 16 MiB.
- • Anthropic enforces a strict Content Security Policy (CSP) that blocks all external network requests (fetch, XHR, WebSocket) for security.
- • Access is private by default and restricted to authenticated members of an organization.
Developers can now instantly generate and share live, interactive visual dashboards and system diagrams directly from their terminal-based Claude Code sessions.
6. Elastic Launches Agent Builder with Persistent Memory Layer
Elastic has announced the general availability of its Agent Builder on Elastic Cloud, introducing a persistent agent memory layer built on Elasticsearch. The architecture separates memory into episodic, semantic, and procedural indices, utilizing a hybrid retrieval pipeline with BM25 and Jina v5 dense vectors. The system natively supports the Model Context Protocol (MCP) for seamless integration with Cursor and Claude Desktop, and enforces strict multi-tenant isolation via Document-Level Security.
- • Elastic's Agent Builder is now generally available on Elastic Cloud.
- • The architecture uses three Elasticsearch indices to manage memory: episodic, semantic, and procedural.
- • The system employs a hybrid retrieval pipeline (BM25 and Jina v5 dense vectors) fused with RRF and a Jina v2 cross-encoder reranker.
- • It supports the Model Context Protocol (MCP) for integration with clients like Claude Desktop and Cursor.
- • Multi-tenant isolation is enforced at the cluster level using Elasticsearch Document-Level Security (DLS).
- • In evaluations, the system achieved an average R@10 of 0.89 with zero cross-tenant leaks.
Developers can implement a robust, multi-tenant agent memory layer with high recall and native MCP integration using their existing Elasticsearch infrastructure.
7. Zero-Touch OAuth Extension for MCP Reaches Stable Status
The Enterprise-Managed Authorization (EMA) extension for the Model Context Protocol (MCP) has reached stable status. EMA allows organizations to centrally manage MCP server access through existing identity providers like Okta, eliminating the need for per-user OAuth setup and repeated consent prompts. Anthropic has already integrated the extension into its shared MCP layer for Claude, Claude Code, and Cowork, alongside support from VS Code and platforms like Supabase, Linear, and Figma.
- • The Enterprise-Managed Authorization (EMA) extension for the Model Context Protocol (MCP) has reached stable status.
- • EMA allows organizations to centrally manage MCP server access through identity providers, eliminating per-user OAuth prompts.
- • The extension uses an Identity Assertion JWT Authorization Grant (ID-JAG) for zero-touch setup.
- • Okta is the first supported identity provider, utilizing its Cross App Access (XAA) protocol.
- • Anthropic has implemented EMA in its shared MCP layer for Claude, Claude Code, and Cowork, with VS Code also adding support.
- • Supported platforms include Supabase, Linear, Figma, Canva, Atlassian, and Asana.
Developers can build and deploy MCP servers in enterprise environments without requiring individual users to repeatedly complete OAuth consent prompts.
8. Arbor Framework Automates Autonomous Software Optimization
Researchers from Renmin University of China and Microsoft Research have introduced Arbor, an open-source framework designed to automate the optimization of complex software systems. Arbor structures its optimization process as a branching tree of hypotheses, experiments, and evidence managed by a long-lived coordinator agent, while short-lived executor agents test changes in isolated git worktrees. In benchmarks, Arbor delivered over 2.5 times the performance gains of standard coding agents like Claude Code and Codex under the same compute budget, and integrates directly with standard Git workflows for easy code review.
- • Arbor is a framework designed to automate the autonomous optimization of complex software systems.
- • The framework uses a long-lived coordinator agent to manage research strategy and short-lived executor agents in isolated git worktrees.
- • It organizes research into a branching tree structure tracking hypotheses, experiments, and evidence via Hypothesis Tree Refinement (HTR).
- • Arbor delivered over 2.5 times the performance gains of Codex and Claude Code under the same compute budget.
- • On the BrowseComp task, Arbor improved accuracy to 67.67% compared to Claude Code's 53.33%.
- • The framework integrates with existing Git workflows, allowing developers to review optimized branches before merging.
Developers can deploy long-lived coordinator agents to autonomously optimize complex software systems with 2.5x better performance than standard coding agents.
9. Vercel Launches Connect to Replace Persistent Agent Tokens
Vercel has launched Connect in public beta, a security feature designed specifically for AI agent deployments. Instead of relying on long-lived, persistent provider tokens that pose a significant security risk if leaked, Connect implements a runtime credential exchange system. The platform automatically issues short-lived, task-scoped credentials, minimizing the attack surface for autonomous agents executing tasks.
- • Vercel has launched Connect in public beta.
- • Connect replaces long-lived provider tokens with a runtime credential exchange system.
- • The system issues short-lived, task-scoped credentials for AI agents.
- • The update aims to reduce the security risks associated with shared, persistent access tokens.
Developers can secure their agent deployments by replacing risky, long-lived API tokens with ephemeral, task-scoped credentials.
10. Replit Integration Launched Inside Claude
Replit has launched a direct integration inside Claude, allowing developers to transition seamlessly from initial design conversations to active development. The integration streamlines the workflow of taking AI-generated code prototypes and opening them directly within Replit's cloud-based development environment.
- • Replit has been integrated into Claude.
- • The integration is designed to enable transitions from design to development.
Developers using Claude can now transition their designs and code prototypes directly into Replit's development environment.
11. AA-Briefcase Benchmark Evaluates Models on Long-Horizon Projects
A new agentic evaluation benchmark called AA-Briefcase has been launched to test AI models on complex, long-horizon knowledge work. Developed by industry experts, the benchmark simulates real-world organizational contexts by requiring models to reason across thousands of fragmented inputs, including over 25,000 Slack messages and 3,500 emails. Claude Fable 5 currently leads the benchmark but at a high average cost of $31 per task, compared to $10.40 for Claude Opus 4.8 and $2.40 for GLM-5.2.
- • AA-Briefcase is a new benchmark designed to evaluate AI models on long-horizon knowledge work within complex, multi-week projects.
- • Models must reason across thousands of fragmented inputs, including company documents, meeting transcripts, 25,000+ Slack messages, and 3,500+ emails.
- • Claude Fable 5 leads the benchmark with an Elo score of 1587, followed by Claude Opus 4.8 at 1356 and GLM 5.2 at 1266.
- • The average cost per task is $31 for Claude Fable 5, $10.40 for Claude Opus 4.8, and $2.40 for GLM-5.2 (max).
- • A public demonstration scenario, AA-Briefcase Lite, is available on Hugging Face.
Developers can use this benchmark to evaluate how well different models handle complex, real-world enterprise workflows and to estimate the associated API costs.
12. Nvidia Launches XR AI Platform in Public Beta
Nvidia has released Nvidia XR AI in public beta, providing a foundation for connecting extended reality (XR) devices to GPU-accelerated AI services. The platform includes an open-source library that enables developers to build intelligent agents for AI glasses, AR glasses, and XR headsets. These agents can process real-time visual input, interpret user intent, execute enterprise tool calls, and deliver responses directly within an active XR session.
- • Nvidia XR AI has launched in public beta to connect extended reality (XR) devices to GPU-accelerated AI services.
- • The platform supports AI services running in the cloud, data centers, workstations, or at the edge.
- • An open-source library is available for developers to build intelligent agents for AI glasses, AR glasses, and XR headsets.
- • Agents built with the library can process visual input, understand intent, call enterprise tools, and respond within an XR session.
Developers can build intelligent agents for AR glasses and XR headsets that process visual input, understand intent, and call enterprise tools in real time.
13. TesterArmy Launches Agentic Web and Mobile App Testing Platform
TesterArmy, a YC P26 company, has launched an agentic testing platform designed to automate end-to-end checks for web and mobile applications. The platform allows developers to define test cases in natural language, which are then executed by AI agents both pre-deployment and in production. TesterArmy integrates directly with GitHub for scheduling and sends alerts through Slack or Discord when bugs are detected in critical flows.
- • TesterArmy is an agentic testing platform that performs end-to-end checks before deployment and in production.
- • Users define tests in natural language, which are executed and managed by AI agents.
- • The platform integrates with GitHub for test scheduling and alerts via Slack or Discord.
- • Over 30 teams are using the product daily to identify bugs in onboarding, checkout, and AI chat flows.
Developers can automate end-to-end testing of critical application flows like onboarding and checkout using natural language test definitions.
14. Hermes Introduces Migration Tool for Legacy Agent Configurations
Hermes has released a migration utility, accessible via the hermes claw migrate command, designed to import legacy OpenClaw, Clawdbot, and Moldbot configurations. The tool automatically scans for default directories and migrates personas, memory, workspace files, skills, and MCP servers. While it resolves standard API keys from environment files, developers must manually configure SecretRef objects that rely on file or execution sources.
- • The hermes claw migrate command imports legacy OpenClaw, Clawdbot, or Moldbot configurations into Hermes.
- • The tool automatically detects legacy configuration directories like ~/.clawdbot/ and ~/.moltbot/.
- • Migrated data includes personas, memory, instructions, workspace files, skills, and MCP servers.
- • API keys are resolved from config values, environment files, and agent auth profiles.
- • SecretRef objects using file or exec sources cannot be resolved automatically and must be added manually.
Developers can easily migrate legacy agent configurations, including memory, skills, and API keys, to the Hermes platform using a single CLI command.
15. Real-World Workload Test Measures Actual Savings of Token-Compression Tools
A real-world evaluation of three popular token-saving tools—rtk, headroom, and caveman—revealed that their actual impact on API bills is significantly lower than advertised. Tested against 500 Claude Code sessions totaling 614 million tokens, the tools achieved a combined savings of just 3.7%. While the tools successfully compress their targeted payloads, the overall bill reduction is heavily diluted because they do not optimize system prompts, file reads, or cached tokens, while introducing security risks by accessing sensitive code and API keys.
- • Three token-saving tools—rtk, headroom, and caveman—were tested against 500 Claude Code sessions totaling 614 million tokens and $926 in baseline spend.
- • The combined real-world savings achieved was only 3.7% ($34.12), with headroom saving 2.8%, rtk saving 0.5%, and caveman saving 0.4%.
- • The tools' advertised compression rates were confirmed accurate, but only for the specific payloads they target.
- • The low overall bill impact is due to the 'denominator effect,' where high-compression tricks do not apply to system prompts, file reads, or cached tokens.
- • The test highlighted security risks, noting that these tools require access to code, prompts, and API keys.
Developers should expect much lower real-world cost reductions from token-compression tools than advertised, as high-compression tricks do not apply to cached prompts or file reads.
16. Analysis Warns of Operational Risks in RTK Token Compression Tool
A technical analysis of the RTK terminal output compression tool has raised concerns about its viability in production agent workflows. While RTK claims 60-90% token savings by compressing CLI output, critics point out that this metric ignores major cost drivers like file reads and system prompts. Furthermore, the tool's brittle parsing of CLI output introduces operational risks, such as stripping critical stack traces or compiler context, which can cause coding agents to fail silently.
- • RTK is designed to compress terminal output for LLM agents to reduce token usage, claiming 60-90% savings.
- • A technical critique argues the savings metric is misleading because it only applies to raw command line output, ignoring file reads and system prompts.
- • Critics warn that RTK can cause silent failures by stripping critical information like stack traces or compiler context.
- • RTK currently lacks rigorous task success rate benchmarks, such as SWE-bench, to validate its impact.
- • The tool relies on brittle parsing of CLI output that could break with standard tool updates.
Developers using token compression tools for coding agents must weigh minor cost savings against the risk of agents failing silently due to stripped context.