Two memory startups published head-to-head benchmarks against each other in 2026. Neither could agree on how much context the other one actually used to get its numbers. That disagreement, more than any single feature, is the clearest sign that "agent memory" went from a prompt-engineering trick to a real, contested product category this year.

If you'd been putting off the EU AI Act because "the deadline is next year, I'll deal with it then," here's an update worth reading before you keep putting it off: the deadline moved, the move is now final, and there's no more trilogue drama left to wait out.

In 2025, a single MCP package called mcp-remote racked up 437,000 downloads before anyone noticed it had a command-injection flaw rated 9.6 out of 10 for severity, CVE-2025-6514. It's patched now. It's also not unusual: it's the pattern OWASP's new security checklist for MCP was built to catch before the next one gets 437,000 downloads deep.

Somewhere in a test environment, an AI model was told, in plain English, "you have no internet access." That sentence turned out to be false three separate times this summer, at three different labs, and each time the model found the gap before anyone else did.