<blockquote cite="https://twitter.com/benhylak/status/2115172657910120740"><p>every product i use should just be a headless mcp, that feeds into an agent, where i never have to think about anything underneath.</p><p>except for our product, of course. </p><p>in our product, customers love the ui and love us very much.</p><p>we're special that way.</p></blockquote><p class="cite">— <a href="https://twitter.com/benhylak...

Rspack 2.3 brings SWC Next, faster builds, lower memory usage, smaller bundles, a new experimental cache, loader caching, and built-in CSS improvements.

A super scary way to go about tables using other layout techniques, like CSS Grid.The Frankenstein Table originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

PHP2Shell and Brocolli2Shell may be harbingers of many vulnerabilities to come. But we can be readyCategory: News

The most fragile code in bilan guessed whether a sync was still alive. Agents replaced it with a small domain model built on Alchemy Domain and Effect, specified by stories that play hours of a sync's life in milliseconds. Here are the principles I took away from it.

Cloudflare mitigated over 8,200 DDoS attacks per hour in Q3 2026 as attackers shifted to shorter, high-frequency strikes. Explore the latest threat data, including the collapse of CLDAP vectors and the impact of recent botnet takedowns.

Agents moved bilan from a Wrangler config to Alchemy in a day. Every pull request now gets its own copy of the app, production never went down, and the whole system lives in one typed file. Here are the principles that made it worth it.

PHP2Shell showed how fast AI turns a bug into an exploit. Here’s why the disclosure should never happen this way again, and why it will anyway.Category: News

こんにちは。@potato4dです。今回は2026年10月12日に開催された フロントエンドカンファレンス関西2026 の参加・協賛レポートをお届けします。本記事では、スポンサーブースの様子や、当日参...

319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Custom media queries let you name and reuse media queries the way custom properties do for values. Here’s a set of drop-in @custom-media presets for input mechanisms, breakpoints, and true HDR, plus a container style query version of each that works in every browser today.

<blockquote cite="https://news.ycombinator.com/item?id=50248124#50249160"><p>In general, LLM performance is incredibly multidimensional. There's no guarantee of a fixed ordering where the model that is best at math is also the model that's best at jokes. Despite that complexity, much of the variation in performance is explained by just a single variable: model size. In general, models that are bigger will (a) be more performant / reliable, (b) cost more per token, and (c) have bette...

You can now run CI for your Turborepo with one line of configuration.In Vercel's internal repositories, our wait time from to "CI passed" is 2-6x shorter, dramatically improving our CI's ability to keep up with our coding agents.git pushTo get started, prompt your agent in your repo:Each task marked with a tag runs on every push. Vercel CI automatically takes care of:ciTo learn more:Read moreOnly running CI that is affected by your code changesTask caching with Vercel Remote CacheInstalling depe

Box Mount lets agents running in Vercel Sandbox read and write Box files through standard filesystem operations. It syncs a Box folder with a directory inside the sandbox. Unmount before you stop the sandbox, and everything the agent wrote is in Box after the sandbox is deleted. The contract-review example uses AI Gateway to review a synthetic contract in Vercel Sandbox and save the review back to Box. The sync process and agent run as separate sandbox users, keeping the Box credentials separate

<p><strong><a href="https://github.blog/news-insights/octoverse/octoverse-commits-pushes-reach-new-highs-in-2026-as-developers-build-with-agents/">GitHub Octoverse 2026</a></strong></p>I'm at GitHub Universe today (GitHub gave me a free ticket through their "GitHub Stars" program). EVP Jay Parikh just announced this year's Octoverse report, and highlighted these numbers in particular:</p><p><img alt="Photo of a conference keynote stage: a wide ...

Today, we laid out our vision for GitHub as the most comprehensive, end-to-end software delivery system in the world.The post GitHub Universe 2026: Evolving every layer of the stack appeared first on The GitHub Blog.

See how a record year of growth reached every industry, every field, and every kind of builder in the 2026 Octoverse report.The post Octoverse: Commits, pushes, reach new highs in 2026 as developers build with agents appeared first on The GitHub Blog.

<p>I've written before about how November 2025 was <a href="https://simonwillison.net/tags/november-2025-inflection/">an inflection point for coding agents</a> - the point where Opus 4.5 and GPT-5.1 crossed a tipping point that meant their respective coding agents became reliable daily drivers for software engineers. I think we've reached a new inflection point in October 2026, and this time it's for <strong>vibe coding computer games</strong>.</p><ul> ...

GitHub’s native egress firewall covers GitHub-hosted Linux runners. See five ways Harden-Runner goes further, from anomaly detection to build tampering

GitHub's dependency graph doesn't read bun.lock yet, so in Bun projects Dependabot alerts only cover what's written in package.json, and never a transitive dependency. Here's how to check if you're affected, and how I closed the gap with a GitHub Action.

<blockquote cite="https://www.aboutamazon.com/news/company-news/amazon-software-engineer-role-guideline-ai"><p>If your work does not benefit from current AI tooling, that is a finding, not a failing. Document why, share it with your community of peers, bring it to your manager, and work to find solutions. An engineer who can explain where AI does not yet help their work is demonstrating the judgement we are asking for.</p></blockquote><p class="cite">— &l...

Aikido launches external network pentesting: AI agents attack your internet-facing systems from the outside and report only findings they actually exploit.Category: Company Updates

now supports up to 2 GB per compressed image layer, up from 500 MB, allowing larger layers to be pushed without splitting them. The total image size limit remains 15 GB.Vercel Container RegistryThe higher layer limit is useful for images with large toolchains or dependency sets, such as custom environments for coding-agent evaluations.Vercel SandboxWith Docker and the installed, run these commands from the directory containing your Dockerfile:Vercel CLIRead the to build, push, and pull your firs

Today, we are introducing on .Virtual ModelsAI GatewayVirtual Models are an abstraction of the model string and configurations your apps and developers use. With a single virtual model ID, you can change and update models, configure fallbacks and priority, and enforce Zero Data Retention centrally. The virtual model configuration applies wherever the ID is used. Assign a virtual model ID to an agent task, and pass it as the model string wherever that task is called. You can then change the model

Coding agents are opening more pull requests than ever, and each one waits on CI before anyone can review or merge it. Most CI systems run the entire workflow on every push, even a one-line change. The more your agents push, the more time you spend waiting on CI.Today, we're announcing Vercel CI in Beta. It runs only the tasks affected by your code change, and spins up only the compute those checks need, the same way scales with your traffic.Fluid computeAt Vercel, our CI now keeps up with our c

I like the idea of "Please suggest 10 improvements to my ~/.zshrc" as a prompt (John Lindquist). Nick Taylor wrote up all the stuff it found for him and got nearly a second back for every fresh terminal opened.

macOSの既定のブラウザとして登録しておき、開いたリンクを設定ファイルのルールに応じて、指定したブラウザとプロファイルへ振り分けるアプリ Chizu 🧀 を作りました。GitHub: azu/chizuChizuには、ブラウザを選ぶ画面や設定画面はありません。振り分けのルールは~/.config/chizu/config.jsoncというJSONCファイルに書き、リンクを開くたびにこのファイルを読み直します。行き先にはブラウザのプロファイルも指定でき、現時点ではDia、Google Chrome、Firefoxのプロファイル指定に対応しています。インストール動作環境は次のとおりです。Apple SiliconのMac + macOS 14以降次のコマンドでインストールし、ChizuをmacOSの既定のブラウザに設定できます。いつも通りnotarizationはしてないので、自己判断でご自由にどうぞ。curl -fL https://github.com/azu/chizu/releases/latest/download/chizu-macos-arm64.zip -o "$TMP...

Typed-channel is a library for typed messages and requests across workers, iframes, tabs, and event buses.

Nuxt DevTools v4 is built on Devframe and Vite DevTools. It brings the full Vue DevTools and the wider devtools ecosystem to Nuxt.

are now available on . Virtual modelsAI GatewayA virtual model is a saved configuration that tells AI Gateway which model and settings to use. Your apps and agents call it with a custom model ID, such as . You can change the model or settings centrally in AI Gateway without redeploying your apps or reconfiguring your agents.vmc/coding-agentUse virtual models to:To create a virtual model, open the and click . Enter a slug, choose the underlying model, configure the settings you want requests to u

Paseo now supports running fx, Codex, Claude Code, OpenCode, and Pi in the cloud with the .Vercel Sandbox pluginYou can now start an agent in Vercel Sandbox from Paseo on your laptop, then connect from your phone to control the same session, even when your laptop is closed. Stopping a sandbox saves your files and conversation history so you can pick up where you left off. Active processes stop with the sandbox.Enter your Vercel AI Gateway key once during setup. The plugin reuses it for model req

from Particle AI is now available on . It is post-trained on DeepSeek V4.1 Flash, with a focus on completing software engineering tasks using fewer tokens. Particle describes the gains as shorter reasoning, fewer rounds of trial and repair, and more focused exploration.Particle-1AI GatewayUse it for debugging, planning code changes, and breaking down multi-step engineering problems. Particle-1 has a 1M-token context window for working with code and extended task histories.Set in your environment

no longer requires an interactive terminal to enable or . Agents can now turn them on for your projects without asking you to run the commands yourself.Vercel CLIWeb AnalyticsObservability PlusTo get started, run either command from a linked project directory:Teams must already be subscribed to Observability Plus to be able to enable it for a project.Update Vercel CLI to version 64.2.0 or later and learn more in the .Vercel CLI project documentationRead more

You can now use , our open-source coding agent harness, in on web, desktop, and mobile.fxT3 CodeT3 Code is an open-source control plane for coding agents, allowing you to add agents like fx as providers for your coding sessions. The built-in fx provider supports Supervised and Auto modes, along with the models and skills you already use with fx.Get started by and . Then and add fx from .installing fxsetting up your model providerdownload T3 CodeSettings > Providers > Add providerRead more

The is now available in .Vercel PluginOpenCodeThe plugin provides guidance on Vercel APIs and recommended patterns, with for AI SDK, Vercel Functions, Workflow, and more. It also includes specialist agents for deployment, performance optimization, and AI application design. Use to deploy projects and to manage environment variables.skills/vercel:deploy/vercel:envThe plugin requires OpenCode 2. If you’re using OpenCode 1, with .upgradeopencode upgrade --majorTo install the plugin, run: Then run i

You can now query AI traffic in to understand how AI bots are accessing your site.Vercel ObservabilityAI traffic insights show:To view AI traffic insights, open in the Vercel dashboard.Observability > AI TrafficYou and your agents can also query these metrics with in the . CLI queries require Observability Plus.vercel metricsVercel CLItype: embedded-entry-inline id: 6E78NBZeL598kMHZ7c4zykLearn more in the .AI traffic documentationRead more how many requests each bot makesRequests by verified ...

<p><strong><a href="https://spf13.com/p/game-boy-color-on-my-conference-badge/">Game Boy Color on My Conference Badge</a></strong></p>I'm at GitHub Universe this week and, <a href="https://simonwillison.net/2025/Oct/28/github-universe-badge/">similar to last year</a>, the conference badge is a full-blown color screen computer.</p><p>I've been hacking around with it again, and then I ran into with Steve Francia... who worked with Gemini...

Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.

We’re back! Don't worry, this isn’t a trick (despite what our name suggests!). However, due to the hiatus, we're also a little behind. That’s why this issue of What’s !important is absolutely stacked. All killer, no filler. Here's what you missed.What’s !important #19: CSS Refraction Effects, Scroll State Queries, @custom-media, and More originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

Inventory the Claude Code and Codex plugins on developer machines and in your GitHub repositories: where each came from, what it bundles, whether it is enabled, and which repositories distribute it.

Three XSS vulnerabilities are now resolved in CKEditor 5 v49.0.1, v48.5.3, and LTS Edition v47.7.6. Updating highly recommended.

We are launching a PHP Capture the Flag challenge integrated with our Bug Bounty program to test our WAF protections. Security researchers are invited to bypass our defenses and capture the flag to help make the Internet safer.

An examination of global Internet disruptions observed by Cloudflare Radar during the third quarter of 2026. This review analyzes how power failures, natural disasters, and government shutdowns impacted network connectivity and traffic.

22% of packages arrive on the npm registry without their dependencies available yet.

Vercel and are partnering to bring 14 ElevenLabs models to . To celebrate the launch, all ElevenLabs models are 50% off on AI Gateway for the first 14 days, through November 9th.ElevenLabsAI GatewayAI Gateway supports six different types of ElevenLabs audio models:All of these audio models are accessible through a single gateway API key. Your app or agent can transcribe what a user says, reason over it with your choice of hundreds of models, then answer in an ElevenLabs voice. You can also creat

The fx adapter for the AI SDK’s now runs the harness and model requests in the same process as your application. Built-in filesystem and shell operations remain isolated in the sandbox.HarnessAgentThe adapter uses , the TypeScript library for fx. It no longer needs to install fx inside the sandbox, run a sandbox bridge, or expose a sandbox port. Model credentials stay on the host rather than being forwarded into the sandbox.libfxThe rewrite also adds:Sessions can be saved and resumed in a new ho

can now investigate alerts from before they reach your paging system. With validation enabled for a webhook destination, only alerts Agent classifies as are sent to it.Vercel AgentVercel monitorsCriticalTo enable validation:You can also configure notification destinations with the using . Add when linking or updating a webhook destination.Vercel CLIvercel monitors notifications--critical-onlyAgent checks logs and metrics to assess impact. For example, it can identify health-check errors that don

Claude は MCP の Tasks と Elicitation に対応し始めました。Tasks は時間のかかるツール呼び出しをタスク ID とポーリングに分ける拡張で、Elicitation は処理の途中でユーザーに入力を求める仕組みです。この記事では 2 つの機能の基本を説明し、TypeScript SDK で実装した MCP サーバーを Claude Code CLI から呼び出した結果を紹介します。

東京都市大学大学院 情報データ科学研究科 情報データ科学専攻 ソーシャルシステムデザイン領域 博士前期課程1年の桒村駿輔です。このたび、LINEヤフーのインターンシップにセキュリティエンジニアとして参...

こんにちは。LINEヤフー株式会社 ショッピングSBUの新堂です。Yahoo!ショッピングでは、AIDD（AI Driven Development）の推進メンバーとともに開発プロセスの再設計に取り組...

There is technology to dynamically create custom social media cards (like this one!) — but what you put on it really depends.

はじめに!修正や追加等はコメントまたはGitHubで編集リクエストをお待ちしております。ダイニーで一番若いエンジニアのriya amemiya(21歳)です。今回は Array.prototype.lastIndexOf（以下 lastIndexOf）を、ElementsKindと探索値の型で分けて高速化しました。パッチはこちらです。https://chromium-review.googlesource.com/c/v8/v8/+/8255963よければ他のArray系メソッド高速化の記事もご覧ください。https://zenn.dev/dinii/article...

Customizable select isn’t just a prettier dropdown. Five before/after demos show how options can carry what people need to decide.

This release fixes pnpm install hanging on a cold store in workspaces that install Cargo crates, and pnpm pack shipping a file that files excludes by name.

This release adds a global --env-file flag, updates to a symlinked pnpm-lock.yaml, and pnpm setup --no-modify-path. It also fixes two security issues, in zstd decompression and in signing.

This release fixes a crash on registry responses with too many content encodings (GHSA-xjj6-f33q-929c) and sizes the install worker pool by the container's CPU quota. A repeat pnpm install now acts on more setting changes.

You can now deploy a plain root or on Vercel's when no other framework is detected. Vercel selects the Container preset, builds that file, and routes all traffic to the resulting image. To get started with containers on Vercel, add a Dockerfile:DockerfileContainerfileContainer runtimeWhen project detection matches another framework, such as Django, that framework still wins. To build use the or instead, run , or set the framework in :DockerfileContainerfilevercel project update --framework conta

Vercel Agent sessions in the dashboard and Slack now cost 67% less on average. We rebuilt how Agent manages context, reducing the tokens needed per session and improving prompt-cache reuse. These improvements are live and require no action. What changed: are unchanged. Paid sessions are billed at the model provider’s inference rates plus a Vercel Agent fee of $0.25 per million tokens. View usage and costs in the of your dashboard.Vercel Agent’s billing ratesAgent sectionRead more Updated Vercel

The AI SDK layer now accepts image inputs across every harness adapter.HarnessAgentPass images alongside text in the standard AI SDK message format: a array mixing and parts.content{ type: 'text' }{ type: 'file' }Image input is processed by the harnesses' underlying vision models and supported across all available adapters: Claude Code, Cline, Codex, Cursor, Deep Agents, fx, GitHub Copilot, Grok Build, OpenCode, Pi.Read the to get started. image inputs documentationHarnessAgentRead more

<p><strong><a href="https://openai.com/index/introducing-gpt-6-1-terra/">GPT-6.1 Terra</a></strong></p>It's always interesting to note which aspects of a new model are emphasized in the release announcement.</p><p>In the case of GPT-6.1 Terra, OpenAI went with visual reasoning and computer use:</p><blockquote><p>We’re introducing <strong>GPT-6.1 Terra</strong>, a fast, efficient model that combines detailed visual rea...

こんにちは、最近は「世界の窮地を救うため5年前の過去に戻って英雄を集める」ゲームをしている furuya です。 先日 Japan Datadog User Group（JDDUG） Meetup#22 に参加してきましたので学びをシェアします。 JDDUG とは Datadog を利用しているユーザーのためのユーザーによるコミュニティです。ページを見ていただくとわかるのですが、Datadog のロゴ（愛称「bits」がダッシュボードを口にくわえているデザイン）の「型抜きされた残りの部分」が JDDUG のロゴになっているデザインの遊び心が素敵です。Datadog のユーザー会として全国各地で…

Patch PHP2Shell (CVE-2026-109618 and CVE-2026-109619) with free Aikido Images for PHP 5.5 to 8.5. Stay on your current version with backported fixes.Category: Product Updates

Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.

A configuration mismatch in GLM 5.3 on Workers AI triggered an SGLang bug that exposed KV cache pages across requests. Here is how we addressed the issue.

Fixes for eMudhra and Brotli are out. Getting them everywhere they’re needed means tracking down bundled libraries, runtimes, and certificate stores.

You and your agents can now browse and search more than 1000 services available in without leaving your terminal. searches by name, alias, keyword, and description.Vercel Connect vercel connect discovertype: embedded-entry-inline id: H1F06IGrASdIU5HbPDOFMResults can be filtered by category, connection method (such as or ) or the product a service exposes. You can also limit results to services that forward webhook triggers. lists the category slugs you can filter by. Both commands support for sc

<blockquote cite="https://www.404media.co/chatgpt-keeps-telling-people-404-media-can-solve-their-tech-support-problems/"><p>Because big tech platforms essentially do not have customer support and make it impossible for their users to contact a human, many people experiencing run-of-the-mill tech problems have turned to ChatGPT. And, increasingly, ChatGPT is telling people that have normal tech support problems that they have discovered something journalistically notable and that 404...

, Scale AI's framework for testing agents against tasks and scoring their results, now runs on . The Vercel provider ships in AgentEnv 0.9.1334 and later, and runs the agent and its task environment in separate Sandboxes.AgentEnvVercel SandboxTry the to run an evaluation on Vercel Sandbox and inspect the task’s score and the agent’s recorded actions. After completing the , run this command from the cloned repository. It uses your existing Vercel CLI login:AgentEnv examplesetup guideReplace with

Safari 27.2 is here, refining Customizable Select, renaming a Grid Lanes property, and delivering 20 bug fixes across accessibility, media, CSS, and more.

<p><strong>Research:</strong> <a href="https://github.com/simonw/research/tree/main/webframe-evaluation#readme">webframe: evaluated as a scraper and a sandbox</a></p> <p><a href="https://github.com/tractordev/webframe">webframe</a> is a neat little project from Jeff Lindsay which lets you "run a web page like a program" - you point it at a URL or file and it executes it in a hidden headless web view and outputs <code>console.log()</...

Yes, I've got the keys to the castle, so to speak. And, even after 12 years of working on the site, I'll admit I'm a little overwhelmed and nervous about that.CSS-Tricks has a new owner! originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

記事は ics.media へアクセスしてご覧ください。

litellm 1.107.0 PyPI wheels and Docker images shipped a .pth credential stealer and an hourly remote code loader that exfiltrate to litellm.dev. Analysis, IOCs, and how to respond.

You can now create custom monitors to get alerts based on your results. Vercel Observability queryFor example, you can track signals such as AI Gateway costs, Core Web Vitals and other performance metrics, Workflow and external API failure rates, or Vercel Sandbox CPU time.Each monitor tracks a single metric, such as response time, or a ratio of two metrics, such as errors divided by total requests. Choose statistical anomaly detection or a fixed threshold, then configure the detection window, f

now lets you send input to running commands through standard input (stdin). Use it to exchange messages with stdio MCP servers such as , or send data to other command-line programs while they run.Vercel Sandboxagent-browserIn the TypeScript SDK, set and in . Use to send input and when you’re done:stdin: truedetached: truerunCommand()writeStdin()closeStdin()You can also set to a Node.js readable stream, such as . The SDK forwards the stream’s data and closes the command’s standard input when the

こんにちは。LINEリサーチプラットフォームで企画を担当している葛貫と、開発を担当している上土井です。2026年8月6日に福岡で開催された社内イベント「AIDD Workshop in Fukuoka...

みなさん初めまして、2026年に新卒で入社したモバイルエンジニアの銭と申します。2026年9月1日（火）〜9月3日（木）の3日間にわたって開催されたDroidKaigi 2026に、LINEヤフー株式...

Safari 27.1 では、iPhone Duo のような折りたたみ端末向けに Device Posture API と Viewport Segments API が機能フラグ付きで実装されました。Device Posture API で端末が折れているかを、Viewport Segments API で折り目によって分かれた画面の位置と大きさを取得できます。この記事では、2 つの API の仕組みと策定の経緯を説明し、折り目を避けるレイアウトの実装例を示します。

The in the dashboard now lets you choose which metric appears on each project card. Overview tabProject cards used to show a fixed Real Experience Score in the top right, but not everyone on your team watches the same signal. You can now swap that slot for whichever metric matters for that project. A security-sensitive project can show firewall activity, while a marketing site project shows traffic.Open the switcher in the top right of any project card. The menu shows the current value for each

from is now available on .GPT-6.1 TerraOpenAIAI GatewayGPT-6.1 Terra is a fast model for visual reasoning, computer use, and writing, and it improves on the previous Terra model in visual reasoning, factual accuracy, and coding. It suits high-volume work in documents and desktop apps, such as filling out forms, interpreting technical drawings, or entering invoice details into accounting software. OpenAI still recommends its larger GPT-6 models for the most complex coding tasks.The model accepts

pnpm installs on Vercel are now faster, reducing the time spent installing dependencies before your build.For Pro deployments with restored build cache, we observed 14% lower average install times with the optimization enabled.Vercel now reuses successful dependency verification across deployments. In the best case, when dependencies are unchanged and the previous verification can be reused, installs can complete in milliseconds.Before:type: embedded-entry-inline id: 4AGN257WKPLKtImRHWI6pRAfter:

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/seam-cutter">Seam Cutter</a></p> <p>I built this weird and very specific cropping tool - it lets you create a horizontal or vertical cut across an image, then slide the two sides relative to each other. Effectively it lets you crop out a section in the middle of an image.</p><p>I wanted this because I often use <a href="https://apps.apple.com/us/app/tailor-screenshot-stitc...

OpenAI の Decisions API は、入力に対する条件判定・分類・段階評価を返す API です。TypeScript から問い合わせを評価する例を使い、predicate・choice・score の使い分けについて紹介します。

Here are the Vim forks I know about:Neovim: “a Vim-based text editor engineered for extensibility and usability, to encourage new applications and contributions.”Vim Classic: “a stable, long-term support fork of the ubiquitous text editor, maintained without the assistance of generative AI tools.”EVi: “a hard-fork of Vim v9.1.0 (Jan 2024) before AI was used in the project.”MacVim: “a macOS version of the Vim text editor, providing a graphical user interface for Vim, while tightly integrating wit

Aikido Security's AI pentesting fits into the stack you already run. You can add AI pentesting on top to catch the complex logic flaws deterministic tools miss. Category: Guides & Best Practices

An attacker swapped the binaries on five OVHcloud CLI releases, stayed live for 94 minutes, and deleted the evidence. We rebuilt the exact attacker build, recovered the GlassWorm loader from an orphaned commit, and detonated the full chain in an isolated chamber. The replay shows that install.sh never exposed arm64 Linux, Homebrew was never a path in, and a single ovhcloud version command was enough to spot the malicious build.

MCP のクライアントがサーバー側の変化を知るには、ポーリングするか接続を張り続ける必要がありました。MCP Events はサーバーが購読者へイベントを通知するための実験的な拡張で、poll、push、webhook の 3 つの配信モードを定義しています。この記事では MCP Events の概要を説明したうえで、AI SDK の webhook モードの対応を使ってイベントの購読から受信、購読の更新と解除までを試します。

<p><strong>Release:</strong> <a href="https://github.com/simonw/battledrones/releases/tag/v14">battledrones v14: Compass Rose, a four player map</a></p> <p>I added four player online mode to <a href="https://simonwillison.net/2026/Oct/20/battledrones/">Battledrones</a> - previous maps were limited to two.</p><p>Here's the initial prompt I used: </p><blockquote><p><code>Add a new map for a four player battl...

A nice app architecture thought by Dominik: The Vertical Codebase. When component architecture came along, many started co-locating HTML/CSS/JS for a component, and it felt right. What if you take that one step further and co-locate based on the site’s conceptual areas? For example, the “dashboard” would have all the hooks, types, queries, etc., related […]

You can now view and manage your team's budget from the Vercel CLI. Run and you, or the scripts and agents you run, get back your current spend and the active budget.Spend Managementvercel budgetsThis is the same On-Demand Budget shown in your team's billing settings. Setting a budget does not stop usage on its own. The flag pauses production deployments of all projects when spend reaches 100%.--pauseYou can now see your budget alert history. Run for the full log, filtered with , , , and . A bar

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/quick-study-painter">Quick Study</a></p> <p>Prompt <a href="https://claude.ai/share/71adda96-193f-4f2a-97c0-454e08066afb">to Claude Opus 5.5 High</a>:</p><blockquote><p><code>Build an artifact where you open a photo and it rapidly (in a few seconds) paints a version of that photo using a canvas element and simulated paintbrush</code></p>&lt...

Socket uncovered secret-stealing workflows that ran in LiteLLM’s GitHub repository 11 days before the supply chain attack on PyPI and Docker.

now includes , a tool for sending bug reports, friction reports, and feature requests directly to the Vercel team from your agent or harness.Vercel MCPsubmit_feedbackAsk your agent to give feedback in plain language: Your assistant can attach structured context that describes the task, the expected behavior, and what went wrong:The tool requires sign-in, and it sends feedback only when you ask your agent to share it.Connect your agent to Vercel MCP and read the to get started.submit_feedback doc

The Brotli flaw behind Node2Shell (CVE-2026-111497) affects many libraries and applications using HTTP with Brotli or brotlicffi installed. Check your versions and upgrade to the fix.Category: Vulnerabilities & Threats

An agent working on production systems needs permission to act. A request like “fix this deployment” doesn’t tell you upfront which actions it will take or what access it will need. Grant agents broad access and a mistake can affect unrelated resources. Ask for approval at every step and the user has to approve individual actions before they know how the agent intends to solve the problem. Repeated prompts can turn that review into a habit of clicking approve. starts by investigating the problem

<p><strong><a href="https://www.kimi.ai/blog/kimi-k3-1-pro">Introducing Kimi K3.1 Pro</a></strong></p>Kimi K3.1 Pro landed on the Kimi API today - it's not yet open weights, but Moonshot promise "Full model weights will be released by Nov 4, 2026".</p><p>They're also offering a "Highspeed" version that's 2-3x faster, at twice the price (except for input token cache hits, which are priced the same).</p><p>The <a href="https://platfor...

Deployment summaries now show the size of the build cache each deployment saved and how close it is to the limit for its . The same information is in the CLI with on version 65.1.0 or newer, and in the .build machineget-deployment REST API endpointvercel inspectUploading the build cache is billable build time, and a cache that goes over the limit is discarded, so the next build starts without one. This is on by default on all plans for deployments built on or after October 21. See the in the doc

Naive byte-range caching can waste gigabytes of origin bandwidth on small requests. We rebuilt our cache architecture in Pingora to coordinate partial fetches automatically, cutting R2 p99 latency in half.

Cloudflare's new post-quantum GeoKey Manager protects geographically fenced decryption keys from harvest now, decrypt later attacks. Learn how we redesigned our cryptography stack to support strict data sovereignty in a post-quantum world.

Today iPhone Duo arrives, and with it, Safari 27.1.

can now create a separate for each agent or task. When you create a Stripe connector, you can now choose Managed API Key as the connection method. Vercel Connectrestricted Stripe API keyVercel creates the key in your Stripe account, limited to the permissions you pick. The existing MCP and bring-your-own API key methods are unchanged.type: embedded-entry-inline id: 3rOuKp0F4Nk80dMYJ5QX6UMost apps and agents run on Stripe’s default secret key, which has full access to the account. With per-agent

Cloudflare introduces tsrs, a Rust port of TypeScript’s compiler promising faster checks and lower memory use, with the TypeScript team’s help.

A closer look at accordion icons, why split menus are harmful, and why it’s better not to have icons and text labels link to different actions. Plus, why the caret is the safest icon choice. You’ll find more [useful guides](https://www.smashingmagazine.com/category/guides/) and [online workshops](https://smashingconf.com/online-workshops) here on Smashing Magazine, so make sure to browse and explore.

Chrome DevTools MCP で AI エージェントはブラウザを操作できますが、DOM からはどのコンポーネントが描画したのか、なぜ遅いのかがわかりません。react-devtools-cdt-mcp はページで import すると、コンポーネントツリーやレンダリング時間を調べるツールを Chrome DevTools MCP に登録する実験的なライブラリです。仕組みとセットアップ、各ツールの出力、Claude Code による調査を試します。

vlt v1.6.0 adds global installs with vlt install -g, links the workspaces that npm monorepos reference by plain ranges, and fixes a round of CLI bugs.

Our benchmarks got a fresh look, better ways to explore performance, and a few new capabilities for agents. Here are some of our favourite improvements.

Interfaze on Vercel50 million requests a month Backend running on Fluid computeMultiple model providers behind one fallback layer with AI Gateway builds models for deterministic work that general-purpose LLMs handle poorly: document processing, OCR, object detection, web scraping, speech to text, and classification.InterfazeAs founder Yoeven Khemlani puts it, "Most models aren't deterministic by nature. That's fine when you're drafting an essay. But when a hospital or a legal team needs to proce

The now includes , which sends bugs, friction reports, and feature requests to the Vercel team from your terminal.Vercel CLIvercel feedbackCoding agents can also send feedback when they run into issues. Use with or to include structured context as pairs. Repeat the flag to describe the task, expected behavior, and what went wrong.vercel feedback-f--fieldkey=valueUpdate to the latest Vercel CLI and read the to get started. documentationvercel feedbackRead more

入力欄に日本語で文章を書いてから、末尾に...を入力すると、その場で英語に翻訳して置き換えるmacOSアプリ Quick Input Translator を作りました。GitHub: azu/quick-input-translator翻訳にはmacOSのTranslation frameworkを使っていて、翻訳はMac上（オンデバイス）で行われます。外部の翻訳APIを呼び出さないので、APIキーは不要で、言語モデルを一度ダウンロードしておけばオフラインでも素早く翻訳できます。インストール動作環境Apple SiliconのMac + macOS 26以降次のコマンドでインストールできます。notarizationはしてないので自己判断でお願いします。curl -fL https://github.com/azu/quick-input-translator/releases/latest/download/quick-input-translator-macos-arm64.zip -o "$TMPDIR/quick-input-translator.zip" &&amp...

from is now available on , along with , a faster version for interactive use.Kimi K3.1 ProMoonshot AIAI GatewayKimi K3.1 Pro HighspeedK3.1 Pro is the first model in Moonshot's K3.1 series. It builds on with improvements in coding, 3D modeling, financial analysis, and agentic tasks, and keeps the 1M-token context window and image input.Kimi K3For coding, K3.1 Pro handles work ranging from small fixes in an existing codebase to building a full project, including long agent runs with many steps. It

Every Pro team can claim a free domain for one year. That offer now includes , , , , , , , and , bringing the eligible TLDs to sixteen..co.studio.company.info.pro.live.digital.agencyThe offer still covers one domain per team, and premium domains are not eligible. After the first year, your domain will at the regular price shown at checkout when you claim it.renew automaticallyClaim yours at , and see the for the full list of eligible TLDs and terms.vercel.com/domainsfree domain FAQRead more

Safari Technology Preview Release 255 is now available for download for macOS Golden Gate and macOS Tahoe.

Compromised eMudhra intermediate CA keys put Python dependency downloads at risk. Here are the affected tools, verified certificate-trust results, and remediation steps for pip, uv, virtual environments, and CI/CD images.

<p><strong><a href="https://www.youtube.com/watch?v=hKO4pQtIXow">DE STAAT - FREEDOM (Official Music Video)</a></strong></p>OK well this is a first for me... at <a href="https://www.youtube.com/watch?v=hKO4pQtIXow&t=44s">00:44</a> in this new music video by Dutch alternative rock band <a href="https://en.wikipedia.org/wiki/De_Staat">De Staat</a>:</p><p><video src="https://static.simonwillison.net/static/2026/freed...

An iframe with srcdoc feels like a safe place to render HTML a model wrote. It isn't. Three tests show how the preview can read your page, escape the frame, and phone home, and four layers of protection close each hole.

Node.js CVE-2026-111497 (Node2Shell) is a Brotli flaw that can allow remote code execution. See who is affected, patched versions and the fix.Category: Vulnerabilities & Threats

<p><strong><a href="https://www.anthropic.com/news/donating-agent-skills-to-the-agentic-ai-foundation">Donating Agent Skills to the Agentic AI Foundation</a></strong></p>News today from Anthropic:</p><blockquote><p>We’re committed to keeping Agent Skills open, community-driven, and vendor-neutral. Today, we are donating the standard to the Agentic AI Foundation (AAIF) under the Linux Foundation, <a href="https://www.anthropic.com/news/don...

As Cybersecurity Awareness Month continues, the GitHub Bug Bounty team spotlights @r31n, diving into their research approach, favorite bug classes, and advice for aspiring hackers.The post How bug bounty sharpens one researcher’s security skills appeared first on The GitHub Blog.