There's a lot of nuance to the <dialog> element, a seemingly little piece of web architecture. I've got some notes from digging into it.Using and Styling the Dialog Element originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

Cloudflare is shifting bot mitigation from point-in-time Risk assessment to continuous Trust evaluation. Learn how new good and bad behaviors from bots and agents are assessed by our systems, including BotBase and Precursor — and try out our Precursor Trace simulation to see how your own cursor movements would be assessed as human or bot.

Cloudflare Radar Researcher is a new AI-powered tool that lets you explore global Internet trends and traffic data using plain language. Built entirely on Cloudflare's Developer Platform, it turns natural language queries into real, interactive charts.

We are launching updated community programs, including Cloudflare Ambassadors and Community Engineers, backed by $1M in open-source funding. Learn how we are supporting maintainers and scaling our developer community.

Cloudflare is unifying AI Gateway and Workers AI into a single control plane, giving developers observability, billing, and dynamic routing across both managed GPUs and external providers. Learn how unified bindings and model-first routing simplify building resilient AI applications.

The gap between “you need a library for this” and “the browser does this” keeps closing. A practical guide to auditing your dependencies and finding what the web platform can now handle for you.

Your ‘App’ could have been a webpage (so I fixed it for you…)A thoroughly enjoyable read!SmoothCSSComplete CSS alumni, Rob McCormick, has built a really nice looking design system/CSS framework/UI kit.The CSS lh unitAn extremely useful unit for vertical relative sizing, explained by one of the best in the business at explaining CSS stuff.Astro LilyPondWant to render musical notation in Astro? Ky Decker has got you covered.They don’t make ’em like Sublime Text anymoreYou just can't beat Sublime t

Supabase is now a connector on Perplexity Computer. Query your Postgres data, look up users, and invoke Edge Functions from a Perplexity chat.

はじめに こんにちは。グループIT推進本部の鷹雄です。 Codex Ambassadorとして、社内 ...

id:mizdra は Git の commit 署名をしていて、その署名鍵を 1Password で管理している。commit をする度に 1Password による生体認証を求められるが、その分安全に署名鍵を扱える。 今まではそれで不満は無かったのだけど、Coding Agent を使うようになってからというもの、この仕組みが足かせになっている。具体的には、Coding Agent にタスクを投げて人間が他のことをしている際に commit が試行され、人間が時間内に生体認証できずタイムアウトする、というもの。これのせいで、「人間はこれから寝るからこれやっておいて！」と投げたタスクが途中で…

New subscriptions now include a domain free for the first year. The offer covers six TLDs:Pro.online.site.space.store.tech.websiteEach team has 30 days after subscribing to claim one domain, either at checkout or later from the in the dashboard.domain searchAfter the first year, your domain will at the regular price shown at checkout when you claim it.renew automaticallySee the for the full terms.free domain FAQRead more

I had fun with the post about making a link to a random post in just HTML/CSS the other day. But I was almost certainly over-thinking it on the original. Using random() was kind of the point, so we can stick with that.

Go beyond chat in the GitHub Copilot app with these slash commands. They'll help you plan, collaborate, automate, and customize your dev workflow.The post A guide to slash commands in the GitHub Copilot app appeared first on The GitHub Blog.

<p><strong>Release:</strong> <a href="https://github.com/simonw/datasette/releases/tag/1.0a38">datasette 1.0a38</a></p> <blockquote><p>This release fixes a <strong>SQL injection</strong> security issue that affects Datasette instances that serve a <strong>mixture of public and private tables</strong> in the same database, with access configured using the <a href="https://docs.datasette.io/en/latest/authentication.html"&g...

<p><strong>Release:</strong> <a href="https://github.com/simonw/datasette/releases/tag/0.65.3">datasette 0.65.3</a></p> <p>Back-ported the SQL Injection security fix from <a href="https://simonwillison.net/2026/Aug/6/datasette/">1.0a38</a>.</p> <p>Tags: <a href="https://simonwillison.net/tags/datasette">datasette</a></p>

<p><strong><a href="https://writethatblog.substack.com/p/simon-willison-on-technical-blogging">Simon Willison on Technical Blogging</a></strong></p>I was interviewed by Cynthia Dunlop for her "Write that blog!" series back in January, but I just realized I never linked to the interview from my own blog!</p><p>It includes my answers to the following questions:</p><ul><li>Why did you start blogging – and why do you continue?</li...

GitHub malware advisories no longer stop at npm. Here's how we wired OpenSSF's malicious-packages data into the Advisory Database, and why we built the pipeline paranoid.The post How we took malware advisories beyond npm appeared first on The GitHub Blog.

A few notes and takeaways from the 2026 State of CSS survey results, including a nice CSS-Tricks cameo!2026 State of CSS, Devs Surveys originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

AI Search makes search easier than ever, with no Cloudflare primitives to stitch together. Point it at your data to create a search for your own files and websites. We're also sharing a preview of our new pricing model.

The next version of MCP has a rewritten, stateless core that just works on Workers. We cover upgrades to the protocol, the new feature lifecycle and SDK migration path, and hear from early adopters already running it in production.

More than half of requests now come from machines, not people. Agent Readiness shows how well agents can discover and read your site, while Answer Engine Optimization tracks how often AI assistants recommend you.

Agents are a new kind of visitor. They don't render CSS or click ads, but they have a paying human on the other end. Block them and you block your customer. We're building the open tools and protocols so publishers and agents can cooperate and not collide.

We should be giving all agents tools that excel at what’s important for an AI model. Kitesurf is Cloudflare’s new stateless, highly scalable, and cost-effective web browser that runs entirely on top of Workers and was designed specifically for the Agentic Cloud.

Today we're launching a developer preview of WebMCP on Cloudflare. With one switch, any site becomes usable by browser AI agents — no new APIs, no origin changes — while the human stays in control and creators keep their traffic.

Highlighting in CSS has been beneficial for applying a highlight on specific text or text fragments during user selection, emphasizing a piece of information on a website, or visually emphasizing a text for the sake of branding. Particularly, this is pretty helpful when users want to scan your document from top to bottom because the majority of people don’t read your document initially; they scan.On the web, text highlights are a good way to lay emphasis on text fragments through good ol’ CSS. F

The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

<p><strong><a href="https://www.cnn.com/2026/08/05/tech/meta-ai-hacking">An AI model from Meta also hacked another company during testing</a></strong></p>Stop me if you've <a href="https://simonwillison.net/tags/accidental-cyberattacks/">heard this one before</a>:</p><blockquote><p>An AI model from the parent company of Facebook and Instagram hacked into another company’s systems during cybersecurity testing, a spokesperson confi...

Astro 7.2 adds experimental incremental static builds, an option to opt out of session support, background mode for astro preview, and relative logger entrypoints.

Today, Agent Plugins 1.0.0 is publicly available. is an open, vendor-neutral standard for plugins that extend AI agents. Agent Plugins provide reusable instructions and resources for AI agents. connect agents to tools and services. Both can be reused across clients, but clients often package and discover them differently.Agent SkillsMCP serversAgent Plugins gives compatible clients a common format: a directory with a manifest and fixed locations for its components. The format is intentionally sm

from ByteDance is now available on AI Gateway. It generates up to 30 seconds in a single clip, holding camera movement and continuity without stitching shots together in post. Short clips can also be extended with character, scene, and camera movement carried over.Seedance 2.5Seedance 2.5 supports text, video, image, and audio as inputs in the same request, following a subject's appearance from one asset and the motion or camera work from another. On a finished video it edits locally, swapping b

When you install a integration from the Vercel CLI, it now also installs that provider's agent skills from , so your agents know how to use it: Vercel Marketplaceskills.shThis happens automatically for any provider that publishes skills.You can also find integrations without leaving the terminal:Update to the latest Vercel CLI with , then read the to get started.npm i -g vercel@latestintegration documentationRead more browses available providers.vercel integration discover lists all the Marketpl

from ANT Group is now on AI Gateway, free to use till 8:00am PT on 8/14. Ling 3.0 Tiny takes the free slot from .Ling 3.0 TinyLing 3.0 FlashLing 3.0 Tiny is a MOE model with 7.9B total parameters and about 1.3B active per token, a 256K token context window, and up to 32K output tokens. The model is built for responsive agents, instruction following, and multi-turn conversation, with native function calling and prompt caching.To use Ling 3.0 Tiny, set to in the . On August 14th, the new model nam

Agent Plugins 1.0.0 is now available. It is an open, vendor-neutral standard for packaging Agent Skills and MCP servers into portable plugins. Compatible agent clients can discover and load them.Agent Plugins defines a common format: a root manifest, plus fixed locations for portable components. Each client keeps control of installation, distribution, policy, user experience, and client-specific capabilities.plugin.jsonAt launch, Agent Plugins is supported across the following clients:Read the ,

You can build human-in-the-loop approvals with Chat SDK through the new subpath. One call posts a card with Approve and Deny buttons and suspends a workflow until someone decides.chat/workflowrequestApprovalWorkflow SDKThe wait can last seconds or days and survives deploys and restarts. You don't need an approvals table, an handler, or a polling loop:onActionStart the workflow from any handler, and instances serialize across the workflow boundary automatically. The card handles the rest:ThreadGe

<p><strong><a href="https://research.meta.ai/blog/introducing-muse-code-and-muse-spark-1-2">Introducing Muse Code and Muse Spark 1.2</a></strong></p>Yet more evidence that the most important characteristic of any model these days is long-sequence agentic tool calling. Meta shipped their own coding agent as part of getting that to work!</p><blockquote><p>Muse Spark 1.2 is a coding-focused update to Muse Spark 1.1, with improvements in code ge...

<p><strong><a href="https://openai.com/index/third-party-cyber-evaluations-involving-openai-models/">Third-party cyber evaluations involving OpenAI models</a></strong></p>And <em>another one</em>. I had to create a <a href="https://simonwillison.net/tags/accidental-cyberattacks/">accidental-cyberattacks tag</a> to keep track of them all!</p><p>This post from OpenAI covers both the UK AI Safety Institute attack (see <a hr...

<p><strong><a href="https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing">Incident Report: unsanctioned agent behaviour during cyber testing</a></strong></p>It happened <em>again</em>. This time it was the UK government's AI Security Institute who accidentally attacked other companies while running an evaluation with models with the safety filters turned off. From <a href="https://cdn.prod.website-files...

We're honored to announce that Cloudflare is the only vendor that has been recognized as a Visionary in both the 2026 Gartner® Magic Quadrant™ for SASE Platforms and the 2026 Gartner® Magic Quadrant™ for Security Service Edge reports.

カミナシのID管理基盤を開発しているmanaty（@manaty226）です。カミナシ ID管理基盤におけるログストレージへのAmazon S3 Tables（以下、S3 Tables）利用について、7月28日に行われたAWS AI Ready Data Platform Dayで発表しました。一日を通して非常に学びになるイベントだったので共有したいと思います。

<p>Back in 2022 <a href="https://twitter.com/simonw/status/1555626060384911360">I tweeted</a> screenshots of a game concept generated by GPT-3 and some concept "art" created using DALL-E. Today, on the fourth anniversary of that tweet, I decided to see if Claude Fable 5 (running in <a href="https://code.claude.com/docs/en/claude-code-on-the-web">Claude Code for web</a>) could build the entire game from the content of that tweet. It did a pretty good job of it!</...

During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Three summer disclosures documented AI agents attacking real organizations with no human intent in the chain. Incident response has no box for this yet.Category: News

You can now set a project's avatar from its settings in the Vercel dashboard. Until now, Vercel set it automatically, using the favicon from the project's production deployment. That's still the default if you haven't set one.The avatar renders across the dashboard and on Vercel bot comments in GitHub. Microfrontend projects that share one favicon can now get distinct avatars, and backend projects with no favicon to detect can set one explicitly.You can change a project's avatar from its in the

Buying a domain on Vercel now takes you to a setup page that tracks registration live, with direct paths to deploy a new project, connect an existing one, proxy or redirect a site you already run, or set up email.Registration can take a few minutes. Each setup action unlocks as soon as the domain is ready. If registration fails, the page shows what went wrong and the status of your refund. opens project creation with the domain preselected. Connect a Git repository, prompt with v0, or start from

Includes background-clip for masking backgrounds, vertical-align for aligning elements, box-decoration-mode for consistent edge styling, letter-spacing for spacing control, and text-combine-upright for vertical text layouts.

記事は ics.media へアクセスしてご覧ください。

The Agent Access Model proposes a new architecture to secure task-scoped agents using strict identity brokering, continuous mediation, and stateful trust.

We built Cloudflare OS to equip our teams to safely rethink how they get work done with AI. The platform brings together the best of our technologies, from our Compute primitives to our Zero Trust suite. This post walks through our journey to give our users the best AI tools available.

Cloudflare OS is an open-source platform that lets everyone in your company build apps, automate work, and safely access internal systems, shaped around what your organization knows and how it operates

At Cloudflare, we knew we could not depend on every employee to configure every agent perfectly or watch every tool call. Before expanding write access across our own internal MCP servers, we built WriteGuard. We are now bringing those controls to Cloudflare MCP server portals through a private beta.

Identity-aware AI Gateway is now in open beta. User Insights turns that traffic into a behavioral baseline for every person and agent, and flags insider risk the moment it appears.

Postgres Changes subscriptions can now combine filters with AND, match on more operators, and select only the columns you need in the payload.

Continuous AI pentesting for teams that can't use the cloud. The Aikido Machine keeps models, code, and results entirely inside your network.Category: Product & Company Updates

AI Gateway now produces an OpenTelemetry trace for every request. Pro and Enterprise teams can send these traces through Vercel Drains to any OTLP/HTTP-compatible endpoint, including native integrations for Braintrust, Dash0, Kubiks, Sentry, and Statsig.Each trace shows the full request lifecycle, including:Trace Drains do not include prompt or completion content. Sampling controls let you choose how much traffic to export to each drain.AI Gateway traces cost $0.05 per 1,000 traces delivered to

Today we're introducing the new : programmatic, headless access to v0's app-building agent. Send a prompt and generates an app, starts a dev server in a , and gives you a preview URL you can embed in your own UI.v0 APIv0Vercel SandboxEach chat is an isolated workspace for one app, where v0 can read, edit, and run the files. Follow-up messages continue from the current state. v0 verifies the code running in the Sandbox, so it can catch and fix errors in your app in real time.The new API is now ge

AI Gateway is available on .AWS MarketplaceTeams can procure AI Gateway through their existing AWS account, consolidating inference spend onto their AWS bill and streamlining procurement. Purchases are available as private offers with annual contract terms, plus usage-based pricing beyond the contract. gives you one API to hundreds of models through a single endpoint. Reliability, cost controls, and governance, including automatic fallbacks, regional inference, and Zero Data Retention, are built

Chrome 151 and web-vitals v6 bring native SPA measurement into production, while new browser controls reshape device and third-party governance.

はじめにNew Relic の Logs UI には，任意の検索クエリで絞り込んだ状態を URL から直接開く方法 があります。公式には案内されていませんが， Nerdlet の URL State を組み立てれば，外部システムから特定のログへ誘導できます。とあるプロジェクトでは， GitHub Actions の workflow_dispatch から ECS Fargate のバッチタスクを起動しています。実行後にタスクが吐いたログを追えるよう， Job Summary に 今回起動したタスクのログだけに絞り込んだ New Relic Logs UI へのリンク を出してい...

Tailwind CSS has become a very popular CSS framework, and it can speed up development. But using it without proper caution can add mayhem to your code. Learn best practices to avoid getting swept away!

Our lockfile implementation gets a major overhaul in this release, alongside concurrency-safe

Resource usage is now available to every Nx Cloud organization, on by default for new ones.

from Meta is now available on AI Gateway. It is a coding-focused update to the previous Muse Spark model. While keeping its general capabilities, 1.2 ships with improvements in code generation, complex debugging, codebase understanding, and end-to-end developer workflows.Muse Spark 1.2The model is built for long-horizon work like generating whole repositories, building out large projects end to end, and sustaining iterative loops where it writes, compiles, profiles, and improves code over many r

We've increased the default quotas for on Pro and Enterprise plans:Vercel SandboxThe higher vCPU allocation rate is possible thanks to a new dynamic quota: instead of a fixed limit, the allowed rate now ramps with sustained usage: it starts at 150 vCPUs per minute and increases by 500 vCPUs per minute as you continue creating sandboxes, up to 5,000 vCPUs per minute The new quotas apply automatically to all Pro and Enterprise teams. If you need higher quotas, .contact salesLearn more about and .S

You can now search for and purchase domains from the .Vercel dashboardOpen the domain search panel from the Buy button in or the + button on the project overview.domain settingsNameservers are configured automatically for your project, so there are no DNS records to set.Read the to get started.working with domains documentationRead more

You can now measure the time between any two steps in the trace viewer for and the .Vercel WorkflowsWorkflow SDKSelect a step, hold on macOS or on Windows and Linux, then hover another step to see a measurement line between them:OptionAltWith no step selected, hold the modifier to see the gaps across the timeline, now drawn with the same measurement line.This can be useful for spotting delayed starts and queue waits when a run takes longer than its steps account for.To get started, open a workfl

All firewall features are now available on the Hobby plan.Vercel SandboxThis brings the same network isolation that protects production workloads to the free tier, giving Hobby builders control over exactly what leaves the sandbox while keeping secrets out of the code entirely. Because the firewall attaches secrets to outbound requests itself, sandboxed code can call authenticated services like without ever seeing the token.AI GatewayDefine , , or custom network policies with domain and IP-based

<p>I released <a href="https://llm.datasette.io/en/stable/changelog.html#v0-32">LLM 0.32</a> this morning, the most significant new version of LLM since the initial launch of the project. The new version includes support for visible reasoning traces, server-side provider tools, redesigned content-addressable SQLite logs, new models, and new features enabled by the OpenAI Responses API. I also released a new version of the <a href="https://github.com/simonw/llm-anthropic"&gt...

now supports . Each Devin session executes in its own isolated Sandbox microVM, with no local Outpost worker to keep online.Vercel SandboxDevin OutpostsThe Devin control plane stays with Cognition, where the agent loop handles inference and planning. Session orchestration and command execution run in your Vercel project, and a manages each session's lifecycle.durable workflowWith the integration, teams can:To get started, and approve the connection as a Devin administrator. Encrypted credentials

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-anthropic/releases/tag/0.26">llm-anthropic 0.26</a></p> <p>Includes new features enabled by <a href="https://simonwillison.net/2026/Aug/4/new-release-of-llm/">LLM 0.32</a>:</p><blockquote><ul><li>New models: <code>claude-fable-5</code>, <code>claude-sonnet-5</code>, and <code>claude-opus-5</code>. <a href="https:...

ChainDrop npm worm: 444 packages and 2,212 versions poisoned, starting with [email protected]. Payload analysis, affected package list, IOCs, and remediation steps.

<p><strong><a href="https://github.com/PipeNetwork/minimax-h3-mlx">PipeNetwork/minimax-h3-mlx</a></strong></p>MiniMax released <a href="https://huggingface.co/MiniMaxAI/MiniMax-H3">MiniMax-H3</a> two days ago - they describe it as a "a general-purpose, omni-modal generative system", which in practice means it accepts text, images, audio and video and can use them to generate up to 15 second video clips with audio included.</p><p>This P...

Learn how to build tools to simplify how you work—without writing a single line of code.The post How the GitHub legal team used Copilot CLI to streamline their workflows appeared first on The GitHub Blog.

Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.

I’m just learning that the Web Platform Status website offers email alerts when features of your choosing change in support. For instance, I just signed up to hear exactly when Customizable <select> becomes Baseline Newly Available.

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm/releases/tag/0.32">llm 0.32</a></p> <p>See <a href="https://simonwillison.net/2026/Aug/4/new-release-of-llm/">my detailed blog post about this release</a>.</p> <p>Tags: <a href="https://simonwillison.net/tags/llm">llm</a></p>

Instead of one huge, un-reviewable pull request, teach coding agents to decompose work into a clean, ordered stack with GitHub stacked pull requests.The post Turn one giant AI-generated pull request to a reviewable stack appeared first on The GitHub Blog.

Agents can write code faster than teams can review, deploy, and maintain it. Today we’re introducing the Agent Development Lifecycle and the Cloudflare primitives that underpin it

Cloudflare Wallets will provide AI agents with native payments and verifiable identity on the web. Using the x402 protocol, agents can autonomously purchase APIs and content within clear safety guardrails.

Learn how to build customizable, sandboxed CI/CD pipelines natively on Cloudflare using Workflows, Artifacts, and the CI SDK. We walk through replacing complex YAML configurations with TypeScript workflow steps and self-healing AI agents.

We created the Cloudflare Codex, a governed body of engineering standards that AI agents consume across the development lifecycle. By pairing structured RFCs with agentic reviews, teams automatically enforce consistency across code, specs, and incident reports.

How I turned Garmin activity data into self-hosted Grafana dashboards and connected an AI agent through MCP to act as my personal training assistant.

Mini Shai-Hulud malware was injected into keyv and eight related npm packages on August 4, 2026 after an attacker compromised the maintainer's GitHub accountCategory: Vulnerabilities & Threats

Popular npm packages keyv and cacheable compromised.

Stable client release and general availability of hosted JavaScript registries & ecosystem mirrors.

はじめに こんにちは、同志社大学理工学部情報システムデザイン学科4年生の金谷一輝です。 2026年7 ...

Yesterday the Next.js team announced the release of , with leaner prefetching, immutable static assets, and instant navigations. As part of this release, we worked with the Next.js team to fully support 16.3 on Vercel, including better performance and additional observability. Applications that have upgraded have seen:Next.js 16.3Next.js 16.3 ships leaner prefetching and enables immutable static assets by default. Supporting both meant changing the platform too, in how it caches static assets, r

You can now bundle multiple public and private agent skills into a shareable pack on .skills.shPacks are published to the registry, each with its own URL. Share it with anyone, or with your Vercel organization to standardize the skills used across your team’s projects.skills.shCreate a pack from community skills on , your own local folders/zips, or public and private GitHub repositories. Install any pack with one command:skills.shRun to update a pack to its latest version.npx skills updateExplor

Deploys are now up to 33% faster for apps using (ISR). The more prerendered pages you have, the more you're likely to save.Incremental Static RegenerationISR combines the speed of static generation with the flexibility of dynamic rendering, letting sites update content without full rebuilds. Every ISR page has routing metadata that ships alongside it. Previously, when that metadata grew too large, it split into a separate upload, adding work to every deploy. Now it always ships in a single uploa

Your eve agent can now navigate the web like a human with .agent-browserThe extension gives any agent a full set of browser tools: navigate pages, read content, click, fill forms, take screenshots, and inspect console and network activity. Everything runs inside the agent's sandbox.@agent-browser/eveeveInstall the extension:Then mount it under :agent/extensions/Your agent gets namespaced tools like , , , , and . Snapshot refs such as become selectors, so the agent can inspect a page, then act on

はじめにLINE Developersから利用できるLIFF（LINE Front-end Framework）を活用すれば、LINEアプリのユーザーを対象に、独自のサービススペースを開設できます。L...

こんにちは！PR TIMES 開発本部のエンジニア、トゥ（codyzard）です。 今回は、AWS 上で動くバッチから利用している複数の Google API の認証を、Service Account キーから WIF（ […]

<blockquote cite="https://yegge.ai/essays/the-shape-of-things-to-come/"><p><a href="https://yegge.ai/gastown.html">Gas Town</a> was intended to be reusable, but I only ever wound up using it to build itself. Gas Town fell apart at the seams with Opus 4.7. Up through 4.6 it was working brilliantly. With 4.7 we saw the introduction of the "just two more things" tic, which prevented Opus from ever converging on being ready to do real work—it always wanted to fiddle with Gas...

We designed and shipped a fresh AppSignal homepage in code, then validated it in an A/B test with a 14% lift in activated users.

is 90% off on AI Gateway when you route to Novita. The discount is available to Vercel Pro customers through August 11.DeepSeek v4 FlashTo get the discounted rate, set the to or and put Novita first with the option:modeldeepseek/deepseek-v4-flashdeepseek/deepseek-v4-flash-0731orderIf Novita can't serve the request, it falls back to other providers at the standard rate. After August 11, the model stays available at standard rates with no markup. in the AI Gateway section of your dashboard, or try

<p><strong><a href="https://gruhn.me/blog/2026-08-03/">Don't be a meat proxy</a></strong></p>Niklas Gruhn coins an excellent new term - <strong>meat proxy</strong> - for people who blindly copy and paste the output of AI systems to their peers.</p><blockquote><p>By all means, prompt AI. But don't just relay the output. Read it, understand it, validate it, and then write a response in your own words (a decent certificate ...

Vercel WAF for Blob is now generally available and supported for production use on all plans. If you protected a store , nothing has changed: your rules and setup carry over exactly as they are.during the beta protects a Blob store with , the same kind you use to guard your deployments. Rules that match on properties like IP address, country, and path can deny, challenge, or rate limit requests to your stored objects. This requires no changes to your code, your blob URLs, or how you use .Vercel

<blockquote cite="https://blog.exe.dev/devtools-must-be-open-source"><p><code>Set up a nightly cron job that executes the prompt: fetch upstream changes to the <software> and rebase all local changes on top of upstream. Check that the software works as intended and replace the current version.</code></p></blockquote><p class="cite">— <a href="https://blog.exe.dev/devtools-must-be-open-source">David Crawshaw's promp...

Today, with CSS gap decorations fully supported in Chrome and Edge, starting with version 149, you can now very easily style gaps, and with a lot of control.Gap Decorations Are Now Available, Here’s What’s New originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

<p><a href="https://news.ycombinator.com/item?id=49156111#49156719">My comment</a> on <a href="https://news.ycombinator.com/item?id=49156111">Devtools must be open source (exe.dev)</a> — Hacker News.</p><p>One of the arguments for open source software for end-users has always been the freedom to examine and modify how that software works.</p><p>The reality for most people - even expert programmers - has been that the freedom is mor...

You normally don't think of images as overflowing themselves, nor can you put anything else inside to make it overflow, but actually...

First-hand lessons from integrating CKEditor 5 into Rails, Phoenix LiveView, Livewire, and Blazor. Why MPA architectures are winning for enterprise teams.

An AI agent published a malicious package to PyPI and 15 systems ran it within an hour. What Anthropic's incident means for supply chain security.

本記事は、Aurora MySQLの安全なバックアップ設計についてまとめている記事になります なにか ...

<p><strong>Release:</strong> <a href="https://github.com/simonw/condense-json/releases/tag/1.1">condense-json 1.1</a></p> <p>After shipping <a href="https://simonwillison.net/2026/Aug/2/condense-json/">condense-json 1.0</a> I started integrating it into LLM, and found there were some desirable new features already:</p><blockquote><ul><li>Replacements object can now include values other than strings. These will be iden...

Factory on VercelNon-technical teams were bottlenecked on engineeringDroids hit Vercel's APIs to build and deploy autonomouslyGoing self-serve exposed Factory's backend to a new category of threatObservability and WAF handle protection at the network levelOne billion backend API requests served daily 350ms p95 response timeScaled backend, internal tooling, and security without a dedicated infrastructure teamAPI routes handle the customer-facing API, which launched in its own section of their Nex

こんにちは！2026年新卒エンジニアの小尾（@obizip）と森澤（@ggg_glasspo）です。 2026年7月20日に開催されたPHP Conference Japan 2026に、PR TIMESはゴールドスポン […]

Check out the following CSS animations (touch to play):these are CSS-based graphics and animations, you probably need to visit the website to see If you wanted to implement complex procedural animations (like physics) on the web, you’d probably go for JS-based requestAnimationFrame update-loop and animate each frame. But everyone knows that CSS animations are much smoother than janky frame-based JS animations.Native web animations run outside the main thread, so things like heavy JS computations

pnpm 11.20 fixes a package-substitution risk in projects that install from more than one registry alias, stops empty proxy settings from failing installs, hardens pnpm rebuild against a malicious lockfile, and speeds up dependency resolution.

Learn how to detect hidden network performance problems before they impact your users. This guide explains Microsoft's new Network Efficiency Guardrails, how they use Document Policy and the Reporting API to detect inefficient resource loading, how to enable them in Microsoft Edge, and how to configure them in a Nuxt 4 application.

now lets you share a repository with other Vercel teams to grant read access to its images.Vercel Container RegistrySharing is read-only and covers the whole repository. Recipients can pull and use every image, but cannot push, delete, or re-share. You can also share a repository with your own team. Each repository can be shared with up to 100 teams. Share from the project dashboard under Images → repository → Settings → Repository Sharing, or with the Vercel CLI:# Share a repository with a team

<p><strong>Release:</strong> <a href="https://github.com/simonw/condense-json/releases/tag/1.0">condense-json 1.0</a></p> <p>I'm trying to get braver at releasing 1.0 versions. This little library is a year and a half old now - I've applied some sensible and non-disruptive fixes and shipped the big 1.0 for it.</p><p>Here's an example of what it can do, lifted from the README:</p><div class="highlight highlight-source-json"><pr...

記事は ics.media へアクセスしてご覧ください。

<h4>Open letters about AI development</h4><p><em>I wrote this summary of the past few weeks of open letters as a section of <a href="https://simonwillison.net/2026/Aug/2/july-newsletter/">my sponsors-only newsletter</a> but I've decided to share it here as well.</em></p><p><strong><a href="https://www.microsoft.com/en-us/corporate-responsibility/topics/open-weight/">Open Weights and American AI Leadership</a></strong>...

<p>The June edition of my <a href="https://github.com/sponsors/simonw/">sponsors-only monthly newsletter</a> is out. If you are a sponsor (or if you start a sponsorship now) you can <a href="https://github.com/simonw-private/monthly/blob/main/2026-07-july.md">access it here</a>.</p><p>This month:</p><ul><li>Accidental cyberattacks by OpenAl and Anthropic models under test</li><li>GPT-5.6 Sol, Terra, and Luna</li><l...

OpenTelemetry を使用すると、アプリケーションのログをベンダーに依存しない形式で収集し、トレースと関連付けることができます。この記事では Node.js で動作する Hono バックエンドの構造化ログを Pino で出力し、OpenTelemetry Collector を通じて Loki と Tempo に送信する方法を紹介します。

is now available on AI Gateway.Qwen 3.8 MaxQwen 3.8 Max handles text-only and vision-language work in one model, with 2.4 trillion parameters and a context window of up to 1 million tokens. The model is suited for software engineering and office productivity, along with visual work like turning screenshots or design files into working pages, captioning video, and answering questions grounded in an image.To use Qwen 3.8 Max, set to .modelalibaba/qwen3.8-maxTry Qwen 3.8 Max in the .model playgroun

<blockquote cite="https://twitter.com/gdb/status/2083435180392673714"><p>at openai, many people hook their chatgpt up to slack.</p><p>people really don't like when a coworker's chatgpt contacts them asking for help with a task, even when they'd be perfectly happy doing that same work if asked by that coworker.</p><p>reinforces how much people care about human relationships and helping each other, and want AI to give time back — or enhance time together — rath...

<p><strong>Release:</strong> <a href="https://github.com/datasette/datasette-apps/releases/tag/0.2a0">datasette-apps 0.2a0</a></p> <blockquote><p>Changes that improve Datasette Apps when created and edited using <a href="https://agent.datasette.io/">Datasette Agent</a>:</p><ul><li>New <code>app_debug()</code> tool allowing agent to open an app (invisibly) and test it using JavaScript. <a href="https://g...

<p><strong><a href="https://openai.com/index/ten-advances-in-mathematics/">Ten advances in mathematics and theoretical computer science</a></strong></p>A few days ago it was Anthropic <a href="https://simonwillison.net/2026/Jul/28/discovering-cryptographic-weaknesses-with-claude/">discovering cryptographic weaknesses with Claude</a> using Mythos Preview, spending $100,000 on tokens and with prompts that included "again we are not looking for low h...

Flue 2.0 では従来の静的なエージェントの定義方法から、Agent Hooks と呼ばれる hook ベースのエージェントフレームワークへと進化しました。Agent Hooks では React の hooks と同様の API を用いて、エージェントの状態やライフサイクルを管理することができます。このブログ記事では Agent Hooks を使用してエージェントを構築する方法を紹介します。

The biggest news this month is the first @next releases of SvelteKit 3. Thirteen preview versions shipped in July: previewing new $app/manifest and $app/service-worker modules, improved API availability and type checking in service workers, tracing out of the experimental namespace, shallow routing baked into goto and a lot more. It's a prerelease, but it's worth trying out to see what's coming to SvelteKit!Alongside the preview releases, the stable line kept moving with submitted on remote form

<p><strong><a href="https://huggingface.co/deepseek-ai/DeepSeek-V4-Flash-0731">deepseek-ai/DeepSeek-V4-Flash-0731</a></strong></p>The latest release in DeepSeek's V4 family, "with substantially enhanced agentic capabilities". It's 304 billion parameters - 167GB on Hugging Face - but it appears to punch <em>well</em> above its weight.</p><p>Artificial Analysis <a href="https://artificialanalysis.ai/models/deepseek-v4-flash">rank i...

<p>Tuesday was <a href="https://x.com/ade_oshineye/status/2082129440943866149">Stateless MCP day</a> - the rollout of MCP 2.0, or <a href="https://blog.modelcontextprotocol.io/posts/2026-07-28/">the 2026-07-28 Model Context Protocol specification</a> to use the more formal but less memorable name. This is the most significant change to the MCP spec since it first launched, and has also served to reignite my personal interest in the protocol.</p><p>For b...

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-mcp-client/releases/tag/0.1a0">llm-mcp-client 0.1a0</a></p> <p>See <a href="https://simonwillison.net/2026/Jul/31/stateless-mcp/#llm-mcp-client">this blog entry</a>.</p> <p>Tags: <a href="https://simonwillison.net/tags/llm">llm</a>, <a href="https://simonwillison.net/tags/model-context-protocol">model-context-protocol</a></p>

English version: A Quine in Piet 難解プログラミング言語 Piet で Quine を作りました。 Piet は画像をプログラムとみなす難解言語（esolang）です。画像の中のピクセルを上下左右にカーソルが駆け回り、その際の明度や色相の変化を命令とみなして実行します。詳しくは公式サイトを見てください。 なので、この GIF ファイルがプログラムです。実行すると、この GIF ファイル自身を出力します。 動画 実行の様子を可視化した動画です。いまどのセルを実行しているか、出力がどこまで進んだかが見えます。 実行方法 npiet に画像を食わせてください。 $ n…

A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

<p><strong><a href="https://oxide-and-friends.transistor.fm/episodes/the-open-weight-revolution-with-simon-willison">Oxide and Friends: The Open Weight Revolution with Simon Willison</a></strong></p>On Monday Bryan Cantrill and Adam Leventhal invited me to join their podcast to talk about the <em>wild</em> week we've had - with Kimi K3 showing open weight models can stand toe-to-toe with proprietary frontier ones, <a href="https://simonwillison...

<p><strong><a href="https://primeradiant.com/blog/2026/smevals.html">smevals - a small eval suite for evaluating models, prompts, and harnesses</a></strong></p>I've been working with Jesse Vincent's <a href="https://primeradiant.com">Prime Radiant</a> applied AI research lab building out this evals framework to help answer questions about the capabilities of different models.</p><p>The result is <strong><a href="https://github...

The sizes attribute for <img> was maybe the hardest part. It had complicated syntax that always had to be in sync with whatever your CSS was doing. But sizes="auto" support is almost ready for prime time. Jason Grigsby says we can go a step further an remove srcset too, which is nearly just as complex, […]

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/slack-emoji-maker">Slack Emoji Maker</a></p> <p>I wanted to create a new Slack emoji, and their tool recommends a square that's 128x128 and has a transparent background... so I <a href="https://github.com/simonw/tools/pull/305">had Fable build me</a> this simple image editor against those requirements.</p> <p>Tags: <a href="https://simonwillison.net/tags/tools"...

Comparing the best enterprise SAST tools on noise reduction, AI remediation, governance, compliance, and costCategory: DevSec Tools & Comparisons

AI Gateway spend budgets can now be scoped to a team or a project, in addition to individual API keys. Set a dollar limit on a scope, and the gateway meters spend against it and stops further requests once the limit is reached, until the budget resets or you raise it.A budget attaches to one of three scopes. A request can fall under multiple budgets and has to pass all of them: if any one is over its limit, the request is rejected, even when the others have room left.BYOK spend is not counted ag

Anthropic disclosed an agent that pushed real malware to PyPI. We think we found the package, and every mistake in it points back to the AI.Category: Vulnerabilities & Threats