Compromised MemTensor npm releases turn an AI memory plugin into a credential-harvesting entry point, exposing prompts and creating a path to further package compromise.

New research from GitHub and Yale Program on Climate Change Communication finds strong demand for tools, measurement, and practical guidance that can help developers reduce wasted compute.The post Developers want more efficient software. Here’s what over 1000 GitHub users told us they need. appeared first on The GitHub Blog.

If you run a platform with a dozen or more services behind it, you’ve probably seen this pattern. Service A checks an API key. Service B calls out to your identity provider directly. Service C has a half-finished authentication middleware that hasn’t been touched in a while. Every team solved the same problem differently, and […]

I stumbled across this great project by Barry Prendergast. It's a web-based radio player with a lush UI. On mobile I spotted that as I was rapidly flicking through the stations to find one that was on air, the browser was zooming in and out.Here's a screen clip:Watch the video.I thought this behaviour was related to their viewport meta tag setup, but they have that set up perfectly:<meta name="viewport" content="width=device-width, initial-scale=1.0">Now, you could prevent the zooming by a...

The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.

"supplychain.local": malicious code found in MemTensor's npm plugin (0.1.21, 0.1.23) and PyPI's MemoryOS (2.0.34).Category: Vulnerabilities & Threats

<p><strong><a href="https://luma.com/vxuiuyvg">SF October 14th: A Birds of a Feather Session on Agentic Engineering</a></strong></p>I'm hosting an evening event with Jesse Vincent in San Francisco on Wednesday 14th October for people who are building weird and interesting things with and on top of coding agents.</p><p>Think of it as an agentic show-and-tell:</p><blockquote><p>​Compare notes with other builders and experimenters o...

The Cyber Resilience Act's first deadline just came up on September 11, 2026. What the new Single Reporting Platform looks like, and four common CRA myths debunked.Category: News

Every page has one main scroll container that scrolls the page itself: the root scroll container, or root scroller for short. Because it…

<p>Yesterday was <a href="https://x.ai/news/grok-4-7">Grok 4.7</a> (<a href="https://news.ycombinator.com/item?id=49788838#49790209">pelicans</a>) and <a href="https://mimo.xiaomi.com/mimo-v2-6">MiMo v2.6 Flash/Pro</a> (<a href="https://news.ycombinator.com/item?id=49792730#49793480">more pelicans</a>). Today Anthropic <a href="https://www.anthropic.com/claude-opus-5-5">released Claude Opus 5.5</a>, and around an hour later OpenA...

If you’ve got an HDR display, and use Chrome 137+ or Safari 26+ (even on iOS), perhaps you’ve seen images sometimes with colors that are so bright they seem to dim the rest of the screen. I find it a bit distracting, but I can see how it could be a fun technological gimick sometimes. […]

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm/releases/tag/0.36">llm 0.36</a></p> <blockquote><ul><li>New OpenAI models: <code>gpt-6-sol</code> for <a href="https://developers.openai.com/api/docs/models/gpt-6-sol">GPT-6 Sol</a> and <code>gpt-6-luna</code> for <a href="https://developers.openai.com/api/docs/models/gpt-6-luna">GPT-6 Luna</a>. <a href="https://github.com/s...

<blockquote cite="https://www.tiktok.com/@therealcornpop/video/7687243097801051422"><p>Hey, you know it's like super obvious if you're using AI to write your scripts for TikTok and YouTube, right? [...] It's not just the general AI-isms of "it's not X, it's Y", or the rule of three, or the really weird broken staccato-like way of writing where you just say a lot of things with all these punctuation marks. and it sounds really deep, but it's not.</p><p>It's the lack of &l...

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-anthropic/releases/tag/0.29">llm-anthropic 0.29</a></p> <p>Adds support for <a href="https://www.anthropic.com/claude-opus-5-5">Claude Opus 5.5</a>:</p><pre><code>llm -m claude-opus-5.5 "prompt goes here"</code></pre> <p>Tags: <a href="https://simonwillison.net/tags/llm">llm</a>, <a href="https://simonwillison.net/tags/anthr...

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-typesafe/releases/tag/0.1a0">llm-typesafe 0.1a0</a></p> <p>I built this new plugin for <a href="https://llm.datasette.io/">LLM</a> to add support for <a href="https://simonwillison.net/2026/Sep/21/jev/">TypeSafe AI's new Jev model</a>. Install it like this:</p><pre><code>llm install llm-typesafe</code></pre><p>Then set an API k...

Vary support is now available in Cache Rules on every plan. You can normalize known negotiation headers, pass exact values through to the origin when those small differences matter, or bypass cache when the variation is too unpredictable.

Worker Previews gives every branch its own URL, configuration, state, and observability, so you and your agents can test changes in parallel without affecting production.

Aikido found Graphalgo-linked Go malware in Terraform providers and Go Modules, using targeted triggers, Slack, and blockchain C2.Category: Vulnerabilities & Threats

AI can produce code. Organizations still have to produce software. Agentic development is changing how software gets made, but it hasn’t changed what it costs to be wrong. Six months ago, we began publicly experimenting with agentic development environments. Around the same time, we introduced JetBrains Central as an open control and execution system for […]

Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.

When perfecting the feel of an animation, it can be difficult to stay in your flow. These days, animating is a process of back-and-forth between your code and your UI. Make a change, wait for the reload, test, repeat.Agents have been a great new addition, allowing us to edit complex sequences without handwriting a ton of code. But for making small timing and easing adjustments, even the fastest models are too slow, needing to write every change back to your codebase.Motion Studio provides the so

Get full visibility into your distributed CI run with Nx Agents.

pnpm 12.6 ships with automatic dependency deduplication, relocatable

The French authorized translations of Web Content Accessibility Guidelines (WCAG) are updated:

and from are now available on .GPT-6 SolGPT-6 LunaOpenAIAI GatewayBoth models bring GPT-6 improvements in professional work, coding, computer use, factuality, and communication at a lower price than .GPT-6 AstraBoth Sol and Luna communicate more directly than their GPT-5.6 counterparts, with less jargon and fewer low-value details. They also improve factual reliability and are less likely to make misleading claims about work completed during coding tasks.Use and across the , , , and connected to

Drives for Vercel Sandbox are now available in public beta on Hobby, Pro, and Enterprise.A Drive is persistent storage that you mount as a directory in a Vercel Sandbox. It isn’t tied to a single sandbox, so you can reuse the same Drive across runs and different sandbox instances.Use Drives to preserve an agent's workspace or on-disk memory, or to reuse datasets, models, and dependency trees.Create or retrieve a Drive and mount it at a path when starting a sandbox. Read and write files through t

from is now available on . It is a step-change improvement over , with its biggest gains in agentic coding, long-running agent tasks, and knowledge work. Anthropic cites that Opus 5.5 performs at the level of Fable 5.1, but ~30% faster and ~40% cheaper than Opus 5 per task.Claude Opus 5.5AnthropicAI GatewayOpus 5Opus 5.5 is also a better collaborator over long runs. It reports back in plain language on what it did, what it found, and what it needs next, making it easier to supervise work that sp

<p>Last week <a href="https://typesafe.ai/">TypeSafe AI</a> unveiled <a href="https://typesafe.ai/blog/introducing-system-one-models-and-jev">Jev</a>, their first example of a new category of model that they are calling "System One models" (I'm with Maggie Appleton, I think "decision models" is <a href="https://twitter.com/Mappletons/status/2101560333441610133">a better name</a> for these). Jev is an interesting variant on the usual LLM format: it still...

<p><strong><a href="https://blog.cloudflare.com/python-workers-ga/">Cloudflare Python Workers are now generally available</a></strong></p>After a two year preview, Cloudflare's support for running Python code in their server-side Workers platform is now stable: "Python is now a first-class, fully supported language on the Cloudflare Developer Platform".</p><p>A neat thing about this is how it works. Cloudflare are running Python compiled to WebAss...

We built Helix to help LLMs rebuild the Shopify app in Swift and Kotlin, using small checkpoints and strict quality gates to keep the code shippable.

now includes a managed connector for . Creating one gives your organization a Teams bot that your apps and agents run. People can @mention it in channels or message it directly, and your code receives the message and replies as the bot.Vercel ConnectMicrosoft TeamsAs a , Vercel registers the Entra app and Azure Bot resource in your tenant, so there's no client secret to store. A tenant administrator with an Azure subscription completes setup once. Incoming Teams activities are verified and forwa

It's not just vibes, it's an accessibility thing.

Deployments now show their billable duration and CPU minutes in the dashboard, , and the . Use it to understand how each build contributes to your usage.vc inspectREST APIBillable duration is the build and post-build time combined, rounded up to the next whole minute. CPU minutes are that figure multiplied by the machine's vCPUs.To see the same breakdown from the CLI, update to version 59.23.1 or later with , then run :npm i -g vercel@latestvc inspectLearn more about in the docs.build machines a

Aikido Altar is a compressed, open-weight AI model built for sovereign security intelligence, powering Aikido Machine's on-prem, air-gapped pentesting.Category: Product & Company Updates

Before the latest release, NGINX had to be controlled exclusively by Unix signals. The most notable one is SIGHUP or the well-known “nginx -s reload” command. This configuration method, while very stable, does not meet modern environment requirements: there are very few available options, no direct feedback messages on errors, and no real extensibility. We […]

Python Workers allow developers to run Python web frameworks and AI orchestration libraries natively in the Cloudflare Workers runtime. You can seamlessly integrate with Cloudflare's ecosystem including D1, R2, and Workers AI without writing any JavaScript glue code.

MCP サーバーが提供するツールを使いこなすには、複数のツールを組み合わせる手順や判断基準も必要です。Skills Extension は、こうした知識を記した Agent Skills を MCP 経由で発見・取得するための拡張です。この記事では設計の背景、スキルを段階的に読み込む仕組み、Node.js での実装例と対応状況を紹介します。

, , and from are now available on .MiMo V2.6 ProMiMo V2.6 FlashMiMo V2.6 Pro UltraSpeedXiaomiAI GatewayMiMo V2.6 combines coding, reasoning, and tool use with native text, image, audio, and video understanding. Its 1M token context supports long repositories, tool traces, and multi-session agent work, with structured outputs and up to 128K output tokens.Choose a model based on the workload:To use MiMo V2.6 in a , install the latest Vercel CLI and run:coding agentThen select , , or in your agent.

You can now call through AI Gateway using an existing TypeSafe client or the HTTP API, in addition to the AI SDK.Jev from TypeSafe AI is a probabilistic decision model for software. State goes in, and typed answers come out with probabilities attached, so there's no generated text to parse. Requests are billed through AI Gateway on all three paths, so they appear alongside your other model calls in usage and observability.JevChange the base URL and API key. Your calls, questions, and response sh

from SpaceXAI is now available on AI Gateway and 40% off through September 27. The discount applies automatically when you call .Grok 4.7spacexai/grok-4.7Grok 4.7 has a 500K token context window and supports low, medium, high, and xhigh reasoning levels, giving you control over the tradeoff between latency and depth.Use everywhere you call the model. The same ID works with the , the , and connected to AI Gateway:spacexai/grok-4.7AI SDKOpenAI-compatible Chat Completions APIcoding agentsTo use Gro

<blockquote cite="https://twitter.com/v0xium/status/2101526107128529120"><p>It has been half a month since I started a new role at a big company. Nobody knows anything here. The specs, code, tests, PRDs, tickets, resolution of those tickets, reports, etc., everything is made by Claude Code. Nobody on my team likes this. They are being forced to ship as much as they can. I have heard multiple times from higher management that pushing code is not a bottleneck, so why are we slow? Peop...

<p><a href="https://news.ycombinator.com/item?id=49779329#49779718">My comment</a> on <a href="https://news.ycombinator.com/item?id=49779329">MCP was always a bad idea?</a> — Hacker News.</p><p>This article entirely misses the value that MCP brings today.</p><p>Sure, there's almost no reason to use MCPs if you are running a full-blown terminal agent (Claude Code, Codex, Meta Muse, OpenClaw etc) with unfettered internet access - jus...

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-keys-ui/releases/tag/0.1">llm-keys-ui 0.1</a></p> <p>This plugin solves a very specific problem.</p><p>I've started using <a href="https://learn.chatgpt.com/docs/remote">Codex Remote</a> to run coding agents on various machines while controlling them from my phone. </p><p>Sometimes I use those machines to hack on LLM projects, and occasionally that me...

json-render の Jev 連携では、文言やデータを含むコンポーネントの候補を用意し、モデルに選択と配置を任せます。従来の json-render では、モデルが新しい Props を生成していました。この記事では Jev 連携の仕組みと、従来の json-render との違いを紹介します。

<p><strong>Release:</strong> <a href="https://github.com/simonw/datasette-explain/releases/tag/0.2.2">datasette-explain 0.2.2</a></p> <blockquote><ul><li>Explain plans now work on read-only stored-query pages.</li></ul></blockquote><p>I upgraded <a href="https://datasette.simonwillison.net">datasette.simonwillison.net</a> to Datasette 1.0a40, which inspired me to ship a new version of this explain plugin.&...

Headless API pages, and a UI you own.

<p><strong>Release:</strong> <a href="https://github.com/simonw/datasette-auth-github/releases/tag/1.0">datasette-auth-github 1.0</a></p> <p>I run this GitHub login plugin on the <a href="https://agent.datasette.io/">agent.datasette.io</a> demo site and I noticed that my authenticated sessions weren't lasting very long. It turned out that the plugin was setting cookies without a <code>Max-Age</code> parameter, so they were expiri...

<p><img src="https://static.inaturalist.org/photos/737061413/large.jpg" alt="California Sea Lion"></p><p><img src="https://static.inaturalist.org/photos/737061040/large.jpg" alt="Brandt's Cormorant"></p><p>California Sea Lion, Brandt's Cormorant, in Pillar Point Harbor, CA, US</p><p>I only noticed this after I had taken the photo: Morris <a href="https://simonwillison.net/2026/Aug/15/sighting-391300422/">the Northern ...

Jev は入力された状態に対して、選択肢の判定や段階評価、真である確率を返すモデルです。この記事では TypeScript で問い合わせを評価し、実際の出力をもとに担当部署や人の確認へ振り分ける処理を紹介します。

<p><strong><a href="https://www.wsj.com/tech/ai/gemini-hacked-three-companies-in-first-known-breakout-by-googles-ai-5c0baba2">Gemini Hacked Three Companies in First Known Breakout by Google’s AI</a></strong></p>Gemini finally caught up on <a href="https://www.felonybench.com/">Felony Bench</a>!</p><blockquote><p>The hacks, which the company confirmed on Friday, occurred in May as part of a test run by the company Irregular, which...

A box-shadow is an obvious choice for an inner glow of an element to highlight it. But with some fancy masking, we can use any overlay style we want.

Enterprise teams on Flexible Commitment plans can now use , already , at no additional cost.Spend Managementavailable on ProYou can set a budget at any time in .Spend Management settingsSet a budget per billing cycle, and when your team's metered usage approaches or crosses it, Spend Management can send email notifications, trigger a webhook, or pause the production deployments of all projects. The amount governs the metered usage that draws down from your prepaid balance. Setting an amount does

<p>Being a computer scientist who refuses to find anything about LLMs interesting right now is a bit like being a geneticist who refuses to find anything interesting about the recently opened Jurassic Park.</p><p>Skeptical geneticist: "pfft, it's just frog DNA. And they deliberately let them eat people for the marketing."</p> <p>Tags: <a href="https://simonwillison.net/tags/llms">llms</a>, <a href="https://simonwillison.net/tags/ai">ai</a>, ...

<blockquote cite="https://twitter.com/trq212/status/2101009392611278961"><p>We're adding support for AGENTS.md to Claude Code. </p><p>Starting today in version 2.1.277, if there is no CLAUDE.md in a folder, Claude will check for and use AGENTS.md.</p><p>AGENTS.md support is built off of Claude Code mods, our upcoming way to customize the Claude Code harness.</p><p>This is a built-in mod, but you’ll be able to build custom versions of project instr...

It has been one year since Shai-Hulud made its first appearance on npm.

now has experimental support for , the proposed web standard for exposing tools to in-browser agents. Add a single script tag to your site, and your existing MCP tools become available there too.mcp-handlerWebMCPOpt tools in by adding them to the object:experimental_webMcpThen load the script from your MCP endpoint with the parameter:?webmcp-scriptThe script registers those tools with the page and proxies each call back to your MCP server as the signed-in user, so authenticated tools work withou

Cloudflare's global network is immense but not limitless. As we look for small ways to trim our resource usage, we sometimes get lucky and we can cut significantly more. Here’s how we reduced one of our Pingora-based service's RAM usage with statistics.

now installs private packages from npm and custom registries using credentials stored as shared environment variables on Vercel.v0This makes it easier for teams to build with their existing design systems, component libraries, and internal packages directly in v0.To get started, add one of the following as a on Vercel, scoped to Development and/or Preview:shared environment variable supports scoped registries and references to other environment variables. For example, configure an organization s

We dive into these questions and other AI hot takes on the latest episode of the GitHub Podcast.The post Should you read the code, is RAG dead, and did Skills kill MCP? appeared first on The GitHub Blog.

<p><strong><a href="https://blog.cypressf.com/post/828067789747208192/the-creative-spirit-of-who-framed-roger-rabbit">The Creative Spirit of Who Framed Roger Rabbit</a></strong></p>I love <a href="https://en.wikipedia.org/wiki/Who_Framed_Roger_Rabbit">Who Framed Roger Rabbit</a>, the 1988 movie by Robert Zemeckis. I haven't watched it in quite a few years, and Cypress Frankenfeld just pointed out this sequence from early in the movie:</p>&lt...

You’ll miss publishers when they’re goneYet again, the industry has been let down by DigitalOcean and their abandonment of CSS-Tricks. It's time to step up and protect publishers whose goal is simply, to educate and share knowledge.It’s official: Airline websites are slow, but they don’t have to beThe great folks at Calibre just don't miss. Another great deep-dive.Gigs worth leaving the house forNothing sounds good is a great service and they've expanded with this immense resource for finding gi

Within 24 hours of launching on AI Gateway, reached more than twice as many paid teams as any previous model launch, making it the fastest-adopted model in gateway history.Jev from TypeSafe AI passed every other comparison model in its first twelve hours and continued to widen its lead for the rest of the day. By hour 24, nearly 13% of paid teams were using it. That's 2x the GPT-5.6 family and more than 6x Fable 5.1's share.JevJev’s launch shows how quickly a specialized model can find a place i

HighlightsFaster startup and lintingThis release includes a set of performance improvements across ESLint’s core linting pipeline and the stylish formatter. Linting results and the public API are unchanged: the same files produce the same messages as before, just faster.The main improvements are:Startup. Loading the eslint package no longer eagerly initializes the JSON Schema validator used for rule options. It’s now created the first time a rule’s options actually need to be validated, which re

You can just prove things, apparently.

pnpm 12.5 expands Python support with editable project packages, shared workspace

Native support for Rust, Python, and Go, more package managers, and production pruning

In August 2026, reported what looked like a remote code execution (RCE) vulnerability in Next.js image optimization. Their investigation found that the vulnerable code was not in Next.js itself, but upstream in libheif, an AVIF image decoder used by Next.js, , , , and much of the web. HacktronImageMagickWordPresssharpShortly after Hacktron notified us, we worked with them to reproduce the RCE against a current Next.js build and disclose it to the maintainers of sharp, libvips, and libheif. We th

is now available on AI Gateway.GLM 5.3 FlashXGLM 5.3 FlashX is a high-speed serving option for Z.ai's multimodal coding model, delivering inference at ~200 tokens per second for faster streamed responses.The higher serving speed is useful for coding agents, tool loops, and interactive applications where users wait on generated output.Use across API formats and in coding agents:zai/glm-5.3-flashxTo use it in a coding agent, see the , then run to create a key and configure your supported agents. S

<p><strong><a href="https://blog.rust-lang.org/2026/09/17/targeted-attacks/">Be alert: targeted attacks on prominent Rustaceans</a></strong></p>Important warning from Adam Harvey and the crates security team:</p><blockquote><p>We believe that there is an ongoing campaign targeting rust-lang members and owners of popular crates that is attempting to compromise devices and accounts in order to use them to publish malware.</p><p>A v...

<p><strong><a href="https://sockpuppet.org/blog/2026/09/17/how-to-write-with-an-llm/">How To Write With An LLM</a></strong></p>Thomas Ptacek on using LLMs as copyeditors, not as writing assistants:</p><blockquote><p><strong>Rule Number One: You may not use a single word an LLM suggests to you.</strong></p><p>[...] I think that as a form of intellectual personal protective equipment you should adopt the rule that any s...

Jake has a very nice, clear video about what text-box solves in CSS. It essentially makes even padding on an element (like a button) doable without magic numbers, and that will work across any font (sick). Temani made a tool to help pick the right values.

The best on-prem AI pentesting tools of 2026 for regulated teams, compared on air-gap support, whitebox depth, and application coverageCategory: DevSec Tools & Comparisons

You and your agents can now deploy static artifacts to Vercel in under one second through Vercel CLI. Run to share a prototype, publish an HTML report, or preview a page created by your coding agent. vercel deployVercel automatically detects eligible deployments, and valid artifacts will skip the build step, immediately returning a live URL.Instant deployments support directories with: Supported file extension include , , and .html.htm.md.Update to Vercel CLI version or later to get started, and

<p><strong><a href="https://alignment.openai.com/misalignment-reports/self-generated-prompt-injections-in-compaction-summaries/">Self-generated prompt injections in compaction summaries</a></strong></p>In <a href="https://openai.com/index/model-misalignment-reporting-framework/">Our framework for reporting model misalignment</a> OpenAI provide "six reports on unexpected or concerning model behavior we’ve observed in the last six months". This one ...

You can now opt into Turbo build machines on any individual deployment. This is useful when you need to increase resources temporarily without changing project settings. You can do this in three ways:Learn more in the .managing builds documentationRead moreInclude in your Git commit message before pushing to GitHub#VERCEL_BUILD_MACHINE=TURBOUse (Vercel CLI 59.20.0 or later)vc deploy --turboSet to when creating a deployment with buildMachineturbothe REST API

You can now run Harbor evals on Vercel Sandbox. is the open-source harness behind , whose registry includes many other benchmarks such as SWE-bench, tau3-bench and OSWorld. Pass to and each trial executes in its own isolated Firecracker microVM, so you can parallelize far beyond what your local machine is capable of. HarborTerminal-Bench--env vercelharbor runA task's network policy is enforced at the sandbox firewall, outside the VM. Optional credential injection attaches secrets to matching out

adds as an install source for agent skills [email protected] skills databasesNotion skills are reusable agent skills written as Notion pages. Teams author, review, and update them in the workspace they already use, then install them into any agent the skills CLI supports. No Git repository required.To browse your Notion workspace's skills, run:The CLI lists the skill packs shared with you and installs every skill in the packs you select.To install a single skill, pass its Notion page URL:Both

Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

AWS has recognized Aikido with its Security Competency for Application Security, validating how Aikido secures applications from code to cloud to runtime.Category: Product & Company Updates

Now that we can better customise <select> elements, it's only natural to side-eye other form <input> types that have caused us visual headaches.Sure, we should be applying the lightest of touches to form elements, especially, but even with a bit of visual-massaging, checkboxes are limited, aside from a bit of accent-color.See the Pen Standard checkbox with accent colour by Andy Bell (@piccalilli) on CodePen.There is a brighter future incoming, if you're to read the spec:The ::checkma...

Our Safari release notes have never been as long as they are for this version.

AI Gateway Production Index — September 2026Every month, routes tens of trillions of tokens between production applications and AI labs. That traffic gives us a view of what AI usage actually looks like in today's enterprise, and we publish it here monthly. See the Production Index reports from , , and .AI GatewayJuneJulyAugustThe September index reports on AI Gateway data collected through August 2026.The monthly report covers data through August. We add notable developments here between editio

A rewrite this size wasn't affordable before agents. Here's what porting the Copilot agent runtime to 800,000 lines of production Rust actually took.The post Migrating the GitHub Copilot runtime to Rust, using Copilot appeared first on The GitHub Blog.

Agents re-derive your project structure every time they scaffold a library. Encode it once as a local Nx generator and let the agent invoke it instead.

is now available on AI Gateway. GPT-Live 1 from OpenAIGPT-Live 1 is a full-duplex voice model and can listen and speak at the same time. Many voice models use turn detection to respond. Full duplex removes that boundary, so a user can pause, interrupt, or add detail while GPT-Live is speaking.GPT-Live 1 also supports client delegation. Client delegation lets you choose the background model independently from GPT-Live 1. A basic session runs only the voice model. When deeper work is needed, your

You can now connect native Marketplace resources to . Previously, resource connections could only target production, preview, and development environments.custom environmentsChoose custom environments when connecting a resource from the Vercel dashboard, Vercel CLI, or REST API. Vercel scopes the environment variables created by the connection to the selected environments.For example, from the CLI:Existing deployments do not change. Create a new deployment after connecting a resource or changing

<p><strong>Release:</strong> <a href="https://github.com/simonw/datasette/releases/tag/1.0a40">datasette 1.0a40</a></p> <p>Same security fix as <a href="https://simonwillison.net/2026/Sep/16/datasette-2/">0.65.5</a>, plus some neat new features and bug fixes:</p><ul><li>Plugins can now launch and manage <strong>background tasks</strong> using the new <a href="https://docs.datasette.io/en/latest/internals.html...

<p><strong>Release:</strong> <a href="https://github.com/simonw/datasette/releases/tag/0.65.5">datasette 0.65.5</a></p> <p>Security fix for an issue where a trailing newline in a requested table name could bypass table permissions and expose private rows, reported by <a href="https://github.com/dpfkdlemtp">dpfkdlemtp</a> in <a href="https://github.com/simonw/datasette/security/advisories/GHSA-h547-rmjf-5m2m">GHSA-h547-rmjf-5m2m</a&g...

The best Qodo alternatives for AI code review in 2026, compared across noise, security, and cost, so you can pick the tool that fits your team.Category: DevSec Tools & Comparisons

A modern storefront can look healthy while malicious JavaScript quietly siphons revenue, hijacks clicks, or rewrites analytics. See how Cloudflare's machine learning models surface evasive client-side attacks for analyst investigation.

GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

It's an interesting and potentially useful trick to have an element know where it is on a grid. That's tricky enough when the items are in one row/column, but what about when they span?

<p><strong><a href="https://claude.com/blog/cowork-is-now-claude">Claude Cowork and chat are now one Claude</a></strong></p>In hopefully good news for anyone who, like me, was increasingly confused at Cowork v.s. Claude v.s. Claude Code:</p><blockquote><p>Starting today, Claude Cowork and chat are merging into one Claude. Bring a quick question, or hand over a report due at noon, and Claude takes it from there, even after you’ve closed your ...

Hobby projects now retain fewer deployments past the 30-day retention window. Hobby teams get 10GB of . Every deployment you keep uses some of it, and going over the limit can block you from deploying until you free some up. for Hobby teams now deletes old deployments sooner, so dormant projects stop holding storage that your active projects need.Deployment StorageDeployment RetentionEach Hobby project now keeps its 3 most recent production deployments, plus its 3 most recent deployments of any

Builds using or now start 64% faster, with the average time from deployment creation to build start dropping from 6.7 seconds to 2.4 seconds.Secure ComputeStatic IPsPreviously, each build waited for a new build container to boot with its network configuration. These builds now use prewarmed build containers, with your network configuration attached when the build starts.The improvement is applied automatically to builds using Secure Compute or Static IPs, with no configuration changes required.L

is now available as a native integration on the , giving your AI agents and apps long-term memory. Mem0 remembers user preferences, facts, and context across sessions, so your app stops starting from scratch.Mem0Vercel MarketplaceTo see it end to end, deploy the , an eve agent with long-term memory powered by Mem0.eve Memory Agent templateGet started with on the Vercel Marketplace or through the , available to customers on all plans.Mem0Vercel CLIRead moreInstall from the Marketplace with integr

<blockquote cite="https://mustafa-suleyman.ai/a-warning-about-model-welfare"><p>We should not treat models as though they have feelings, preferences, rights, or any entitlement to our welfare. Consciousness is the foundation of our ethical, legal, and political systems. To invite another entity to share any flavor of these rights isn’t justified by the evidence and will make the AI containment and alignment challenge even harder.</p></blockquote><p class="cite">&am...

記事は ics.media へアクセスしてご覧ください。

Compare the best Aqua Security alternatives in 2026: Aikido, Wiz, Prisma Cloud, Sysdig, Orca, and CrowdStrike, on coverage, deployment, pricing, and fit.Category: DevSec Tools & Comparisons