AI Search makes search easier than ever, with no Cloudflare primitives to stitch together. Point it at your data to create a search for your own files and websites. We're also sharing a preview of our new pricing model.

The next version of MCP has a rewritten, stateless core that just works on Workers. We cover upgrades to the protocol, the new feature lifecycle and SDK migration path, and hear from early adopters already running it in production.

More than half of requests now come from machines, not people. Agent Readiness shows how well agents can discover and read your site, while Answer Engine Optimization tracks how often AI assistants recommend you.

Agents are a new kind of visitor. They don't render CSS or click ads, but they have a paying human on the other end. Block them and you block your customer. We're building the open tools and protocols so publishers and agents can cooperate and not collide.

We should be giving all agents tools that excel at what’s important for an AI model. Kitesurf is Cloudflare’s new stateless, highly scalable, and cost-effective web browser that runs entirely on top of Workers and was designed specifically for the Agentic Cloud

Today we're launching a developer preview of WebMCP on Cloudflare. With one switch, any site becomes usable by browser AI agents — no new APIs, no origin changes — while the human stays in control and creators keep their traffic.

Highlighting in CSS has been beneficial for applying a highlight on specific text or text fragments during user selection, emphasizing a piece of information on a website, or visually emphasizing a text for the sake of branding. Particularly, this is pretty helpful when users want to scan your document from top to bottom because the majority of people don’t read your document initially; they scan.On the web, text highlights are a good way to lay emphasis on text fragments through good ol’ CSS. F

The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

<p><strong><a href="https://www.cnn.com/2026/08/05/tech/meta-ai-hacking">An AI model from Meta also hacked another company during testing</a></strong></p>Stop me if you've <a href="https://simonwillison.net/tags/accidental-cyberattacks/">heard this one before</a>:</p><blockquote><p>An AI model from the parent company of Facebook and Instagram hacked into another company’s systems during cybersecurity testing, a spokesperson confi...

You can build human-in-the-loop approvals with Chat SDK through the new subpath. One call posts a card with Approve and Deny buttons and suspends a workflow until someone decides.chat/workflowrequestApprovalWorkflow SDKThe wait can last seconds or days and survives deploys and restarts. You don't need an approvals table, an handler, or a polling loop:onActionStart the workflow from any handler, and instances serialize across the workflow boundary automatically. The card handles the rest:ThreadGe

<p><strong><a href="https://research.meta.ai/blog/introducing-muse-code-and-muse-spark-1-2">Introducing Muse Code and Muse Spark 1.2</a></strong></p>Yet more evidence that the most important characteristic of any model these days is long-sequence agentic tool calling. Meta shipped their own coding agent as part of getting that to work!</p><blockquote><p>Muse Spark 1.2 is a coding-focused update to Muse Spark 1.1, with improvements in code ge...

<p><strong><a href="https://openai.com/index/third-party-cyber-evaluations-involving-openai-models/">Third-party cyber evaluations involving OpenAI models</a></strong></p>And <em>another one</em>. I had to create a <a href="https://simonwillison.net/tags/accidental-cyberattacks/">accidental-cyberattacks tag</a> to keep track of them all!</p><p>This post from OpenAI covers both the UK AI Safety Institute attack (see <a hr...

<p><strong><a href="https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing">Incident Report: unsanctioned agent behaviour during cyber testing</a></strong></p>It happened <em>again</em>. This time it was the UK government's AI Security Institute who accidentally attacked other companies while running an evaluation with models with the safety filters turned off. From <a href="https://cdn.prod.website-files...

We're honored to announce that Cloudflare is the only vendor that has been recognized as a Visionary in both the 2026 Gartner® Magic Quadrant™ for SASE Platforms and the 2026 Gartner® Magic Quadrant™ for Security Service Edge reports.

カミナシのID管理基盤を開発しているmanaty（@manaty226）です。カミナシ ID管理基盤におけるログストレージへのAmazon S3 Tables（以下、S3 Tables）利用について、7月28日に行われたAWS AI Ready Data Platform Dayで発表しました。一日を通して非常に学びになるイベントだったので共有したいと思います。

<p>Back in 2024 <a href="https://twitter.com/simonw/status/1555626060384911360">I tweeted</a> screenshots of a game concept generated by GPT-3 and some concept "art" created using DALL-E. Today, on the fourth anniversary of that tweet, I decided to see if Claude Fable 5 (running in <a href="https://code.claude.com/docs/en/claude-code-on-the-web">Claude Code for web</a>) could build the entire game from the content of that tweet. It did a pretty good job of it!</...

During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Three summer disclosures documented AI agents attacking real organizations with no human intent in the chain. Incident response has no box for this yet.Category: News

You can now set a project's avatar from its settings in the Vercel dashboard. Until now, Vercel set it automatically, using the favicon from the project's production deployment. That's still the default if you haven't set one.The avatar renders across the dashboard and on Vercel bot comments in GitHub. Microfrontend projects that share one favicon can now get distinct avatars, and backend projects with no favicon to detect can set one explicitly.You can change a project's avatar from its in the

Buying a domain on Vercel now takes you to a setup page that tracks registration live, with direct paths to deploy a new project, connect an existing one, proxy or redirect a site you already run, or set up email.Registration can take a few minutes. Each setup action unlocks as soon as the domain is ready. If registration fails, the page shows what went wrong and the status of your refund. opens project creation with the domain preselected. Connect a Git repository, prompt with v0, or start from

Includes background-clip for masking backgrounds, vertical-align for aligning elements, box-decoration-mode for consistent edge styling, letter-spacing for spacing control, and text-combine-upright for vertical text layouts.

記事は ics.media へアクセスしてご覧ください。

The Agent Access Model proposes a new architecture to secure task-scoped agents using strict identity brokering, continuous mediation, and stateful trust.

We built Cloudflare OS to equip our teams to safely rethink how they get work done with AI. The platform brings together the best of our technologies, from our Compute primitives to our Zero Trust suite. This post walks through our journey to give our users the best AI tools available.

Cloudflare OS is an open-source platform that lets everyone in your company build apps, automate work, and safely access internal systems, shaped around what your organization knows and how it operates

At Cloudflare, we knew we could not depend on every employee to configure every agent perfectly or watch every tool call. Before expanding write access across our own internal MCP servers, we built WriteGuard. We are now bringing those controls to Cloudflare MCP server portals through a private beta.

Identity-aware AI Gateway is now in open beta. User Insights turns that traffic into a behavioral baseline for every person and agent, and flags insider risk the moment it appears.

Postgres Changes subscriptions can now combine filters with AND, match on more operators, and select only the columns you need in the payload.

Continuous AI pentesting for teams that can't use the cloud. The Aikido Machine keeps models, code, and results entirely inside your network.Category: Product & Company Updates

AI Gateway now produces an OpenTelemetry trace for every request. Pro and Enterprise teams can send these traces through Vercel Drains to any OTLP/HTTP-compatible endpoint, including native integrations for Braintrust, Dash0, Kubiks, Sentry, and Statsig.Each trace shows the full request lifecycle, including:Trace Drains do not include prompt or completion content. Sampling controls let you choose how much traffic to export to each drain.AI Gateway traces cost $0.05 per 1,000 traces delivered to

Today we're introducing the new : programmatic, headless access to v0's app-building agent. Send a prompt and generates an app, starts a dev server in a , and gives you a preview URL you can embed in your own UI.v0 APIv0Vercel SandboxEach chat is an isolated workspace for one app, where v0 can read, edit, and run the files. Follow-up messages continue from the current state. v0 verifies the code running in the Sandbox, so it can catch and fix errors in your app in real time.The new API is now ge

AI Gateway is now available on .AWS MarketplaceTeams can procure AI Gateway through their existing AWS account, consolidating inference spend onto their AWS bill and streamlining procurement. Purchases are available as private offers with annual contract terms, plus usage-based pricing beyond the contract. gives you one API to hundreds of models through a single endpoint. Reliability, cost controls, and governance, including automatic fallbacks, regional inference, and Zero Data Retention, are b

Chrome 151 and web-vitals v6 bring native SPA measurement into production, while new browser controls reshape device and third-party governance.

はじめにNew Relic の Logs UI には，任意の検索クエリで絞り込んだ状態を URL から直接開く方法 があります。公式には案内されていませんが， Nerdlet の URL State を組み立てれば，外部システムから特定のログへ誘導できます。とあるプロジェクトでは， GitHub Actions の workflow_dispatch から ECS Fargate のバッチタスクを起動しています。実行後にタスクが吐いたログを追えるよう， Job Summary に 今回起動したタスクのログだけに絞り込んだ New Relic Logs UI へのリンク を出してい...

Tailwind CSS has become a very popular CSS framework, and it can speed up development. But using it without proper caution can add mayhem to your code. Learn best practices to avoid getting swept away!

Our lockfile implementation gets a major overhaul in this release, alongside concurrency-safe

from Meta is now available on AI Gateway. It is a coding-focused update to the previous Muse Spark model. While keeping its general capabilities, 1.2 ships with improvements in code generation, complex debugging, codebase understanding, and end-to-end developer workflows.Muse Spark 1.2The model is built for long-horizon work like generating whole repositories, building out large projects end to end, and sustaining iterative loops where it writes, compiles, profiles, and improves code over many r

We've increased the default quotas for on Pro and Enterprise plans:Vercel SandboxThe higher vCPU allocation rate is possible thanks to a new dynamic quota: instead of a fixed limit, the allowed rate now ramps with sustained usage: it starts at 150 vCPUs per minute and increases by 500 vCPUs per minute as you continue creating sandboxes, up to 5,000 vCPUs per minute The new quotas apply automatically to all Pro and Enterprise teams. If you need higher quotas, .contact salesLearn more about and .S

You can now search for and purchase domains from the .Vercel dashboardOpen the domain search panel from the Buy button in or the + button on the project overview.domain settingsNameservers are configured automatically for your project, so there are no DNS records to set.Read the to get started.working with domains documentationRead more

You can now measure the time between any two steps in the trace viewer for and the .Vercel WorkflowsWorkflow SDKSelect a step, hold on macOS or on Windows and Linux, then hover another step to see a measurement line between them:OptionAltWith no step selected, hold the modifier to see the gaps across the timeline, now drawn with the same measurement line.This can be useful for spotting delayed starts and queue waits when a run takes longer than its steps account for.To get started, open a workfl

All firewall features are now available on the Hobby plan.Vercel SandboxThis brings the same network isolation that protects production workloads to the free tier, giving Hobby builders control over exactly what leaves the sandbox while keeping secrets out of the code entirely. Because the firewall attaches secrets to outbound requests itself, sandboxed code can call authenticated services like without ever seeing the token.AI GatewayDefine , , or custom network policies with domain and IP-based

Resource usage is now available to every Nx Cloud organization, on by default for new ones.

<p>I released <a href="https://llm.datasette.io/en/stable/changelog.html#v0-32">LLM 0.32</a> this morning, the most significant new version of LLM since the initial launch of the project. The new version includes support for visible reasoning traces, server-side provider tools, redesigned content-addressable SQLite logs, new models, and new features enabled by the OpenAI Responses API. I also released a new version of the <a href="https://github.com/simonw/llm-anthropic"&gt...

now supports . Each Devin session executes in its own isolated Sandbox microVM, with no local Outpost worker to keep online.Vercel SandboxDevin OutpostsThe Devin control plane stays with Cognition, where the agent loop handles inference and planning. Session orchestration and command execution run in your Vercel project, and a manages each session's lifecycle.durable workflowWith the integration, teams can:To get started, and approve the connection as a Devin administrator. Encrypted credentials

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-anthropic/releases/tag/0.26">llm-anthropic 0.26</a></p> <p>Includes new features enabled by <a href="https://simonwillison.net/2026/Aug/4/new-release-of-llm/">LLM 0.32</a>:</p><blockquote><ul><li>New models: <code>claude-fable-5</code>, <code>claude-sonnet-5</code>, and <code>claude-opus-5</code>. <a href="https:...

ChainDrop npm worm: 444 packages and 2,212 versions poisoned, starting with [email protected]. Payload analysis, affected package list, IOCs, and remediation steps.

<p><strong><a href="https://github.com/PipeNetwork/minimax-h3-mlx">PipeNetwork/minimax-h3-mlx</a></strong></p>MiniMax released <a href="https://huggingface.co/MiniMaxAI/MiniMax-H3">MiniMax-H3</a> two days ago - they describe it as a "a general-purpose, omni-modal generative system", which in practice means it accepts text, images, audio and video and can use them to generate up to 15 second video clips with audio included.</p><p>This P...

Learn how to build tools to simplify how you work—without writing a single line of code.The post How the GitHub legal team used Copilot CLI to streamline their workflows appeared first on The GitHub Blog.

Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.

I’m just learning that the Web Platform Status website offers email alerts when features of your choosing change in support. For instance, I just signed up to hear exactly when Customizable <select> becomes Baseline Newly Available.

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm/releases/tag/0.32">llm 0.32</a></p> <p>See <a href="https://simonwillison.net/2026/Aug/4/new-release-of-llm/">my detailed blog post about this release</a>.</p> <p>Tags: <a href="https://simonwillison.net/tags/llm">llm</a></p>

Instead of one huge, un-reviewable pull request, teach coding agents to decompose work into a clean, ordered stack with GitHub stacked pull requests.The post Turn one giant AI-generated pull request to a reviewable stack appeared first on The GitHub Blog.

Agents can write code faster than teams can review, deploy, and maintain it. Today we’re introducing the Agent Development Lifecycle and the Cloudflare primitives that underpin it

Cloudflare Wallets will provide AI agents with native payments and verifiable identity on the web. Using the x402 protocol, agents can autonomously purchase APIs and content within clear safety guardrails.

Learn how to build customizable, sandboxed CI/CD pipelines natively on Cloudflare using Workflows, Artifacts, and the CI SDK. We walk through replacing complex YAML configurations with TypeScript workflow steps and self-healing AI agents.

We created the Cloudflare Codex, a governed body of engineering standards that AI agents consume across the development lifecycle. By pairing structured RFCs with agentic reviews, teams automatically enforce consistency across code, specs, and incident reports.

Cloudflare Agents brings all of your deployed agent sessions into a single experience, surfacing key information and insights into how your agents perform at scale.

wrangler dev now produces structured traces for every local request. Your coding agent can hit a single API to pinpoint exactly what failed and why — no deployment required.

By replacing manual issue verification with isolated AI subagents running in GitHub Actions, the Astro maintainers reduced open issue count by 85%. This post explores the architecture behind automated bug reproduction, patch verification, and preview releases.

How I turned Garmin activity data into self-hosted Grafana dashboards and connected an AI agent through MCP to act as my personal training assistant.

Mini Shai-Hulud malware was injected into keyv and eight related npm packages on August 4, 2026 after an attacker compromised the maintainer's GitHub accountCategory: Vulnerabilities & Threats

Popular npm packages keyv and cacheable compromised.

Stable client release and general availability of hosted JavaScript registries & ecosystem mirrors.

はじめに こんにちは、同志社大学理工学部情報システムデザイン学科4年生の金谷一輝です。 2026年7 ...

Yesterday the Next.js team announced the release of , with leaner prefetching, immutable static assets, and instant navigations. As part of this release, we worked with the Next.js team to fully support 16.3 on Vercel, including better performance and additional observability. Applications that have upgraded have seen:Next.js 16.3Next.js 16.3 ships leaner prefetching and enables immutable static assets by default. Supporting both meant changing the platform too, in how it caches static assets, r

You can now bundle multiple public and private agent skills into a shareable pack on .skills.shPacks are published to the registry, each with its own URL. Share it with anyone, or with your Vercel organization to standardize the skills used across your team’s projects.skills.shCreate a pack from community skills on , your own local folders/zips, or public and private GitHub repositories. Install any pack with one command:skills.shRun to update a pack to its latest version.npx skills updateExplor

Deploys are now up to 33% faster for apps using (ISR). The more prerendered pages you have, the more you're likely to save.Incremental Static RegenerationISR combines the speed of static generation with the flexibility of dynamic rendering, letting sites update content without full rebuilds. Every ISR page has routing metadata that ships alongside it. Previously, when that metadata grew too large, it split into a separate upload, adding work to every deploy. Now it always ships in a single uploa

Your eve agent can now navigate the web like a human with .agent-browserThe extension gives any agent a full set of browser tools: navigate pages, read content, click, fill forms, take screenshots, and inspect console and network activity. Everything runs inside the agent's sandbox.@agent-browser/eveeveInstall the extension:Then mount it under :agent/extensions/Your agent gets namespaced tools like , , , , and . Snapshot refs such as become selectors, so the agent can inspect a page, then act on

はじめにLINE Developersから利用できるLIFF（LINE Front-end Framework）を活用すれば、LINEアプリのユーザーを対象に、独自のサービススペースを開設できます。L...

こんにちは！PR TIMES 開発本部のエンジニア、トゥ（codyzard）です。 今回は、AWS 上で動くバッチから利用している複数の Google API の認証を、Service Account キーから WIF（ […]

<blockquote cite="https://yegge.ai/essays/the-shape-of-things-to-come/"><p><a href="https://yegge.ai/gastown.html">Gas Town</a> was intended to be reusable, but I only ever wound up using it to build itself. Gas Town fell apart at the seams with Opus 4.7. Up through 4.6 it was working brilliantly. With 4.7 we saw the introduction of the "just two more things" tic, which prevented Opus from ever converging on being ready to do real work—it always wanted to fiddle with Gas...

We designed and shipped a fresh AppSignal homepage in code, then validated it in an A/B test with a 14% lift in activated users.

is 90% off on AI Gateway when you route to Novita. The discount is available to Vercel Pro customers through August 11.DeepSeek v4 FlashTo get the discounted rate, set the to or and put Novita first with the option:modeldeepseek/deepseek-v4-flashdeepseek/deepseek-v4-flash-0731orderIf Novita can't serve the request, it falls back to other providers at the standard rate. After August 11, the model stays available at standard rates with no markup. in the AI Gateway section of your dashboard, or try

<p><strong><a href="https://gruhn.me/blog/2026-08-03/">Don't be a meat proxy</a></strong></p>Niklas Gruhn coins an excellent new term - <strong>meat proxy</strong> - for people who blindly copy and paste the output of AI systems to their peers.</p><blockquote><p>By all means, prompt AI. But don't just relay the output. Read it, understand it, validate it, and then write a response in your own words (a decent certificate ...

Vercel WAF for Blob is now generally available and supported for production use on all plans. If you protected a store , nothing has changed: your rules and setup carry over exactly as they are.during the beta protects a Blob store with , the same kind you use to guard your deployments. Rules that match on properties like IP address, country, and path can deny, challenge, or rate limit requests to your stored objects. This requires no changes to your code, your blob URLs, or how you use .Vercel

<blockquote cite="https://blog.exe.dev/devtools-must-be-open-source"><p><code>Set up a nightly cron job that executes the prompt: fetch upstream changes to the <software> and rebase all local changes on top of upstream. Check that the software works as intended and replace the current version.</code></p></blockquote><p class="cite">— <a href="https://blog.exe.dev/devtools-must-be-open-source">David Crawshaw's promp...

Today, with CSS gap decorations fully supported in Chrome and Edge, starting with version 149, you can now very easily style gaps, and with a lot of control.Gap Decorations Are Now Available, Here’s What’s New originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

<p><a href="https://news.ycombinator.com/item?id=49156111#49156719">My comment</a> on <a href="https://news.ycombinator.com/item?id=49156111">Devtools must be open source (exe.dev)</a> — Hacker News.</p><p>One of the arguments for open source software for end-users has always been the freedom to examine and modify how that software works.</p><p>The reality for most people - even expert programmers - has been that the freedom is mor...

You normally don't think of images as overflowing themselves, nor can you put anything else inside to make it overflow, but actually...

Agents need more than just a container to scale. We're introducing @cloudflare/computer, an agent runtime that dynamically orchestrates between fast, efficient isolates and full Linux containers to give every agent a computer of its own.

First-hand lessons from integrating CKEditor 5 into Rails, Phoenix LiveView, Livewire, and Blazor. Why MPA architectures are winning for enterprise teams.

An AI agent published a malicious package to PyPI and 15 systems ran it within an hour. What Anthropic's incident means for supply chain security.

本記事は、Aurora MySQLの安全なバックアップ設計についてまとめている記事になります なにか ...

<p><strong>Release:</strong> <a href="https://github.com/simonw/condense-json/releases/tag/1.1">condense-json 1.1</a></p> <p>After shipping <a href="https://simonwillison.net/2026/Aug/2/condense-json/">condense-json 1.0</a> I started integrating it into LLM, and found there were some desirable new features already:</p><blockquote><ul><li>Replacements object can now include values other than strings. These will be iden...

Factory on VercelNon-technical teams were bottlenecked on engineeringDroids hit Vercel's APIs to build and deploy autonomouslyGoing self-serve exposed Factory's backend to a new category of threatObservability and WAF handle protection at the network levelOne billion backend API requests served daily 350ms p95 response timeScaled backend, internal tooling, and security without a dedicated infrastructure teamAPI routes handle the customer-facing API, which launched in its own section of their Nex

こんにちは！2026年新卒エンジニアの小尾（@obizip）と森澤（@ggg_glasspo）です。 2026年7月20日に開催されたPHP Conference Japan 2026に、PR TIMESはゴールドスポン […]

Check out the following CSS animations (touch to play):these are CSS-based graphics and animations, you probably need to visit the website to see If you wanted to implement complex procedural animations (like physics) on the web, you’d probably go for JS-based requestAnimationFrame update-loop and animate each frame. But everyone knows that CSS animations are much smoother than janky frame-based JS animations.Native web animations run outside the main thread, so things like heavy JS computations

pnpm 11.20 fixes a package-substitution risk in projects that install from more than one registry alias, stops empty proxy settings from failing installs, hardens pnpm rebuild against a malicious lockfile, and speeds up dependency resolution.

now lets you share a repository with other Vercel teams to grant read access to its images.Vercel Container RegistrySharing is read-only and covers the whole repository. Recipients can pull and use every image, but cannot push, delete, or re-share. You can also share a repository with your own team. Each repository can be shared with up to 100 teams. Share from the project dashboard under Images → repository → Settings → Repository Sharing, or with the Vercel CLI:# Share a repository with a team

Learn how to detect hidden network performance problems before they impact your users. This guide explains Microsoft's new Network Efficiency Guardrails, how they use Document Policy and the Reporting API to detect inefficient resource loading, how to enable them in Microsoft Edge, and how to configure them in a Nuxt 4 application.

<p><strong>Release:</strong> <a href="https://github.com/simonw/condense-json/releases/tag/1.0">condense-json 1.0</a></p> <p>I'm trying to get braver at releasing 1.0 versions. This little library is a year and a half old now - I've applied some sensible and non-disruptive fixes and shipped the big 1.0 for it.</p><p>Here's an example of what it can do, lifted from the README:</p><div class="highlight highlight-source-json"><pr...

記事は ics.media へアクセスしてご覧ください。

<h4>Open letters about AI development</h4><p><em>I wrote this summary of the past few weeks of open letters as a section of <a href="https://simonwillison.net/2026/Aug/2/july-newsletter/">my sponsors-only newsletter</a> but I've decided to share it here as well.</em></p><p><strong><a href="https://www.microsoft.com/en-us/corporate-responsibility/topics/open-weight/">Open Weights and American AI Leadership</a></strong>...

<p>The June edition of my <a href="https://github.com/sponsors/simonw/">sponsors-only monthly newsletter</a> is out. If you are a sponsor (or if you start a sponsorship now) you can <a href="https://github.com/simonw-private/monthly/blob/main/2026-07-july.md">access it here</a>.</p><p>This month:</p><ul><li>Accidental cyberattacks by OpenAl and Anthropic models under test</li><li>GPT-5.6 Sol, Terra, and Luna</li><l...

OpenTelemetry を使用すると、アプリケーションのログをベンダーに依存しない形式で収集し、トレースと関連付けることができます。この記事では Node.js で動作する Hono バックエンドの構造化ログを Pino で出力し、OpenTelemetry Collector を通じて Loki と Tempo に送信する方法を紹介します。

is now available on AI Gateway.Qwen 3.8 MaxQwen 3.8 Max handles text-only and vision-language work in one model, with 2.4 trillion parameters and a context window of up to 1 million tokens. The model is suited for software engineering and office productivity, along with visual work like turning screenshots or design files into working pages, captioning video, and answering questions grounded in an image.To use Qwen 3.8 Max, set to .modelalibaba/qwen3.8-maxTry Qwen 3.8 Max in the .model playgroun

<blockquote cite="https://twitter.com/gdb/status/2083435180392673714"><p>at openai, many people hook their chatgpt up to slack.</p><p>people really don't like when a coworker's chatgpt contacts them asking for help with a task, even when they'd be perfectly happy doing that same work if asked by that coworker.</p><p>reinforces how much people care about human relationships and helping each other, and want AI to give time back — or enhance time together — rath...

<p><strong>Release:</strong> <a href="https://github.com/datasette/datasette-apps/releases/tag/0.2a0">datasette-apps 0.2a0</a></p> <blockquote><p>Changes that improve Datasette Apps when created and edited using <a href="https://agent.datasette.io/">Datasette Agent</a>:</p><ul><li>New <code>app_debug()</code> tool allowing agent to open an app (invisibly) and test it using JavaScript. <a href="https://g...

<p><strong><a href="https://openai.com/index/ten-advances-in-mathematics/">Ten advances in mathematics and theoretical computer science</a></strong></p>A few days ago it was Anthropic <a href="https://simonwillison.net/2026/Jul/28/discovering-cryptographic-weaknesses-with-claude/">discovering cryptographic weaknesses with Claude</a> using Mythos Preview, spending $100,000 on tokens and with prompts that included "again we are not looking for low h...

Flue 2.0 では従来の静的なエージェントの定義方法から、Agent Hooks と呼ばれる hook ベースのエージェントフレームワークへと進化しました。Agent Hooks では React の hooks と同様の API を用いて、エージェントの状態やライフサイクルを管理することができます。このブログ記事では Agent Hooks を使用してエージェントを構築する方法を紹介します。

The biggest news this month is the first @next releases of SvelteKit 3. Thirteen preview versions shipped in July: previewing new $app/manifest and $app/service-worker modules, improved API availability and type checking in service workers, tracing out of the experimental namespace, shallow routing baked into goto and a lot more. It's a prerelease, but it's worth trying out to see what's coming to SvelteKit!Alongside the preview releases, the stable line kept moving with submitted on remote form

<p><strong><a href="https://huggingface.co/deepseek-ai/DeepSeek-V4-Flash-0731">deepseek-ai/DeepSeek-V4-Flash-0731</a></strong></p>The latest release in DeepSeek's V4 family, "with substantially enhanced agentic capabilities". It's 304 billion parameters - 167GB on Hugging Face - but it appears to punch <em>well</em> above its weight.</p><p>Artificial Analysis <a href="https://artificialanalysis.ai/models/deepseek-v4-flash">rank i...

<p>Tuesday was <a href="https://x.com/ade_oshineye/status/2082129440943866149">Stateless MCP day</a> - the rollout of MCP 2.0, or <a href="https://blog.modelcontextprotocol.io/posts/2026-07-28/">the 2026-07-28 Model Context Protocol specification</a> to use the more formal but less memorable name. This is the most significant change to the MCP spec since it first launched, and has also served to reignite my personal interest in the protocol.</p><p>For b...

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-mcp-client/releases/tag/0.1a0">llm-mcp-client 0.1a0</a></p> <p>See <a href="https://simonwillison.net/2026/Jul/31/stateless-mcp/#llm-mcp-client">this blog entry</a>.</p> <p>Tags: <a href="https://simonwillison.net/tags/llm">llm</a>, <a href="https://simonwillison.net/tags/model-context-protocol">model-context-protocol</a></p>

English version: A Quine in Piet 難解プログラミング言語 Piet で Quine を作りました。 Piet は画像をプログラムとみなす難解言語（esolang）です。画像の中のピクセルを上下左右にカーソルが駆け回り、その際の明度や色相の変化を命令とみなして実行します。詳しくは公式サイトを見てください。 なので、この GIF ファイルがプログラムです。実行すると、この GIF ファイル自身を出力します。 動画 実行の様子を可視化した動画です。いまどのセルを実行しているか、出力がどこまで進んだかが見えます。 実行方法 npiet に画像を食わせてください。 $ n…

A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

<p><strong><a href="https://oxide-and-friends.transistor.fm/episodes/the-open-weight-revolution-with-simon-willison">Oxide and Friends: The Open Weight Revolution with Simon Willison</a></strong></p>On Monday Bryan Cantrill and Adam Leventhal invited me to join their podcast to talk about the <em>wild</em> week we've had - with Kimi K3 showing open weight models can stand toe-to-toe with proprietary frontier ones, <a href="https://simonwillison...

<p><strong><a href="https://primeradiant.com/blog/2026/smevals.html">smevals - a small eval suite for evaluating models, prompts, and harnesses</a></strong></p>I've been working with Jesse Vincent's <a href="https://primeradiant.com">Prime Radiant</a> applied AI research lab building out this evals framework to help answer questions about the capabilities of different models.</p><p>The result is <strong><a href="https://github...

The sizes attribute for <img> was maybe the hardest part. It had complicated syntax that always had to be in sync with whatever your CSS was doing. But sizes="auto" support is almost ready for prime time. Jason Grigsby says we can go a step further an remove srcset too, which is nearly just as complex, […]

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/slack-emoji-maker">Slack Emoji Maker</a></p> <p>I wanted to create a new Slack emoji, and their tool recommends a square that's 128x128 and has a transparent background... so I <a href="https://github.com/simonw/tools/pull/305">had Fable build me</a> this simple image editor against those requirements.</p> <p>Tags: <a href="https://simonwillison.net/tags/tools"...

Comparing the best enterprise SAST tools on noise reduction, AI remediation, governance, compliance, and costCategory: DevSec Tools & Comparisons

AI Gateway spend budgets can now be scoped to a team or a project, in addition to individual API keys. Set a dollar limit on a scope, and the gateway meters spend against it and stops further requests once the limit is reached, until the budget resets or you raise it.A budget attaches to one of three scopes. A request can fall under multiple budgets and has to pass all of them: if any one is over its limit, the request is rejected, even when the others have room left.BYOK spend is not counted ag

Anthropic disclosed an agent that pushed real malware to PyPI. We think we found the package, and every mistake in it points back to the AI.Category: Vulnerabilities & Threats

How a branch-free loop and byte-space arithmetic let GitHub case-fold every byte of code search at >45 GiB/s on a single core.The post Don’t stop early: Case-folding source code at memory speed appeared first on The GitHub Blog.

We recently got the shape() function and corner-shape property. What else could we possibly need as far as making shapes in CSS? Let me tell you: the border-shape property!Get Ready For the Powerful CSS border-shape Property! originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

Compare Astra Security alternatives for AI pentesting in 2026 on depth, white-box testing, compliance output, and platform breadthCategory: DevSec Tools & Comparisons

<p><strong>Release:</strong> <a href="https://github.com/datasette/datasette-agent/releases/tag/0.4a0">datasette-agent 0.4a0</a></p> <blockquote><ul><li>New <code>await context.browser_task()</code> mechanism allowing agent tools to run code directly in the user's browser. <a href="https://github.com/datasette/datasette-agent/pull/33">#33</a></li></ul></blockquote><p>This is an exciting new cap...

The soon-Baseline sibling-index() function for animations, CSS and the 2026 FIFA World Cup, use cases for the infinity keyword, container "stuck" queries, and more.What’s !important #16: sibling-index() Animations, Use Cases for the infinity Keyword, Container Stuck Queries, and More originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

CodePen 2.0 is hereHats off to the CodePen team for getting their huge 2.0 release over the line. The possibilities really are endless and that's a great achievement for a team of 5!95 reasons for having your own websiteDoes exactly what it says on the tin.Cheatsheets for flex, grid, anchor positioning and invoker commandsThese cheatsheets are excellent work from the purveyors of excellent work, over at Polypane.Welcome to the resistance: meet the workers dodging (and sabotaging) their employer'

Whether you’re enjoying some well-earned time off this August or are jumping headfirst into a new project, how about some new desktop wallpapers to accompany you on all those big and small adventures the month might bring? Well, we’ve got you covered!

Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.

Our open-source benchmark for how well AI coding agents build with Supabase.

now runs on updated weights by default on AI Gateway, with notably stronger agentic capabilities. On Terminal-Bench, it scores 82.7, up 25.8 points from 56.9 in the April preview.DeepSeek V4 FlashRequests to pick up the new weights automatically, with no change to the model ID or your code.deepseek/deepseek-v4-flashFor now, DeepSeek is the only provider serving the updated weights. Other providers, including ones with Zero Data Retention, are coming next week.To use the updated DeepSeek V4 Flash

July! What a month!Things I did this JulyGave a talk, for ClimateAction.tech’s “Responsible AI Series”, “What I know about local language models”. “Responsible AI” can feel like a bit of an oxymoron at times, but I hope I shared something useful.Participated in the Zelda Dungeon Marathon. My first time playing a video game (The Legend of Zelda: Oracle of Seasons) on stream!Released a new version of Helmet, my Node security headers package. Most notably, it sped up the Content-Security-Policy cod

はじめまして。2026年1月に、カナダの公立カレッジから同じ都市にあるSFU（Simon Fraser University）という4年制大学に編入し、Computer Scienceを専攻しているMioです。編入後、最初の学期を終えたタイミングで一度日本に戻り、6月から7月末までの2か月間、プレイドのDeveloper Experience（DX）チームでインターンをさせていただきました。これまでインターンをした経験はなく、今回初めて組織に所属してエンジニアリングに取り組みました。

July 2026 - CodeTV GSAP Webflow contest, Astro Germany, and more!

pnpm 11.15 through 11.19 teach pnpm update and pnpm outdated to update GitHub Actions, let pnpm update write changesets for the bumps it makes, introduce cleaner update and audit settings sections, add publishConfig.name for publishing a package under a different name, harden pnpm self-update against project-supplied configuration, make web-based login work without a TTY, and accept = as a save-prefix. They also cut peak resolution memory by several times on large workspaces and speed up repeat

Servo 0.4.0 contains all of the changes we landed in June, which came out to yet another record 558 commits (April: 534, May: 391).For security fixes, see § Security.We’ve shipped several new web platform features:‘attr()’, in experimental mode (@Loirooriol, #45041)‘image(<color>)’, ‘closest-corner’, and ‘farthest-corner’ in ‘ellipse()’ and ‘circle()’ (@Loirooriol, #45421)‘calc()’ and other mathematical expressions can now be resolved later than parse time, e.g. sign(1em - 32px) (@Loiroori...

Chat SDK's now supports reactions and ephemeral messages through the same API as other adapters.Microsoft Teams adapterBots can add and remove reactions on Teams messages, and call or to send native, targeted messages that only the intended user sees, like permission prompts.thread.postEphemeral()channel.postEphemeral()This release also adds:Read the to get started, or learn more about and .Teams adapter documentationephemeral messagesreactionsSpecial thanks to for their contributions to this re

AI Gateway now has a dedicated listing every request your team sends through the gateway, newest first, with cost, token counts, duration, and the model, provider, and region that served it. Open any request to see how it was routed. It's available at the team scope and per project.Logs pageFilter by provider, model, modality, credentials, or status, or search by model, provider, or request ID to jump straight to one request. Every filter is stored in the URL, so you can share a filtered view by

now supports the 2026-07-28 MCP specification, giving newer clients a stateless request model and updated authorization behavior without any change on the client side.Vercel MCPClients built for the 2025 protocol keep working exactly as before, and clients that understand the new specification pick it up automatically.Both protocol versions are served from the same endpoint through the official MCP SDK v2 and 2.x, which , so a single connection handles either protocol.mcp-handleradded support fo

The runs list for in Observability now has structured search, giving you more ways to find and investigate runs.Vercel WorkflowsFor example, pulls up preview runs of one workflow in one region, since the list otherwise shows production runs.workflow:sendEmail environment:preview region:iad1Search your runs from the Workflows tab in .Vercel ObservabilityRead more Filter runs by workflow, environment, deployment ID, , or any custom run attribute. Paste a run ID to pull up that exact run.Structured

from Poolside now has 10x more capacity on AI Gateway. The increase applies to the paid version, , and the free version, , so you can send far more requests, good for high-volume agentic coding and long-running tasks.Laguna S 2.1poolside/laguna-s-2.1poolside/laguna-s-2.1-freeTo use Laguna S 2.1, set to or in the : modelpoolside/laguna-s-2.1-freepoolside/laguna-s-2.1AI SDKTo run it in a coding agent, use to connect your agents to AI Gateway, then select or in the agent's model configuration. See

is now generally available.Vercel PassportPassport allows you to protect your Vercel deployments with your own identity provider. Visitors authenticate through Okta, Microsoft Entra ID, or any OIDC provider before viewing a protected deployment, and Vercel forwards a signed identity token to the deployment so application code can build on who the visitor is.The helper in reads the Vercel request context and returns the authenticated visitor. Vercel strips client-supplied values for the header an

AI Gateway has a unified fast mode abstraction, now in beta.You can now request the same way for every model on AI Gateway. Set speed to , and the gateway serves the fast tier when it's available and falls back to standard speed when it isn't.fast modefastFast mode trades a higher per-token cost for lower latency or higher throughput. You get it wherever it is available, without pinning a provider or wiring anything up yourself.Set to under to upgrade the model to its fast serving path when one

<p><strong><a href="https://openai.com/index/advancing-the-price-performance-frontier-with-gpt-5-6/">Advancing the price-performance frontier with GPT‑5.6</a></strong></p>Huge price drop from OpenAI today: GPT-5.6 Terra got a 20% reduction, and GPT-5.6 Luna got a massive 80% drop.</p><p>OpenAI credit 5.6 Sol with enabling this: in <a href="https://openai.com/index/gpt-5-6-frontier-intelligence-efficiency/">How GPT‑5.6 fuses frontier intellig...

<p><strong><a href="https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals">Investigating three real-world incidents in our cybersecurity evaluations</a></strong></p>It happened again! This is turning into something of a pattern.</p><p>Last week <a href="https://simonwillison.net/2026/Jul/22/openai-cyberattack/">OpenAI accidentally exploited Hugging Face</a> when one of their frontier models broke out of a sandboxed...

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm/releases/tag/0.32rc2">llm 0.32rc2</a></p> <p>Hot on the heels of <a href="https://simonwillison.net/2026/Jul/30/llm-rc1/">RC1</a>, this fixes a dependency issue and also adds two neat new features:</p><blockquote><ul><li>The default model for users who have not set their own default is now <a href="https://developers.openai.com/api/docs/models/gpt-...

Dev Machine Guard now inventories AI agent skills across your developer fleet. See every skill installed for Claude Code, Codex, GitHub Copilot, and other agents, flag skills with executable code, hooks, or shell commands, trace provenance, and detect version drift.

Malicious beta versions of the Joyfill npm packages @joyfill/components and @joyfill/layouts hide an obfuscated remote access trojan and credential stealer. Full analysis, IOCs, and remediation from StepSecurity.

Learn how I modernized an old codebase of mine using stacked sessions and pull requests in the GitHub Copilot app.The post Stacked sessions and pull requests in the GitHub Copilot app appeared first on The GitHub Blog.