An AI agent published a malicious package to PyPI and 15 systems ran it within an hour. What Anthropic's incident means for supply chain security.

本記事は、Aurora MySQLの安全なバックアップ設計についてまとめている記事になります なにか ...

こんにちは！2026年新卒エンジニアの小尾（@obizip）と森澤（@ggg_glasspo）です。 2026年7月20日に開催されたPHP Conference Japan 2026に、PR TIMESはゴールドスポン […]

Check out the following CSS animations (touch to play):these are CSS-based graphics and animations, you probably need to visit the website to see If you wanted to implement complex procedural animations (like physics) on the web, you’d probably go for JS-based requestAnimationFrame update-loop and animate each frame. But everyone knows that CSS animations are much smoother than janky frame-based JS animations.Native web animations run outside the main thread, so things like heavy JS computations

<p><strong>Release:</strong> <a href="https://github.com/simonw/condense-json/releases/tag/1.0">condense-json 1.0</a></p> <p>I'm trying to get braver at releasing 1.0 versions. This little library is a year and a half old now - I've applied some sensible and non-disruptive fixes and shipped the big 1.0 for it.</p><p>Here's an example of what it can do, lifted from the README:</p><div class="highlight highlight-source-json"><pr...

Agents Week explores how cloud infrastructure must evolve to serve autonomous agents rather than human browsers. Join us as we unpack the storage, execution, and security primitives needed for an agent-native web.

<h4>Open letters about AI development</h4><p><em>I wrote this summary of the past few weeks of open letters as a section of <a href="https://simonwillison.net/2026/Aug/2/july-newsletter/">my sponsors-only newsletter</a> but I've decided to share it here as well.</em></p><p><strong><a href="https://www.microsoft.com/en-us/corporate-responsibility/topics/open-weight/">Open Weights and American AI Leadership</a></strong>...

<p>The June edition of my <a href="https://github.com/sponsors/simonw/">sponsors-only monthly newsletter</a> is out. If you are a sponsor (or if you start a sponsorship now) you can <a href="https://github.com/simonw-private/monthly/blob/main/2026-07-july.md">access it here</a>.</p><p>This month:</p><ul><li>Accidental cyberattacks by OpenAl and Anthropic models under test</li><li>GPT-5.6 Sol, Terra, and Luna</li><l...

OpenTelemetry を使用すると、アプリケーションのログをベンダーに依存しない形式で収集し、トレースと関連付けることができます。この記事では Node.js で動作する Hono バックエンドの構造化ログを Pino で出力し、OpenTelemetry Collector を通じて Loki と Tempo に送信する方法を紹介します。

is now available on AI Gateway.Qwen 3.8 MaxQwen 3.8 Max handles text-only and vision-language work in one model, with 2.4 trillion parameters and a context window of up to 1 million tokens. The model is suited for software engineering and office productivity, along with visual work like turning screenshots or design files into working pages, captioning video, and answering questions grounded in an image.To use Qwen 3.8 Max, set to .modelalibaba/qwen3.8-maxTry Qwen 3.8 Max in the .model playgroun

<blockquote cite="https://twitter.com/gdb/status/2083435180392673714"><p>at openai, many people hook their chatgpt up to slack.</p><p>people really don't like when a coworker's chatgpt contacts them asking for help with a task, even when they'd be perfectly happy doing that same work if asked by that coworker.</p><p>reinforces how much people care about human relationships and helping each other, and want AI to give time back — or enhance time together — rath...

<p><strong>Release:</strong> <a href="https://github.com/datasette/datasette-apps/releases/tag/0.2a0">datasette-apps 0.2a0</a></p> <blockquote><p>Changes that improve Datasette Apps when created and edited using <a href="https://agent.datasette.io/">Datasette Agent</a>:</p><ul><li>New <code>app_debug()</code> tool allowing agent to open an app (invisibly) and test it using JavaScript. <a href="https://g...

<p><strong><a href="https://openai.com/index/ten-advances-in-mathematics/">Ten advances in mathematics and theoretical computer science</a></strong></p>A few days ago it was Anthropic <a href="https://simonwillison.net/2026/Jul/28/discovering-cryptographic-weaknesses-with-claude/">discovering cryptographic weaknesses with Claude</a> using Mythos Preview, spending $100,000 on tokens and with prompts that included "again we are not looking for low h...

Flue 2.0 では従来の静的なエージェントの定義方法から、Agent Hooks と呼ばれる hook ベースのエージェントフレームワークへと進化しました。Agent Hooks では React の hooks と同様の API を用いて、エージェントの状態やライフサイクルを管理することができます。このブログ記事では Agent Hooks を使用してエージェントを構築する方法を紹介します。

The biggest news this month is the first @next releases of SvelteKit 3. Thirteen preview versions shipped in July: previewing new $app/manifest and $app/service-worker modules, improved API availability and type checking in service workers, tracing out of the experimental namespace, shallow routing baked into goto and a lot more. It's a prerelease, but it's worth trying out to see what's coming to SvelteKit!Alongside the preview releases, the stable line kept moving with submitted on remote form

<p><strong><a href="https://huggingface.co/deepseek-ai/DeepSeek-V4-Flash-0731">deepseek-ai/DeepSeek-V4-Flash-0731</a></strong></p>The latest release in DeepSeek's V4 family, "with substantially enhanced agentic capabilities". It's 304 billion parameters - 167GB on Hugging Face - but it appears to punch <em>well</em> above its weight.</p><p>Artificial Analysis <a href="https://artificialanalysis.ai/models/deepseek-v4-flash">rank i...

<p>Tuesday was <a href="https://x.com/ade_oshineye/status/2082129440943866149">Stateless MCP day</a> - the rollout of MCP 2.0, or <a href="https://blog.modelcontextprotocol.io/posts/2026-07-28/">the 2026-07-28 Model Context Protocol specification</a> to use the more formal but less memorable name. This is the most significant change to the MCP spec since it first launched, and has also served to reignite my personal interest in the protocol.</p><p>For b...

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-mcp-client/releases/tag/0.1a0">llm-mcp-client 0.1a0</a></p> <p>See <a href="https://simonwillison.net/2026/Jul/31/stateless-mcp/#llm-mcp-client">this blog entry</a>.</p> <p>Tags: <a href="https://simonwillison.net/tags/llm">llm</a>, <a href="https://simonwillison.net/tags/model-context-protocol">model-context-protocol</a></p>

English version: A Quine in Piet 難解プログラミング言語 Piet で Quine を作りました。 Piet は画像をプログラムとみなす難解言語（esolang）です。画像の中のピクセルを上下左右にカーソルが駆け回り、その際の明度や色相の変化を命令とみなして実行します。詳しくは公式サイトを見てください。 なので、この GIF ファイルがプログラムです。実行すると、この GIF ファイル自身を出力します。 動画 実行の様子を可視化した動画です。いまどのセルを実行しているか、出力がどこまで進んだかが見えます。 実行方法 npiet に画像を食わせてください。 $ n…

A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

<p><strong><a href="https://oxide-and-friends.transistor.fm/episodes/the-open-weight-revolution-with-simon-willison">Oxide and Friends: The Open Weight Revolution with Simon Willison</a></strong></p>On Monday Bryan Cantrill and Adam Leventhal invited me to join their podcast to talk about the <em>wild</em> week we've had - with Kimi K3 showing open weight models can stand toe-to-toe with proprietary frontier ones, <a href="https://simonwillison...

<p><strong><a href="https://primeradiant.com/blog/2026/smevals.html">smevals - a small eval suite for evaluating models, prompts, and harnesses</a></strong></p>I've been working with Jesse Vincent's <a href="https://primeradiant.com">Prime Radiant</a> applied AI research lab building out this evals framework to help answer questions about the capabilities of different models.</p><p>The result is <strong><a href="https://github...

The sizes attribute for <img> was maybe the hardest part. It had complicated syntax that always had to be in sync with whatever your CSS was doing. But sizes="auto" support is almost ready for prime time. Jason Grigsby says we can go a step further an remove srcset too, which is nearly just as complex, […]

<p><strong>Tool:</strong> <a href="https://tools.simonwillison.net/slack-emoji-maker">Slack Emoji Maker</a></p> <p>I wanted to create a new Slack emoji, and their tool recommends a square that's 128x128 and has a transparent background... so I <a href="https://github.com/simonw/tools/pull/305">had Fable build me</a> this simple image editor against those requirements.</p> <p>Tags: <a href="https://simonwillison.net/tags/tools"...

Comparing the best enterprise SAST tools on noise reduction, AI remediation, governance, compliance, and costCategory: DevSec Tools & Comparisons

AI Gateway spend budgets can now be scoped to a team or a project, in addition to individual API keys. Set a dollar limit on a scope, and the gateway meters spend against it and stops further requests once the limit is reached, until the budget resets or you raise it.A budget attaches to one of three scopes. A request can fall under multiple budgets and has to pass all of them: if any one is over its limit, the request is rejected, even when the others have room left.BYOK spend is not counted ag

Anthropic disclosed an agent that pushed real malware to PyPI. We think we found the package, and every mistake in it points back to the AI.Category: Vulnerabilities & Threats

How a branch-free loop and byte-space arithmetic let GitHub case-fold every byte of code search at >45 GiB/s on a single core.The post Don’t stop early: Case-folding source code at memory speed appeared first on The GitHub Blog.

We recently got the shape() function and corner-shape property. What else could we possibly need as far as making shapes in CSS? Let me tell you: the border-shape property!Get Ready For the Powerful CSS border-shape Property! originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

Compare Astra Security alternatives for AI pentesting in 2026 on depth, white-box testing, compliance output, and platform breadthCategory: DevSec Tools & Comparisons

<p><strong>Release:</strong> <a href="https://github.com/datasette/datasette-agent/releases/tag/0.4a0">datasette-agent 0.4a0</a></p> <blockquote><ul><li>New <code>await context.browser_task()</code> mechanism allowing agent tools to run code directly in the user's browser. <a href="https://github.com/datasette/datasette-agent/pull/33">#33</a></li></ul></blockquote><p>This is an exciting new cap...

The soon-Baseline sibling-index() function for animations, CSS and the 2026 FIFA World Cup, use cases for the infinity keyword, container "stuck" queries, and more.What’s !important #16: sibling-index() Animations, Use Cases for the infinity Keyword, Container Stuck Queries, and More originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

Last year we made every Cloudflare server a Media over QUIC (MoQ) relay. Now the new provisioning API lets you create your own isolated relay and control who can publish and who can only watch.

CodePen 2.0 is hereHats off to the CodePen team for getting their huge 2.0 release over the line. The possibilities really are endless and that's a great achievement for a team of 5!95 reasons for having your own websiteDoes exactly what it says on the tin.Cheatsheets for flex, grid, anchor positioning and invoker commandsThese cheatsheets are excellent work from the purveyors of excellent work, over at Polypane.Welcome to the resistance: meet the workers dodging (and sabotaging) their employer'

Whether you’re enjoying some well-earned time off this August or are jumping headfirst into a new project, how about some new desktop wallpapers to accompany you on all those big and small adventures the month might bring? Well, we’ve got you covered!

Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.

Our open-source benchmark for how well AI coding agents build with Supabase.

now runs on updated weights by default on AI Gateway, with notably stronger agentic capabilities. On Terminal-Bench, it scores 82.7, up 25.8 points from 56.9 in the April preview.DeepSeek V4 FlashRequests to pick up the new weights automatically, with no change to the model ID or your code.deepseek/deepseek-v4-flashFor now, DeepSeek is the only provider serving the updated weights. Other providers, including ones with Zero Data Retention, are coming next week.To use the updated DeepSeek V4 Flash

July! What a month!Things I did this JulyGave a talk, for ClimateAction.tech’s “Responsible AI Series”, “What I know about local language models”. “Responsible AI” can feel like a bit of an oxymoron at times, but I hope I shared something useful.Participated in the Zelda Dungeon Marathon. My first time playing a video game (The Legend of Zelda: Oracle of Seasons) on stream!Released a new version of Helmet, my Node security headers package. Most notably, it sped up the Content-Security-Policy cod

はじめまして。2026年1月に、カナダの公立カレッジから同じ都市にあるSFU（Simon Fraser University）という4年制大学に編入し、Computer Scienceを専攻しているMioです。編入後、最初の学期を終えたタイミングで一度日本に戻り、6月から7月末までの2か月間、プレイドのDeveloper Experience（DX）チームでインターンをさせていただきました。これまでインターンをした経験はなく、今回初めて組織に所属してエンジニアリングに取り組みました。

July 2026 - CodeTV GSAP Webflow contest, Astro Germany, and more!

pnpm 11.15 through 11.19 teach pnpm update and pnpm outdated to update GitHub Actions, let pnpm update write changesets for the bumps it makes, introduce cleaner update and audit settings sections, add publishConfig.name for publishing a package under a different name, harden pnpm self-update against project-supplied configuration, make web-based login work without a TTY, and accept = as a save-prefix. They also cut peak resolution memory by several times on large workspaces and speed up repeat

Servo 0.4.0 contains all of the changes we landed in June, which came out to yet another record 558 commits (April: 534, May: 391).For security fixes, see § Security.We’ve shipped several new web platform features:‘attr()’, in experimental mode (@Loirooriol, #45041)‘image(<color>)’, ‘closest-corner’, and ‘farthest-corner’ in ‘ellipse()’ and ‘circle()’ (@Loirooriol, #45421)‘calc()’ and other mathematical expressions can now be resolved later than parse time, e.g. sign(1em - 32px) (@Loiroori...

Chat SDK's now supports reactions and ephemeral messages through the same API as other adapters.Microsoft Teams adapterBots can add and remove reactions on Teams messages, and call or to send native, targeted messages that only the intended user sees, like permission prompts.thread.postEphemeral()channel.postEphemeral()This release also adds:Read the to get started, or learn more about and .Teams adapter documentationephemeral messagesreactionsSpecial thanks to for their contributions to this re

AI Gateway now has a dedicated listing every request your team sends through the gateway, newest first, with cost, token counts, duration, and the model, provider, and region that served it. Open any request to see how it was routed. It's available at the team scope and per project.Logs pageFilter by provider, model, modality, credentials, or status, or search by model, provider, or request ID to jump straight to one request. Every filter is stored in the URL, so you can share a filtered view by

now supports the 2026-07-28 MCP specification, giving newer clients a stateless request model and updated authorization behavior without any change on the client side.Vercel MCPClients built for the 2025 protocol keep working exactly as before, and clients that understand the new specification pick it up automatically.Both protocol versions are served from the same endpoint through the official MCP SDK v2 and 2.x, which , so a single connection handles either protocol.mcp-handleradded support fo

The runs list for in Observability now has structured search, giving you more ways to find and investigate runs.Vercel WorkflowsFor example, pulls up preview runs of one workflow in one region, since the list otherwise shows production runs.workflow:sendEmail environment:preview region:iad1Search your runs from the Workflows tab in .Vercel ObservabilityRead more Filter runs by workflow, environment, deployment ID, , or any custom run attribute. Paste a run ID to pull up that exact run.Structured

from Poolside now has 10x more capacity on AI Gateway. The increase applies to the paid version, , and the free version, , so you can send far more requests, good for high-volume agentic coding and long-running tasks.Laguna S 2.1poolside/laguna-s-2.1poolside/laguna-s-2.1-freeTo use Laguna S 2.1, set to or in the : modelpoolside/laguna-s-2.1-freepoolside/laguna-s-2.1AI SDKTo run it in a coding agent, use to connect your agents to AI Gateway, then select or in the agent's model configuration. See

is now generally available.Vercel PassportPassport allows you to protect your Vercel deployments with your own identity provider. Visitors authenticate through Okta, Microsoft Entra ID, or any OIDC provider before viewing a protected deployment, and Vercel forwards a signed identity token to the deployment so application code can build on who the visitor is.The helper in reads the Vercel request context and returns the authenticated visitor. Vercel strips client-supplied values for the header an

AI Gateway has a unified fast mode abstraction, now in beta.You can now request the same way for every model on AI Gateway. Set speed to , and the gateway serves the fast tier when it's available and falls back to standard speed when it isn't.fast modefastFast mode trades a higher per-token cost for lower latency or higher throughput. You get it wherever it is available, without pinning a provider or wiring anything up yourself.Set to under to upgrade the model to its fast serving path when one

<p><strong><a href="https://openai.com/index/advancing-the-price-performance-frontier-with-gpt-5-6/">Advancing the price-performance frontier with GPT‑5.6</a></strong></p>Huge price drop from OpenAI today: GPT-5.6 Terra got a 20% reduction, and GPT-5.6 Luna got a massive 80% drop.</p><p>OpenAI credit 5.6 Sol with enabling this: in <a href="https://openai.com/index/gpt-5-6-frontier-intelligence-efficiency/">How GPT‑5.6 fuses frontier intellig...

<p><strong><a href="https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals">Investigating three real-world incidents in our cybersecurity evaluations</a></strong></p>It happened again! This is turning into something of a pattern.</p><p>Last week <a href="https://simonwillison.net/2026/Jul/22/openai-cyberattack/">OpenAI accidentally exploited Hugging Face</a> when one of their frontier models broke out of a sandboxed...

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm/releases/tag/0.32rc2">llm 0.32rc2</a></p> <p>Hot on the heels of <a href="https://simonwillison.net/2026/Jul/30/llm-rc1/">RC1</a>, this fixes a dependency issue and also adds two neat new features:</p><blockquote><ul><li>The default model for users who have not set their own default is now <a href="https://developers.openai.com/api/docs/models/gpt-...

Dev Machine Guard now inventories AI agent skills across your developer fleet. See every skill installed for Claude Code, Codex, GitHub Copilot, and other agents, flag skills with executable code, hooks, or shell commands, trace provenance, and detect version drift.

Malicious beta versions of the Joyfill npm packages @joyfill/components and @joyfill/layouts hide an obfuscated remote access trojan and credential stealer. Full analysis, IOCs, and remediation from StepSecurity.

<blockquote cite="https://www.schneier.com/blog/archives/2026/07/should-you-use-ai-for-a-task-heres-a-simple-way-to-decide.html"><p>The writing assignments I give my students are gym tasks, not work tasks. I ask them to write policy memos not because the world needs more policy memos. I assign them because the very act of writing, which includes thinking and outlining and drafting and editing, making and criticizing and revising arguments, will help develop the critical thinking ski...

Learn how I modernized an old codebase of mine using stacked sessions and pull requests in the GitHub Copilot app.The post Stacked sessions and pull requests in the GitHub Copilot app appeared first on The GitHub Blog.

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm-chat-completions-server/releases/tag/0.1a0">llm-chat-completions-server 0.1a0</a></p> <p>A key goal of the new content-addressable logs <a href="https://simonwillison.net/2026/Jul/30/llm-rc1/">in LLM 0.32rc1</a> was being able to support OpenAI Chat Completion style requests where each incoming message extends the previous conversation, like this:</p><pre><cod...

<p><strong>Release:</strong> <a href="https://github.com/simonw/llm/releases/tag/0.32rc1">llm 0.32rc1</a></p> <p>This RC for LLM 0.32 finishes the work that <a href="https://simonwillison.net/2026/Apr/29/llm/">started in LLM 0.32a0</a> - it adds a <a href="https://llm.datasette.io/en/latest/logging.html#the-message-store">new schema design</a> that does a much better job of capturing the details of the prompts and responses retur...

Chrome 146 introduced a scoped custom element registry, allowing different versions of custom elements to share the same tag name without using the global namespace.

We moved cdnjs, serving 9 billion requests a day, entirely onto Cloudflare's Developer Platform. That means we’re running one of the Internet's busiest open-source CDNs on our own building blocks, and we pushed Workflows and Workers limits higher for everyone.

On August 10, 2026, Vercel's CDN will stop stripping the response header and begin passing it through to the client.Server-TimingUse to report backend metrics like database query time and cache hits. These values appear in the browser's network panel and as entries through the Performance API.Server-TimingPerformanceServerTimingIf you want to keep the current behavior, where the header is stripped from every response, you can add a in :transformvercel.jsonLearn more about the .Performance API an

We're getting close to the last part of iteration one — the skeletal build of the site. Good! I'm getting eager to get on with the design work now. For some reason, doing this series (along with being busy in general) has stifled my ability to think creatively about my site. I guess I need to get all the non-technical stuff published to let my brain fully switch. Brains are weird, man.Anyway, we've got one more bit of content plumbing to do and in my eyes, this is the most important part of the

Add custom items to the CKEditor menu bar three ways: extendMenuBar, addItems, or full definition. All with a working plugin example.

Shopify and Vercel Open source and runtime agnostic, runs anywhere JavaScript doesStandard Actions brings agentic commerce to every storefrontFeature development cut from months to a week for retailers like Paige powers commerce for millions of merchants worldwide, and Hydrogen is its framework for building headless storefronts. The Shopify team is partnering with Vercel to rebuild Hydrogen from the ground up. The new version is open source and runtime agnostic so developers can build with Next.

The SDK now supports multiple Linux users and groups, so you can run agents side by side in a single Sandbox.@vercel/sandboxEach agent runs as its own user with a private home directory. A group opens a shared workspace when they need to collaborate. This makes multi-agent systems easier to build.Call for each agent; its commands and file operations run as that user, and users can't read, write, or list each other's files. To set up a shared directory, call and add users to it.createUsercreateGr

こんにちは。東京科学大学 修士一年の一瀬達矢です。 AI事業本部 極TD事業部で202 ...

is now available on AI Gateway.MiniMax H3H3 generates 2K video from a text prompt, a starting image, a pair of first and last frames, or reference material.Alongside text-to-video and first-frame image-to-video, the model supports first-to-last keyframe transitions and multimodal reference-to-video, conditioning a generation on reference images, video, or audio in a single request. Reference and keyframe modes are mutually exclusive. Output is mp4 at 2K resolution, from 5 to 15 seconds, in aspec

from Thinking Machines is now available on AI Gateway.Inkling SmallInkling Small reaches performance comparable to the larger Inkling model at about a quarter of the size, using much less compute per task. It is a broad generalist with native reasoning over audio and images, and it holds up well on reasoning, agentic coding, and tool use. Controllable thinking effort lets you trade quality against cost and latency, from minimal to maximum reasoning.For visual tasks, it can crop, zoom, and inspec

You can now exchange OIDC tokens from CI/CD workflows, including , for short-lived access tokens.GitHub workflowsTurborepoThese tokens grant access to , and are a more secure alternative to long-lived Personal Access Tokens (PATs). OIDC tokens are short-lived, only grant access to Vercel Remote Cache, and are associated with your Vercel team, rather than a specific team member. Vercel's Remote CacheWe recommend all customers migrate their CI/CD workflows from PATs to OIDC. Get started by adding

On , and are now cheaper and is faster.AI GatewayGPT-5.6 LunaGPT-5.6 TerraGPT-5.6 SolAI Gateway adds no markup on token pricing, so these changes reach you at the upstream rate.The changes apply to both short and long context pricing.GPT-5.6 Sol keeps the same price; its fast mode now runs 2.5x faster, up from 1.5x. Model IDs are unchanged, so existing requests get the new rates and speed with no code change.See full pricing detail on .AI GatewayRead moreModelChangeInput: Short context (per 1M t

Over the past few months, we've made deployments up to 7 seconds faster end to end. We removed up to 5 seconds of fixed platform overhead from every build, and deploys from the latest Vercel CLI save up to 2 seconds more. The improvements are most noticeable on smaller builds, where orchestration represents a larger share of the total build time.The largest platform gains:These apply automatically to builds triggered through Git, the dashboard, or Vercel CLI. Deployments from the latest CLI fini

is now available with support for the and [email protected] Model Context Protocol specificationMCP TypeScript SDK v2We originally built to make it easier to spin up MCP servers on popular web frameworks including Next, Nuxt, Svelte, and more.mcp-handlerWith the new 2.0 release, the handler now supports:Existing stateless Streamable HTTP clients can continue connecting to the same endpoint while servers adopt the latest protocol./mcpInstall the new packages:Create a Next.js route hand

Enterprise customers can now apply a portion of their Flexible Commitment toward eligible resources purchased through the Vercel Marketplace.With Flex Commit support, eligible Marketplace cost can draw directly from your existing commitment making it easier to provision the infrastructure and services your applications need.We're rolling this out with an initial set of Marketplace partners, including , , and , with support for more providers coming.NeonSupabaseRedisEligible integrations are mark

You can now create that are limited to a project to authenticate and use the .Vercel Access TokensVercel APIA project-scoped token can only read and write resources belonging to a project that the token is scoped to. Requests to any other project, a user-level resource, or a team-level resource will be denied. This ensures jobs, tools, or workflows only ever access the projects they are scoped to.Navigate to the , found under the area of your Account.Account Tokens pageSettingsRead moreCreating

こんにちは。ABEMA の CloudPlatform チームに所属しているエンジニアの koda ...

Perhaps this theoretical button wasn't a button at all, but 50 links in a trenchcoat.

Safari Technology Preview Release 249 is now available for download for macOS Golden Gate and macOS Tahoe.

Recon, stolen credentials, hidden C2, and rebuild-or-patch. Four Hugging Face breach decisions that show whether you can catch an attack in progress.Category: News

<blockquote cite="https://www.youtube.com/watch?v=R57nUGzo7CA&t=848s"><p>Years ago, we didn’t have SQL. There were people whose job was to generate software that would query large data sets. Their job title was COBOL programmer.</p><p>Then SQL comes along—I’m simplifying this only a little bit—and it gives you this convenient way so people could just specify. With a very simple specification, you can generate all of that code that you had to pay the expensive COB...

<p><strong><a href="https://enklypesalt.com/posts/context-collapse-part3-ai-worming-through-word/">AI Worming through Word</a></strong></p>Neat new prompt injection variant by Håkon Måløy, who found a way to upgrade prompt injection attacks against Microsoft Word to full self-replicating worms:</p><blockquote><p>An attacker places hidden instructions in a document that is later used as source material in Copilot for Word. Copilot may interpr...

<blockquote cite="https://blog.cryptographyengineering.com/2026/07/29/some-notes-about-anthropics-new-results/"><p>Right now we’re in the midst of a historic transition from traditional public-key algorithms based on EC-based cryptography and RSA, moving over to new <em>post-quantum</em> algorithms based on novel problems. This is why there are so many standards like HAWK being considered. If there was ever a perfect time for a massive new public cryptanalysis capability...

Dependabot keeps your dependencies current, but its defaults can flood your repository with pull requests. Here's how grouping updates, slowing the cadence, and keeping security fixes fast cut the noise on a Microsoft open source project.The post Tame Dependabot: Group your updates, slow the cadence, keep security fast appeared first on The GitHub Blog.

Compare the top SAST tools of 2026 across detection depth, noise, remediation, and enterprise fit Category: DevSec Tools & Comparisons

Cloudflare now supports post-quantum (PQ) authentication when connecting to customer origin servers via Authenticated Origin Pulls and Custom Origin Trust Store. This is the first step towards providing PQ authentication for all Cloudflare products.

As AI reshapes product design, it could give designers greater autonomy or expose the gaps that autonomy makes harder to hide. Exploring both the bull and bear cases, Andy Budd examines what happens when designers need less permission to act.

Use your ChatGPT account to sign in to Supabase, and connect Supabase inside ChatGPT and Codex.

はじめに：なぜKafkaのエンドツーエンド暗号化なのか？LINEメッセンジャーでは、毎日数十億件のメッセージがやり取りされています。この膨大なデータはさまざまなシステムに送信されますが、その中には個人...

<p><strong>TIL:</strong> <a href="https://til.simonwillison.net/llms/mcp-in-claude-and-chatgpt">Adding a custom MCP server to Claude and ChatGPT</a></p> <p>Connecting a custom MCP server to Claude and ChatGPT's standard chat interfaces is possible, but can take quite a few steps.</p> <p>Tags: <a href="https://simonwillison.net/tags/ai">ai</a>, <a href="https://simonwillison.net/tags/generative-ai">generative-ai</a>, &...

Chrome's render-blocking label doesn't always fully illustrate which resources are impacting a page's First Contentful Paint (FCP), Largest Contentful Paint (LCP) or H1-visible metrics. We recently introduced our website bottleneck finder tool to help you find resources on your page that might be impacting these metrics but are not considered blocking by Chrome.

is now available on AI Gateway. It is a speech-to-speech voice model that takes audio in and audio out, improving on the previous Grok Voice model in reasoning, transcription accuracy, and conversation.Grok Voice Think Fast 2.0 from xAIThe model reasons in parallel with speech, so it can think through a query while talking without adding latency. It has also been trained to use fewer reasoning tokens than before, so tool calls fire sooner, often before the end of the agent's first sentence. Tran

Edge Config is now . This rename better reflects that it is a globally replicated data store with ~1ms reads in every region, built for the configuration that applications read at runtime, such as feature flags, redirects, and experimentation settings.Global ConfigGlobal Config stores can now hold up to 1 MB on every plan, and Pro and Enterprise teams can create unlimited stores with more writes per day. The rename also ships with a new server-side SDK, , and a new environment variable.@vercel/g

Sign in with ChatGPT adds your ChatGPT account as an authentication option for Vercel. It is available when adding the Vercel plugin to ChatGPT and when signing in to Vercel or v0.When you add the Vercel plugin to ChatGPT, you can easily sign in to Vercel and grant team and project permissions without leaving ChatGPT. "Continue with ChatGPT" also appears as a sign-in option on the Vercel and v0 sign-in and sign-up pages. Team requirements like 2FA and SSO still apply. You can re-authenticate or

Pro and Enterprise teams can now purchase additional custom environment capacity without contacting sales.Custom environments let you model your team's release process on Vercel. You can add , , or any named stage between and , and each environment gets its own branch tracking, environment variables, and domains.stagingqapreviewproductionYou can purchase or adjust capacity from the dashboard, API, or CLI. DashboardCustom EnvironmentsAPIPOST /v1/projects/custom-environments/settingsCLIvercel buy

You can now discover and install integrations for agents directly from the eve CLI. Integrations come from the official eve catalog and third-party sources.eveRun from your eve project to install an integration:eve addIntegrations write their files directly into your project and can add anything an eve agent uses, from a single tool to a channel to a full extension. Review the generated files and add any required configuration before running your agent.Find integrations with the new eve registry

Jenna Smith with some pretty solid UX advice as it relates to loading states: Rather than designing another loading state, I improve the preload strategy until the issue disappears entirely. She points to Route Transitions and preloading data as solutions that get closer to pages that load everything at once, like a default website, while […]

<p><strong><a href="https://www.anthropic.com/research/discovering-cryptographic-weaknesses">Discovering cryptographic weaknesses with Claude</a></strong></p>The best part of this article (here's <a href="https://github.com/anthropics/cryptography-research-demo">the repo</a>) about how Anthropic researchers used Claude Mythos to find mathematical flaws in both HAWK and a weaker version of AES ("neither of these results has a practical impact on to...

After 5x ARR growth in 2024 and again in 2025, StepSecurity is on pace for its biggest year yet in 2026. What is driving it, and why supply chain security is inflecting.

<blockquote cite="https://www.reuters.com/business/openais-rogue-agent-compromised-an-account-second-tech-firm-sources-say-2026-07-28/"><p>We’re aware a Modal customer published an unauthenticated endpoint that allowed ​anyone on the internet to use ​their ⁠sandboxes for code execution. This was used by the rogue agent. Modal’s ⁠platform ​or isolation were not ​compromised in anyway.</p></blockquote><p class="cite">— <a href="https://www.reuters.com/bu...

<p><strong><a href="https://github.com/astral-sh/uv/releases/tag/0.12.0">uv 0.12.0</a></strong></p>Some interesting breaking changes in this release of <code>uv</code>, in particular to the default project produced by the <code>uv init</code> command.</p><p><a href="https://docs.astral.sh/uv/concepts/projects/init/">uv init</a> is the <code>uv</code> shortcut for creating a new project. The previous ...

<p><strong><a href="https://huggingface.co/blog/agent-intrusion-technical-timeline">Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident</a></strong></p>Hugging Face just released this extremely detailed technical description of <a href="https://simonwillison.net/2026/Jul/22/openai-cyberattack/">OpenAI's recent accidental cyberattack against their infrastructure</a>. This attack was <em>very</em> so...

Benign-looking npm packages split malicious functionality across a dependency chain that deploys a cross-platform RAT targeting Alibaba developers.

Explore the changes we've shipped across npm and GitHub Actions over the past few months to disrupt supply chain attack techniques and limit their impact.The post Disrupting supply chain attacks on npm and GitHub Actions appeared first on The GitHub Blog.

Two Joyfill npm beta releases contain an import-time implant that uses blockchain transactions to retrieve a remote-access trojan.

Cloudflare Radar tracked Internet disruptions driven by natural disasters, government-mandated shutdowns, and DNSSEC key rollovers over the last quarter. This post analyzes traffic telemetry to explain how these events impacted global connectivity.

Many of the AI tools we interact with take the form of text boxes. But what if there was a different way to interact with AI? Oleksii Hrzhehorzhevskyi explores a different approach to creating a new AI assistant and how designers can navigate the field as AI continues to change it.

`focusgroup` 属性は、ツールバーやタブリストなどの複合ウィジェットにおける矢印キーのフォーカス移動を宣言的に実装する HTML 属性です。従来必要だった roving tabindex の JavaScript をブラウザに任せ、単一の Tab ストップ、折り返し、最後にフォーカスした項目の記憶などを提供します。この記事では Chrome 150 で利用可能になった `focusgroup` 属性の使い方を紹介します。

now supports forking with .Vercel SandboxSandbox.fork()The fork starts from the source's current snapshot and inherits its config and environment variables. If the source is running, it forks the latest saved state, not the live in-memory state. If the source has no snapshot, it falls back to a fresh create, using the source's and config. Any parameter you pass overrides the inherited value.runtimeA fork takes about the same time as creating a sandbox, with the same limits. Use it to branch an a

In which Adam highlights the integration process and notes some challenges compared to the TanStack setup we covered shortly ago.

※ この記事は、筆者が AI エージェント(Claude Code)と対話しながら執筆しました。読了 ...

第2回となる今回は、Local LLM を開発の相棒として使ってみる、1時間集中の個人参加型ハッカソ ...

How to protect your npm package from being stolen in a supply chain attack and improve its position in security ratings

now lets you link a connector to a so deployments there can request provider tokens and receive forwarded webhooks.Vercel ConnectCustom EnvironmentCustom Environments appear alongside Production, Preview, and Development when you add or edit a project on a connector in the dashboard.From the CLI, pass the environment's slug to :--environmentPassing replaces the default environments.--environmentOnce linked, a deployment in that environment can request tokens with as usual. If the calling environ

<p><strong><a href="https://huggingface.co/moonshotai/Kimi-K3">moonshotai/Kimi-K3</a></strong></p>As promised <a href="https://simonwillison.net/2026/Jul/16/kimi-k3/">earlier this month</a>, Moonshot have released the weights for their excellent 2.8 trillion parameter Kimi K3. They're a hefty 1.56TB on Hugging Face.</p><p>Kimi introduced their own janky <a href="https://huggingface.co/moonshotai/Kimi-K2-Instruct/blob/main/LICENSE"&g...

Socket releases free Certified Patches for high-severity Nuxt vulnerabilities, including server-side remote code execution through server island props.

<p><strong><a href="https://www.oneusefulthing.org/p/an-opinionated-guide-to-which-ai-b22">An opinionated guide to which AI to use to do stuff</a></strong></p>It's interesting watching the evolution of Ethan Mollick's guide over time. </p><p><a href="https://www.oneusefulthing.org/p/using-ai-right-now-a-quick-guide">A year ago</a> it was still all about chat - ChatGPT, Claude, Gemini - with o3, Claude 4 Opus, and Gemini 2.5 Pro as the ...

AI Gateway now supports . Set on a request to pin it to the US or EU. Every model provider that supports the selected region handles it the same way. Inference runs there, and any data the provider keeps is stored there.regional inferenceinferenceRegionAI Gateway supports two pinned regions, plus global routing:If no model provider can serve it, the request fails rather than running somewhere else. Every response reports the region that served it, so you can confirm where each request ran.Here's

Safari 26.6 is here.

A practical GitHub Copilot workflow for prototyping, planning, implementing, and reviewing software without chasing every new AI tool.The post The harness is all you need (mostly) appeared first on The GitHub Blog.

agents on Slack can now keep replying in a thread without repeated mentions, cancel an in-progress response or reset a conversation entirely, and react to any event your Slack app subscribes to.eveMentions no longer have to carry the conversation. Once a thread has an active session, your agent can reply on its own.The new hook receives incoming Slack messages, and two helpers decide which ones to handle: detects an explicit mention, and checks whether the message belongs to a thread with an act

New to the GitHub Copilot app? Learn how to start projects, work with AI agents, explore canvases, and streamline your development workflow.The post GitHub Copilot app for Beginners: Getting started appeared first on The GitHub Blog.

Sandstone on VercelVercel deployments turned a Sunday request into a five-minute fix1,000+ legal requests managed daily across customer teams7-app turborepo monorepo deployed seamlessly to multiple Vercel projectsMulti-step agentic legal workflows built end-to-end with AI SDKPreview deployments fast enough to win enterprise trustAn AI layer flexible enough to ship agentic workflows in minutes that makes security a one-sentence answerSecure ComputeWhen in-house legal teams get a request from thei

pvcli is a curl-like tool designed to simplify the testing of complex privacy protocols like OHTTP.