The warning is correct. And the recommended fixes you've probably seen are wrong. Here's what you can do instead to properly fix the issue.Blocked aria-hidden: The Warning is Right, and Every Fix You’ve Found is Wrong originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

SAST, Deep PR Review, AI Code Analysis, and AI Pentest each catch different vulnerabilities at different stages. Here's when to use each, and why.Category: Product & Company Updates

Two StepSecurity controls show every CI job and developer machine that still installs from public registries. Once you can see them, you can block public registries in CI and centrally set the registry configuration on every developer machine.

A quiet week in web performance is a useful chance to investigate the evidence and problems teams already have.

MinMax H3を使って動画を作成したい！！でも、手元のPCが貧弱・・・と、言う方でも簡単にかつ格安で動画を作れる方法の紹介です。※15秒で40〜80円くらいらしいです。 Google Colabの課金Pay As You GoのプランでGoogle Colabに課金します。月額プランでも特に問題ないはずです。 Google Drive(Google One)に課金100GBのプランで問題ないので契約します。僕が課金したタイミングでは3ヶ月間は70円/月と言う狂った安さでした。 動画の準備 素材作成https://github.com/sobaya-01...

はじめに はじめまして。東京海洋大学 海洋工学部2年の恩田梨那(@cs_riri)と申します。 今回 ...

<p><strong><a href="https://sophiebits.com/2026/06/25/there-are-no-lossless-transformations-of-natural-language-text">There are no lossless transformations of natural-language text</a></strong></p>Sophie Alpert shares her "internal policy on acceptable use of AI writing by engineers". It's a short read (supporting its own recommendations) and really good.</p><p>If you chose to have LLMs help massage your writing the following rule seems crucial to...

The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.

You can get pretty darn flexible with it.

<p><strong><a href="https://stolen-thoughts.com/">Stealing Reasoning Traces from Proprietary LLM APIs</a></strong></p>A vanity domain name (<code>stolen-thoughts.com</code>) for <a href="https://www.alphaxiv.org/abs/2608.09867">a neat paper</a>:</p><blockquote><p>Anthropic, OpenAI, and Google return encrypted chain-of-thought blocks to clients that can be replayed across sessions, users, and models. We take a trace pr...

Every build on Vercel starts in the build warm pool, which is a set of standby containers that let builds begin without waiting for new compute. The pool runs on state that tracks which containers are ready, the tokens each one uses to authenticate, and the mapping that ties every running build back to the deployment that gets billed for it. When we built the pool, we put all of that in Redis, which was fast and made sense at the time.Over the years, though, that state turned into a liability. T

Vercel Connect now gives teams line-level visibility into the token lifecycle. See who created a token, what app or project used it, when, and whether it is still active.Every connector's detail page includes a new tab:ObservabilityConnect observability is available on all plans. Events are retained for 12 hours on Hobby, 3 days on Pro, and 30 days on Enterprise. To retain events longer, forward them to a custom webhook endpoint by adding a Drain on Pro and Enterprise plans. Enterprise teams als

Enterprise Managed Users (EMU) gives organizations full control over the Vercel accounts tied to their verified domains. It makes the organization's identity provider the single source of truth for authentication and account lifecycle, so accounts on company domains are governed centrally rather than owned by individuals.Now generally availableRequires an Enterprise plan, enforced SAML SSO, active Directory Sync, and at least one verified domain.In Beta, available on requestTo request access, co

<p><strong>Release:</strong> <a href="https://github.com/simonw/datasette-upload-dbs/releases/tag/0.5a0">datasette-upload-dbs 0.5a0</a></p> <p>This plugin has been around for a while - it lets users upload a brand new SQLite database to a hosted Datasette instance, at which point that database will start being served by that instance.</p><p>It can also be used to atomically swap a database with a more recent version. The uploaded database is...

You can now integrate 100+ services through Vercel Connect from the CLI. Previously, completed setup in the terminal for some services, and opened the dashboard for everything else.vercel connect createPass the service name to create a connector, then attach it to your project:The CLI pre-populates the brand name, icon, auth type, and MCP or discovery URL, then prompts for any credentials the service requires and creates the connector.After attaching the connector, call with its UID () to reques

Developers are owning more of the delivery system around code, not just code itself. Join us during GitHub Universe to meet other devs, learn something new, and explore what's next.The post From coder to orchestrator: How agents shift the role of a developer appeared first on The GitHub Blog.

In the first half of 2026, Cloudflare detected a 519% surge in hyper-volumetric DDos attacks across its network. These attacks were driven heavily by DNS and CLDAP reflection vectors. This report breaks down how major geopolitical conflicts reshaped the global cyber threat landscape.

When tasked with building a highly interactive, tactile web experience, the architecture must serve the art direction. In this article, Alexey Kopytin explains their architectural rationale for building a digital stress-relief squeeze toy game using Lottie animations, DOM events, and distance-based math to maintain absolute control over their designers’ intentional motion.

Over the past year, AI models have become much more capable of performing cybersecurity work. These changes are reshaping both the threats facing the web and the tools available to defend it. Right now, defenders have an advantage because they can use stronger models for defensive work than the open-weight models broadly available for offensive research. But this advantage will not always last. The gap will soon close.I have both good news and bad news, neither of which is yet widely understood

AI Gateway Production Index — August 2026Every month, routes tens of trillions of tokens between production applications and AI labs. That traffic gives us a view of what AI usage actually looks like in today's enterprise, and we publish it here monthly. See the Production Index reports from , , and .AI GatewayMayJuneJulyThe August index reports on AI Gateway data collected through July 2026.Moonshot released Kimi K3 on July 16. Like Z.ai's GLM 5.2 released in June, it is built for long-horizon

生成 AI のチャット UI では、回答が少しずつ画面に表示されます。このような更新をそのままライブリージョンに入れると、スクリーンリーダーが生成途中の回答を細切れに読み上げることがあります。ChatGPT と Claude、チャット UI ライブラリの実装を調査し、回答本文と状態通知を分離したサンプルを実装します。

Are you treating your users fairly? They could be stuck in the queue while a greedy user monopolizes resources. And you might not even know it! In this post, you’ll see if it’s time for you to take background job prioritization seriously, and how to make it fair for all users.

Today we are excited to release React Native 0.87!

Running untrusted code safely requires more than separating it from the host. You also have to control what that code can reach.This matters more as AI agents gain the ability to read files, execute commands, install packages, and generate programs of their own. A microVM can prevent that code from accessing the host or another workload. By itself, it cannot stop the code from exfiltrating data, probing internal services, attacking systems elsewhere on the internet, or using credentials availabl

is now available on the , allowing you to quickly get started with feature flags without additional setup. You can:LaunchDarklyVercel MarketplaceTo get started, run , add the adapter, and declare a flag with the :vercel install launchdarkly@flags-sdk/launchdarklyFlags SDKUsing a coding agent? Hand it this prompt:Add from the Vercel Marketplace, or read the .LaunchDarklyadapter docsRead moreSync flags into and evaluate them locallyGlobal ConfigTarget releases by user, attribute, or segmentRun exp

<p><strong><a href="https://research.meta.ai/blog/introducing-muse-glimmer-open-agentic-model">Introducing Muse Glimmer</a></strong></p>Meta are back in the open weights game! Muse Glimmer is a brand new 30B model under a clean Apache 2.0 license (a step up from the janky Llama licenses of old).</p><p>They claim to have optimized it for exactly the kind of things I'm looking for in a local model:</p><blockquote><ul><li><...

Enterprise Java developers have a new superpower—drive GitHub Copilot from idiomatic Java code with annotations, virtual threads, and more.The post Using the GitHub Copilot SDK for Java appeared first on The GitHub Blog.

Our latest Agents Week has come to a close. Here’s a recap of all the announcements we made from Wallets to Radar.

Today we are introducing Vercel Managed Images (VMI), a set of versioned, open-source base images you can use as-is or extend. The source for every image lives in the public repository.vercel/sandboxManaged images replace Sandbox runtimes, which are now deprecated. Starting with version 3 of the Sandbox SDK, new sandboxes default to . It ships with Node.js, Python, common coding agents and standard utilities, so most users never build a custom image or install packages at boot. vercel/sandbox/un

Border images are an overlooked feature. One neat fact is that border image slices can run across entire borders on an element, and animating it creates beautiful effects.Animating CSS border-image originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

Smashing Magazine’s in-person conferences are back and returning to the wonderful city of Freiburg next month, September 7–10.SmashingConf Freiburg 2026, September 7-10 originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

Cloudflare for Government achieves FedRAMP Class D (High) Certified status. We also announce our commitment to pursue DoD IL4 authorization. Cloudflare brings world-class security, performance, and developer products to the public sector.

<blockquote cite="https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack/107007986"><p>The API has zero authorisations checks on cancelling other people's reservations … I tested this with the person in waitlist position #1 — and it actually went through. So you've moved from #4 to #3 already.</p></blockquote><p class="cite">— <a href="https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack...

Nx Cloud can now read your pipeline configuration from a central config file.

pnpm 12 is a rewrite of pnpm in Rust, and it is currently a release candidate. Upgrading is not meant to be a migration: apart from the differences below, it keeps the commands, flags, settings, and lockfile format of pnpm 11, and the documentation applies to both versions.

Leaving most of my open source projects in security mode and/or with other maintainers.

, the open-source security review harness from Vercel, now lets you set up a repository and run its first security review with a single command.deepsecThe command now automates the standard setup process:initSetup is checkpointed after each step. If a run stops, whether from closing the process, a failed step, or a hit cost or duration limit, re-running resumes from the last completed step.initRun to start your first scan, or read the to learn more.npx deepsec initdocsRead morecreates the isolat

The for Vercel Functions now supports as a function entrypoint, including WebSocket handlers. The server you run locally with Bun deploys as-is, without being wrapped in a framework.Bun runtimeBun.serve()Enable the runtime by setting in ."bunVersion": "1.x"vercel.jsonCreate a server with a map in at the project root.routesserver.tsAdd a handler and call in to upgrade matching requests. The rest of the server stays the same.websocketserver.upgrade(request)fetchWebSocket connections run on with ,

<blockquote cite="https://platform.claude.com/docs/en/release-notes/system-prompts#claude-opus-5"><p>Claude Fable 5 and Claude Mythos 5 were first released on June 9, 2026. On June 12, 2026, Anthropic suspended access to both models to comply with U.S. Department of Commerce export controls; the Department lifted those controls on June 30, 2026, and Anthropic restored access on July 1, 2026 (Anthropic's statement: <a href="https://www.anthropic.com/news/fable-mythos-access">ht...

はじめに CIU (CyberAgent group Infrastructure Unit) の ...

<p><strong><a href="https://github.blog/changelog/2026-07-30-github-models-is-now-retired/">GitHub Models is now retired</a></strong></p>I missed this news until today, when the GitHub Actions run for my <a href="https://github.com/simonw/research">simonw/research</a> repository failed with this error message:</p><blockquote><p>GitHub Models is temporarily unavailable as part of a scheduled retirement brownout.</p></bloc...

<p><strong>Research:</strong> <a href="https://github.com/simonw/research/tree/main/sqlite-text-history-prototype#readme">SQLite compressed text-history prototypes</a></p> <p>I'm perennially interested in options for storing revision histories in relational databases. While out on a dog walk I had a new idea: how about taking the full text of every prior version in a big JSON array of strings and then applying zlib or zstd compression to the whole thing...

`aria-actions` 属性は、ある要素に対して実行できる操作を提供する別のインタラクティブ要素を関連付けるための WAI-ARIA のプロパティです。この記事では、メール一覧の各項目と「既読にする」「スターを付ける」「削除する」ボタンを関連付ける例を使い、`aria-actions` が解決する問題と使い方を紹介します。

Two ways to stop GitHub Copilot from suggesting inside your .env files in VS Code, how to verify it worked, and where those fixes stop helping.

<p><strong><a href="https://claude.com/blog/auto-mode-default-in-claude-code">Auto mode is now the default in Claude Code for Pro, Max, and Team plans</a></strong></p>Anthropic are <em>really</em> confident in Claude Code's <a href="https://code.claude.com/docs/en/auto-mode-config">auto mode</a>, to the point that they are making it the default setting for new sessions in most Claude Code plans starting on August 14th.</p><p&g...

<p><a href="https://news.ycombinator.com/item?id=49220609#49221745">My comment</a> on <a href="https://news.ycombinator.com/item?id=49220609">Now we have a timeline of the OpenAI accidental attack against Hugging Face</a> — Hacker News.</p><p>I think one of the most interesting details here might be tucked away in that first bulletin point:</p><blockquote><p>May 7: OpenAI starts a new training run for an experimental, unrelea...

Fetch API に textStream() メソッドが追加されました。レスポンスボディを UTF-8 のテキストとして読み出すストリームを返すメソッドで、これまで TextDecoderStream を自分で繋いでいた処理を 1 つの呼び出しに置き換えられます。この記事では従来の書き方との違いを紹介します。

<blockquote cite="https://daringfireball.net/linked/2026/08/07/simon-willison-on-blogging"><p>Me, I try to get into the mindset of playing live music, not recording a studio album. Except when I’m writing a piece where I really want it to be an album. Those aren’t <em>rare</em>, per se, but they’re <em>occasional</em>. If I tried to make every post a hall-of-famer I’d never get anything out.</p><p>I’m aiming for professionalism. I’m performing liv...

is now available on AI Gateway.Grok Imagine Image 2.0 Preview from xAIThe model follows detailed instructions closely and plans typography and layout together, so dense, multi-part visuals like infographics, posters, and title screens hold their structure and small text stays legible. Grok Imagine Image 2.0 Preview also supports image editing, keeping subjects and details consistent across repeated generations.Try the model out now in , running on AI Gateway.imagine.vercel.shTo use Grok Imagine

<p>OpenAI gave a last-minute presentation at the Black Hat security on Wednesday about "the Hugging Face Incident" (<a href="https://simonwillison.net/2026/Jul/22/openai-cyberattack/">previously</a> on this blog). <a href="https://www.youtube.com/watch?v=87DyyMV0kCY">The video</a> was published yesterday. It's short and information dense and well worth watching, in particular because it provides full details of what happened and how things played out inside OpenAI....

<p><strong><a href="https://simonw.github.io/raccoon-heist-codex/">Moonlight & Mayhem (Raccoon Heist by Codex + GPT-5.6 Sol Ultra)</a></strong></p>On Wednesday I wrote about <a href="https://simonwillison.net/2026/Aug/5/raccoon-heist/">One-shotting a Raccoon Heist game using Claude Fable 5</a>, where I had Claude Fable 5 build a full working game from a premise I generated with GPT-3 and DALL-E <a href="https://twitter.com/simonw/status...

can now use as its inference layer and run its agent commands in an isolated microVM. Access 200+ models through AI Gateway at no markup on tokens, and every request appears in your AI Gateway dashboard with the rest of your usage and spend.Hermes AgentVercel AI GatewayVercel SandboxInstall Hermes, then pick Vercel AI Gateway in the setup wizard:The picker pulls live model availability and current pricing from AI Gateway. For the full walkthrough, see .Configuring HermesThe backend is opt-in. Co

View Transitions block interactivity (like clicks) while they are running. Maybe you don't want to do that.

now lets you make a repository public, so anyone with a Vercel account can pull and use its images.Vercel Container RegistrySharing already granted read access to up to 100 teams, and making a repository public opens that access to every Vercel team rather than a named set. Public access is read-only, so anyone can pull and use the images but cannot push, delete, or otherwise change the repository. Repositories stay private by default.Make a repository public from the project dashboard under Ima

<p><strong><a href="https://www.404media.co/the-tokenpocalypse-is-here-companies-are-scrambling-to-stop-spending-so-much-on-ai/">The Tokenpocalypse Is Here: Companies Are Scrambling To Stop Spending So Much on AI</a></strong></p>There's a fun anecdote from Accenture (apparently via leaked meeting audio recordings) in this 404 Media piece from June 24th:</p><blockquote><p>“We’re seeing from some of the data internally at least that it’s actua...

There's a lot of nuance to the <dialog> element, a seemingly little piece of web architecture. I've got some notes from digging into it.Using and Styling the Dialog Element originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

Cloudflare is shifting bot mitigation from point-in-time Risk assessment to continuous Trust evaluation. Learn how new good and bad behaviors from bots and agents are assessed by our systems, including BotBase and Precursor — and try out our Precursor Trace simulation to see how your own cursor movements would be assessed as human or bot.

Cloudflare Radar Researcher is a new AI-powered tool that lets you explore global Internet trends and traffic data using plain language. Built entirely on Cloudflare's Developer Platform, it turns natural language queries into real, interactive charts.

We are launching updated community programs, including Cloudflare Ambassadors and Community Engineers, backed by $1M in open-source funding. Learn how we are supporting maintainers and scaling our developer community.

Cloudflare is unifying AI Gateway and Workers AI into a single control plane, giving developers observability, billing, and dynamic routing across both managed GPUs and external providers. Learn how unified bindings and model-first routing simplify building resilient AI applications.

The gap between “you need a library for this” and “the browser does this” keeps closing. A practical guide to auditing your dependencies and finding what the web platform can now handle for you.

Your ‘App’ could have been a webpage (so I fixed it for you…)A thoroughly enjoyable read!SmoothCSSComplete CSS alumni, Rob McCormick, has built a really nice looking design system/CSS framework/UI kit.The CSS lh unitAn extremely useful unit for vertical relative sizing, explained by one of the best in the business at explaining CSS stuff.Astro LilyPondWant to render musical notation in Astro? Ky Decker has got you covered.They don’t make ’em like Sublime Text anymoreYou just can't beat Sublime t

Supabase is now a connector on Perplexity Computer. Query your Postgres data, look up users, and invoke Edge Functions from a Perplexity chat.

Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.

Audit Log Drains now stream your team's audit events into , , and , joining the existing custom HTTPS endpoint and Amazon S3 destinations. DatadogSplunkPantherAn forwards every event from your team's Activity Log, plus additional audit metadata, to the destination you choose. They're available on Enterprise plans. Audit Log DrainTo create one, go to in your team settings. Click Add Drain, choose Audit Log as the data type, and pick a destination. DrainsAudit Log Drains replace . If you already s

You can now bundle multiple agent skills into a shareable pack on .skills.shBuild a pack from community skills, your own local folders and zips, or public and private GitHub repositories. Every pack is unlisted, with its own URL. Share that link with a single person, or your whole team to standardize the skills across your projects.Install a pack with one command:Run to update a pack to its latest version.npx skills updateExplore and create packs at .skills.sh/packsRead more

はじめに こんにちは。グループIT推進本部の鷹雄です。 Codex Ambassadorとして、社内 ...

id:mizdra は Git の commit 署名をしていて、その署名鍵を 1Password で管理している。commit をする度に 1Password による生体認証を求められるが、その分安全に署名鍵を扱える。 今まではそれで不満は無かったのだけど、Coding Agent を使うようになってからというもの、この仕組みが足かせになっている。具体的には、Coding Agent にタスクを投げて人間が他のことをしている際に commit が試行され、人間が時間内に生体認証できずタイムアウトする、というもの。これのせいで、「人間はこれから寝るからこれやっておいて！」と投げたタスクが途中で…

HighlightsThe following rules have been updated to ensure that they behave correctly in some edge cases:accessor-pairsgetter-returnid-denylistid-matchno-unused-labelsno-unused-varsBug Fixes18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173) (dongkyu lee)151ba3f fix: false positives in getter-return and accessor-pairs (#21163) (Grit)6898df9 fix: ignore meta-property names in id-denylist (#21166) (Pixel)4d7db66 fix: ignore meta-property names in id-match (#21167) (Pixel)677214e fi

New subscriptions now include a domain free for the first year. ProThe offer covers six TLDs:.online.site.space.store.tech.websiteEach team has 30 days after subscribing to claim one domain, either at checkout or later from the in the dashboard.domain searchAfter the first year, your domain will at the regular price shown at checkout when you claim it.renew automaticallySee the for the full terms.free domain FAQRead more

<p><strong>Release:</strong> <a href="https://github.com/simonw/datasette-auth-tokens/releases/tag/0.4a13">datasette-auth-tokens 0.4a13</a></p> <p>Upgraded for compatibility with `sqlite-utils 4.</p> <p>Tags: <a href="https://simonwillison.net/tags/datasette">datasette</a></p>

Terminal coding agents like Claude Code, Codex, and OpenCode can now each run in their own isolated , orchestrated from , a tmux-style manager that runs them side by side in panes. Nothing an agent runs or edits touches your machine.Vercel SandboxHerdrWhen you start an agent, the plugin uploads your project files into a new Sandbox, installs the agent there, and opens a pane connected to it. The pane works like a local terminal; you type to the agent and watch it work. But it lives in the Sandbo

I had fun with the post about making a link to a random post in just HTML/CSS the other day. But I was almost certainly over-thinking it on the original. Using random() was kind of the point, so we can stick with that.

Go beyond chat in the GitHub Copilot app with these slash commands. They'll help you plan, collaborate, automate, and customize your dev workflow.The post A guide to slash commands in the GitHub Copilot app appeared first on The GitHub Blog.

Harness engineering is the code around an AI model that turns it into an agent. What a harness does, why it beats picking a model, and how to build one.Category: News

<p><strong>Release:</strong> <a href="https://github.com/simonw/datasette/releases/tag/1.0a38">datasette 1.0a38</a></p> <blockquote><p>This release fixes a <strong>SQL injection</strong> security issue that affects Datasette instances that serve a <strong>mixture of public and private tables</strong> in the same database, with access configured using the <a href="https://docs.datasette.io/en/latest/authentication.html"&g...

<p><strong>Release:</strong> <a href="https://github.com/simonw/datasette/releases/tag/0.65.3">datasette 0.65.3</a></p> <p>Back-ported the SQL Injection security fix from <a href="https://simonwillison.net/2026/Aug/6/datasette/">1.0a38</a>.</p> <p>Tags: <a href="https://simonwillison.net/tags/datasette">datasette</a></p>

<p><strong><a href="https://writethatblog.substack.com/p/simon-willison-on-technical-blogging">Simon Willison on Technical Blogging</a></strong></p>I was interviewed by Cynthia Dunlop for her "Write that blog!" series back in January, but I just realized I never linked to the interview from my own blog!</p><p>It includes my answers to the following questions:</p><ul><li>Why did you start blogging – and why do you continue?</li...

GitHub malware advisories no longer stop at npm. Here's how we wired OpenSSF's malicious-packages data into the Advisory Database, and why we built the pipeline paranoid.The post How we took malware advisories beyond npm appeared first on The GitHub Blog.

A few notes and takeaways from the 2026 State of CSS survey results, including a nice CSS-Tricks cameo!2026 State of CSS, Devs Surveys originally handwritten and published with love on CSS-Tricks. You should really get the newsletter as well.

AI Search makes search easier than ever, with no Cloudflare primitives to stitch together. Point it at your data to create a search for your own files and websites. We're also sharing a preview of our new pricing model.

The next version of MCP has a rewritten, stateless core that just works on Workers. We cover upgrades to the protocol, the new feature lifecycle and SDK migration path, and hear from early adopters already running it in production.

More than half of requests now come from machines, not people. Agent Readiness shows how well agents can discover and read your site, while Answer Engine Optimization tracks how often AI assistants recommend you.

Agents are a new kind of visitor. They don't render CSS or click ads, but they have a paying human on the other end. Block them and you block your customer. We're building the open tools and protocols so publishers and agents can cooperate and not collide.

We should be giving all agents tools that excel at what’s important for an AI model. Kitesurf is Cloudflare’s new stateless, highly scalable, and cost-effective web browser that runs entirely on top of Workers and was designed specifically for the Agentic Cloud.

Today we're launching a developer preview of WebMCP on Cloudflare. With one switch, any site becomes usable by browser AI agents — no new APIs, no origin changes — while the human stays in control and creators keep their traffic.

Highlighting in CSS has been beneficial for applying a highlight on specific text or text fragments during user selection, emphasizing a piece of information on a website, or visually emphasizing a text for the sake of branding. Particularly, this is pretty helpful when users want to scan your document from top to bottom because the majority of people don’t read your document initially; they scan.On the web, text highlights are a good way to lay emphasis on text fragments through good ol’ CSS. F

The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

<p><strong><a href="https://www.cnn.com/2026/08/05/tech/meta-ai-hacking">An AI model from Meta also hacked another company during testing</a></strong></p>Stop me if you've <a href="https://simonwillison.net/tags/accidental-cyberattacks/">heard this one before</a>:</p><blockquote><p>An AI model from the parent company of Facebook and Instagram hacked into another company’s systems during cybersecurity testing, a spokesperson confi...

Astro 7.2 adds experimental incremental static builds, an option to opt out of session support, background mode for astro preview, and relative logger entrypoints.

Today, Agent Plugins 1.0.0 is publicly available. is an open, vendor-neutral standard for plugins that extend AI agents. Agent Plugins provide reusable instructions and resources for AI agents. connect agents to tools and services. Both can be reused across clients, but clients often package and discover them differently.Agent SkillsMCP serversAgent Plugins gives compatible clients a common format: a directory with a manifest and fixed locations for its components. The format is intentionally sm

from ByteDance is now available on AI Gateway. It generates up to 30 seconds in a single clip, holding camera movement and continuity without stitching shots together in post. Short clips can also be extended with character, scene, and camera movement carried over.Seedance 2.5Seedance 2.5 supports text, video, image, and audio as inputs in the same request, following a subject's appearance from one asset and the motion or camera work from another. On a finished video it edits locally, swapping b

When you install a integration from the Vercel CLI, it now also installs that provider's agent skills from , so your agents know how to use it: Vercel Marketplaceskills.shThis happens automatically for any provider that publishes skills.You can also find integrations without leaving the terminal:Update to the latest Vercel CLI with , then read the to get started.npm i -g vercel@latestintegration documentationRead more browses available providers.vercel integration discover lists all the Marketpl

from ANT Group is now on AI Gateway, free to use till 8:00am PT on 8/14. Ling 3.0 Tiny takes the free slot from .Ling 3.0 TinyLing 3.0 FlashLing 3.0 Tiny is a MOE model with 7.9B total parameters and about 1.3B active per token, a 256K token context window, and up to 32K output tokens. The model is built for responsive agents, instruction following, and multi-turn conversation, with native function calling and prompt caching.To use Ling 3.0 Tiny, set to in the . On August 14th, the new model nam

Agent Plugins 1.0.0 is now available. It is an open, vendor-neutral standard for packaging Agent Skills and MCP servers into portable plugins. Compatible agent clients can discover and load them.Agent Plugins defines a common format: a root manifest, plus fixed locations for portable components. Each client keeps control of installation, distribution, policy, user experience, and client-specific capabilities.plugin.jsonAt launch, Agent Plugins is supported across the following clients:Read the ,

You can build human-in-the-loop approvals with Chat SDK through the new subpath. One call posts a card with Approve and Deny buttons and suspends a workflow until someone decides.chat/workflowrequestApprovalWorkflow SDKThe wait can last seconds or days and survives deploys and restarts. You don't need an approvals table, an handler, or a polling loop:onActionStart the workflow from any handler, and instances serialize across the workflow boundary automatically. The card handles the rest:ThreadGe

<p><strong><a href="https://research.meta.ai/blog/introducing-muse-code-and-muse-spark-1-2">Introducing Muse Code and Muse Spark 1.2</a></strong></p>Yet more evidence that the most important characteristic of any model these days is long-sequence agentic tool calling. Meta shipped their own coding agent as part of getting that to work!</p><blockquote><p>Muse Spark 1.2 is a coding-focused update to Muse Spark 1.1, with improvements in code ge...

<p><strong><a href="https://openai.com/index/third-party-cyber-evaluations-involving-openai-models/">Third-party cyber evaluations involving OpenAI models</a></strong></p>And <em>another one</em>. I had to create a <a href="https://simonwillison.net/tags/accidental-cyberattacks/">accidental-cyberattacks tag</a> to keep track of them all!</p><p>This post from OpenAI covers both the UK AI Safety Institute attack (see <a hr...

<p><strong><a href="https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing">Incident Report: unsanctioned agent behaviour during cyber testing</a></strong></p>It happened <em>again</em>. This time it was the UK government's AI Security Institute who accidentally attacked other companies while running an evaluation with models with the safety filters turned off. From <a href="https://cdn.prod.website-files...

We're honored to announce that Cloudflare is the only vendor that has been recognized as a Visionary in both the 2026 Gartner® Magic Quadrant™ for SASE Platforms and the 2026 Gartner® Magic Quadrant™ for Security Service Edge reports.

カミナシのID管理基盤を開発しているmanaty（@manaty226）です。カミナシ ID管理基盤におけるログストレージへのAmazon S3 Tables（以下、S3 Tables）利用について、7月28日に行われたAWS AI Ready Data Platform Dayで発表しました。一日を通して非常に学びになるイベントだったので共有したいと思います。

<p>Back in 2022 <a href="https://twitter.com/simonw/status/1555626060384911360">I tweeted</a> screenshots of a game concept generated by GPT-3 and some concept "art" created using DALL-E. Today, on the fourth anniversary of that tweet, I decided to see if Claude Fable 5 (running in <a href="https://code.claude.com/docs/en/claude-code-on-the-web">Claude Code for web</a>) could build the entire game from the content of that tweet. It did a pretty good job of it!</...

During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Three summer disclosures documented AI agents attacking real organizations with no human intent in the chain. Incident response has no box for this yet.Category: News

You can now set a project's avatar from its settings in the Vercel dashboard. Until now, Vercel set it automatically, using the favicon from the project's production deployment. That's still the default if you haven't set one.The avatar renders across the dashboard and on Vercel bot comments in GitHub. Microfrontend projects that share one favicon can now get distinct avatars, and backend projects with no favicon to detect can set one explicitly.You can change a project's avatar from its in the

Buying a domain on Vercel now takes you to a setup page that tracks registration live, with direct paths to deploy a new project, connect an existing one, proxy or redirect a site you already run, or set up email.Registration can take a few minutes. Each setup action unlocks as soon as the domain is ready. If registration fails, the page shows what went wrong and the status of your refund. opens project creation with the domain preselected. Connect a Git repository, prompt with v0, or start from

Includes background-clip for masking backgrounds, vertical-align for aligning elements, box-decoration-mode for consistent edge styling, letter-spacing for spacing control, and text-combine-upright for vertical text layouts.

記事は ics.media へアクセスしてご覧ください。