Rust crates.io removes malicious supply chain attack
Five typosquat crates plus compromised arrayref/internment versions deleted after build-script payload injection; 86–107 minute exposure window.
If your Cargo.lock pulled append-only-vec@0.1.9, arrayref@0.3.10, or internment@0.8.7 between 2026-08-20 07:15–09:25 UTC, you downloaded malicious binaries. Scanning local cache is mandatory; credential compromise on arrayref maintainer signals ongoing registry risk.
Run the provided `find` command against ~/.cargo/registry/cache immediately to detect affected crate files. No mitigation exists for already-built artifacts—rebuild and redeploy if positives found. Downgrade to pre-malicious versions (arrayref <0.3.10, internment <0.8.7, append-only-vec <0.1.9) and audit build logs for the exposure window.
- “the crate had a build script that was downloading a malicious payload”
- “append-only-vec@0.1.9: published at 2026-08-20T07:37:49Z, deleted at 2026-08-20T09:25:24Z. Online for 107 minutes”
- “arrayref@0.3.10: published at 2026-08-20T07:15:00Z, deleted at 2026-08-20T08:41:40Z. Online for 86 minutes”
- “their computer or credentials are likely compromised”
supply-chain-securityrustcrates-iomalwareincident-response
GLM 5.3 FlashX now serves at 200 tokens/sec
Z.ai's multimodal coding model available on Vercel AI Gateway with ~200 tokens/second inference speed for streaming agents and interactive tools.
Faster token throughput directly reduces latency in coding agents and tool loops where users wait on generated output. Integrates via unified API gateway with cost tracking, failover, and no platform fees.
Replaces slower Z.ai model variants for streaming workflows. Requires AI Gateway API key and model string `zai/glm-5.3-flashx`. Setup is trivial (`npx vercel ai-gateway setup`) and works today across Claude Code, Codex, Hermes, and OpenAI-compatible clients. Worth trying now if you run inference-heavy agents.
- “delivering inference at ~200 tokens per second for faster streamed responses”
- “The higher serving speed is useful for coding agents, tool loops, and interactive applications where users wait on generated output”
- “AI Gateway reflects provider pricing with no markup and does not charge a platform fee on inference”
model-servingai-gatewaycoding-agentsinference-speedstreaming
Claude Opus 5.5 launches with adaptive thinking, faster inference
Opus 5.5 removes manual thinking budget and forced tool use, requiring prompt-driven steering instead—trade control for 30% speed and 40% cost reduction per task.
Breaking API changes (thinking always adaptive, forced tool use retired) force immediate code rewrites for existing Opus 5 integrations. The agentic improvements and long-context reporting reduce supervision overhead in multi-step workflows.
Replaces Opus 5 for agentic/coding tasks; requires removing think budget parameters and tool forcing calls, switching to structured outputs for JSON returns. Ready now via AI Gateway, SDK, or OpenAI-compatible API. Plan 1-2 hour migration if heavily invested in Opus 5 agent code.
- “~30% faster and ~40% cheaper than Opus 5 per task”
- “Thinking is always adaptive. Requests that disable thinking or set a fixed thinking budget are rejected.”
- “Forced tool use is retired. Requests cannot require a tool call or force a specific tool.”
- “It is a step-change improvement over Opus 5, with its biggest gains in agentic coding, long-running agent tasks, and knowledge work”
- “has a 1M-token context window, returns up to 128K tokens, and has a June 2026 knowledge cutoff”
claude-opusapi-breaking-changeagentic-aicost-optimizationvercel-ai-gateway
Vercel Connect reaches general availability across all plans
Runtime token generation replaces stored secrets; OIDC-backed scoped access with 100+ preset connectors, audit logs, and MCP integration.
Eliminates credential sprawl in agent deployments. Tokens mint on-demand with automatic expiry and user-scoped identity, reducing blast radius of compromised secrets and simplifying compliance audits.
Replaces manual OAuth flows and long-lived provider API keys. Requires Vercel CLI registration (`vercel connect create`) and adapter imports for your auth stack (Better Auth, Auth.js, AI SDK, MCP). Ready now—GA on all plans with SDKs available.
- “Instead of storing long-lived provider secrets, your code requests short-lived, scoped tokens at runtime”
- “Connect ships with 100+ preset connectors for tools like Notion and Workday, managed connectors for Slack, GitHub, Linear, Salesforce, Snowflake, and Microsoft”
- “Triggers deliver provider events to your app without a stored secret”
- “Hobby includes 500 token requests and 1,000 triggers per month at no additional cost”
- “Request a token only when your code needs one, with `getToken`”
credential-managementoidcagent-toolingintegrationssecrets
Deploy eve agents from Vercel dashboard now
Vercel dashboard now scaffolds, deploys, and git-backs eve agents with model selection and tool integration in one flow.
Eliminates agent scaffolding and deployment friction—go from dashboard clicks to a running agent with customizable code repo in minutes. Reduces boilerplate setup time for teams building conversational tools.
Replaces manual eve agent project setup and Vercel deployment steps. Requires Vercel account and eve framework familiarity. Ready now—live feature with Next.js web chat and Slack integrations included.
- “You can now create eve agents directly from the Vercel dashboard, giving you a deployed agent that you can chat with right away”
- “The builder scaffolds the agent, creates a private Git repository with its files, and deploys it as a new Vercel project on your team”
- “Give the agent tools and data from other services through built-in connections like Linear and Notion, or a custom MCP server”
eve-agentsvercel-dashboardagent-deploymentai-gatewaymcp-integration