August 2026 Summaries

Vercel created design.md, a public file that gives coding agents design guidance outside its repositories, helping one-off reports, proposals, and pages retain the company’s typography, color, hierarchy, copywriting, responsiveness, and information architecture. Rather than directly publishing its internal product-design skill, Vercel rebuilt the guidance through fixed evaluation scenarios, discovering that prose alone was insufficient without concrete rules, reusable visual primitives, and iterative testing. The resulting system combines design.md for judgment and page composition, a public stylesheet with documented CSS classes and tokens that limits agents’ ability to invent inconsistent layouts, and an evaluation loop using human review alongside deterministic checks for mechanical failures. Across more than 200 runs, pages generated with design.md showed 57% fewer known checked failures than pages without it in a small test, although all outputs still required review and the measurement could not assess overall design quality. Vercel keeps the system current through feedback from its internal Slack design agent, GitHub reviews, and Figma comments, turning recurring issues into improvements to prompts, stylesheets, checks, or evaluation scenarios, while recommending that others begin with a single recurring artifact, a saved baseline, observable design corrections, and human-reviewed comparisons.

Workflow SDK is a Vercel-developed, open-source TypeScript framework for durable execution that aims to let developers write long-running, stateful workflows as ordinary code rather than manually defined task graphs or separately managed worker systems. It uses directives such as “use workflow” for orchestration and “use step” for durable side-effecting operations, while supporting normal language constructs including awaits, branching, parallelism, retries, loops, and error handling. The SDK replaces separate workflow signals, queries, and updates with hooks, including webhooks that can pause a workflow until an external response arrives. Designed as a library rather than a proprietary orchestration platform, it can run on existing applications, databases, queues, and streaming systems through a pluggable “World” interface, with Postgres and Vercel-backed implementations available. The Vercel implementation is described as a stateless CRUD service, while workflow logic remains in the Apache-licensed client library. Versioning is handled on Vercel by pinning runs to their original immutable deployment, avoiding failures from code changes during in-flight executions, although other backends must implement comparable support. The project is focused on reducing the performance overhead of durable steps, with Workflow v5 reporting up to fivefold improvements and further work planned for v6.

Vercel Connect is now generally available as a platform for connecting applications and AI agents to more than 100 services, including Slack, GitHub, Snowflake, Shopify, and custom OAuth or API-key services, without storing long-lived provider credentials in application environments. Instead, applications use their Vercel deployment’s OIDC identity to request short-lived, automatically refreshed tokens at runtime, with permissions scoped to individual tasks, repositories, users, or services where supported. The service aims to reduce credential rotation, leakage, and revocation risks while enabling agents to act either as an application or on behalf of a user through consent-based authorization. General availability adds governance features such as role-based access controls, audit logs, token and trigger observability, per-environment connector configuration, and centralized revocation. Connect also handles inbound provider events through Triggers, verifying webhook signatures and forwarding OIDC-attested events without requiring apps to store bot tokens or signing secrets. It integrates with Vercel tools and frameworks including eve, Chat SDK, AI SDK, MCP, Auth.js, Better Auth, Workflows, and v0, and is available on all plans with free Hobby allowances and usage-based pricing for Pro and Enterprise customers.

Run SDK is a newly released package for executing untrusted JavaScript and type-stripped TypeScript within applications without granting direct access to Node.js, networks, credentials, or internal services. It runs each program in a fresh QuickJS worker-thread context and lets applications expose narrowly scoped, serializable host functions for approved data access and actions, enabling agents to coordinate tools, process results locally, and return only useful outputs. The SDK supports interruptions for authentication and human approval through signed resume tokens, replaying programs while reusing recorded host-function results so completed work is not repeated. Configurable time and memory limits, disabled dynamic evaluation, and hardened built-in prototypes provide additional safeguards, although host functions remain trusted code responsible for normal authorization checks. Originally developed from the js-exec runtime in just-bash and tested in eve, the execution layer now powers code mode in the AI SDK, supports Node.js 22.13+ and Bun, and is intended for in-application computation rather than workloads requiring operating-system or process-level isolation.

v0’s Snowflake integration addresses the risk of AI-generated, unreviewed code accessing users’ OAuth credentials by routing all Snowflake traffic from isolated sandboxes through a server-side request proxy built on the Vercel Sandbox firewall. Rather than placing real credentials in the sandbox, the system provides clients with a public placeholder token while the proxy verifies the sandbox’s OIDC identity, retrieves a fresh user credential server-side, and injects it only into protocol-defined authentication fields. This approach avoids the flaw of blindly replacing placeholder text in requests, which could expose a real token through attacker-controlled SQL or other request content. The proxy also restricts token-bearing traffic to the connected Snowflake account, rejects malformed or unsafe requests, limits request sizes, and logs operational metadata without secrets. Temporary Snowflake session tokens may exist after authentication but are short-lived and removed with the sandbox, while deployed applications authenticate independently through Snowflake-managed service credentials. After handling roughly 13,000 requests in its first 15 production days without placeholder misuse incidents, the beta integration illustrates a broader pattern for enabling AI-generated applications to use external services without granting them access to long-lived user credentials.

Vercel for Slack, now in public beta for Pro and Enterprise teams, brings Vercel Agent into Slack channels, threads, and direct messages so teams can investigate production issues, review pull requests, manage deployments and configuration, and create tested PRs without leaving their discussions. The agent uses built-in context from Vercel, including deployments, logs, metrics, build statuses, code reviews, and feature flags, as well as the surrounding Slack conversation, to diagnose incidents, correlate errors with releases, identify risky changes, and answer codebase or infrastructure questions. It can translate decisions reached in threads into proposed actions such as fixes, rollbacks, cache purges, or configuration updates, while remaining read-only by default and requiring explicit team approval of a scoped plan before making any changes. Vercel positions the integration as a way to reduce context loss and duplicated investigation by keeping diagnosis, discussion, decisions, and execution in the same conversation, although it advises users to review all proposed changes because the agent can make mistakes.

Vercel has launched a two-week public HackerOne challenge offering up to $1 million in total rewards for researchers who can break the isolation of its Vercel Sandbox platform, reflecting concerns that secure execution of untrusted agent code requires both compute and network boundaries. Running from August 18 through September 1, 2026, the program offers up to $50,000 per report for demonstrated vulnerabilities that enable cross-tenant data access or modification, with rewards determined by severity and impact. Vercel Sandbox uses Firecracker microVMs on bare-metal EC2 hosts, placing user code in Linux containers inside dedicated guest kernels and enforcing outbound TCP, DNS, destination-policy, and credential controls from the host side. Eligible findings include microVM escapes, cross-tenant compute attacks, denial-of-service attacks against another sandbox, and firewall bypasses that enable unauthorized access, data exfiltration, or credential retrieval, while container escapes limited to the guest operating system are excluded. Researchers must submit live, reproducible proofs of concept through HackerOne rather than static-analysis findings, and Vercel plans to fix confirmed issues, pay successful participants, and later publish details on the discovered techniques and mitigations.

Vercel’s Winter 2026 internship cohort was structured around treating interns as full engineering contributors, with participants shipping production features across the CDN, v0, financial infrastructure, and AI Gateway during a four-month program in San Francisco. Projects included dashboard, API, CLI, and AI-assisted routing and firewall tools; v0 collaboration features, infrastructure cost reductions, Slack-agent improvements, automated model routing, and enterprise integrations; standardized billing APIs, entitlement systems, and purchasing services; and AI Gateway pricing transparency and endpoint migrations. The interns’ work supported customer-facing launches, enterprise deals, reliability efforts, and systems used at substantial scale, while several participants also handled customer communication, incident response, and complex production infrastructure. Their advice for future interns emphasizes taking initiative, asking questions, sharing work openly, building relationships beyond one’s team, and allowing time to learn the codebase and organizational pace before accelerating.

AI SDK maintainers created ai-sdk-factory, an open-source, human-supervised automation system to manage growing volumes of community issues and pull requests across a widely used AI infrastructure project. Rather than relying on general-purpose coding agents alone, the factory assigns specialized agents to tasks including issue classification, feature and bug analysis, implementation, review, documentation updates, and release backports, while preserving human approval for every merged change. It evaluates work with documented evidence so reviewers can calibrate scrutiny according to risk, and runs agents in isolated sandboxes with limited secrets and network controls to address untrusted public inputs. Built first through a local CLI and later deployed on Vercel-based infrastructure, the system processes GitHub webhooks through queues and provides a monitoring interface for reviewers. In its first four weeks, it reportedly authored 25–35% of weekly merged main-branch pull requests, closed more than 75% of closed issues in July, increased support for older release lines through automated backports, and helped reduce the open-issue backlog. Failed or incomplete agent runs are categorized as flawed, blocked, or manual and used as feedback to improve prompts, evaluations, environments, and the boundaries of automation over time.

Vercel migrated the state supporting its build warm pool from Redis to DynamoDB after recognizing that Redis, used as an ephemeral cache, held critical billing mappings that could not be reconstructed if lost. The live migration required a redesigned container-centered DynamoDB schema, hashed tokens, expiry-aware status indexes, and a separate strongly consistent billing-mapping table, followed by feature-flagged phases including dual writes, shadow reads, primary reads, and monitored rollback options. Shadow comparisons exposed an inefficient status-counting implementation that caused excessive load until an index was added, while a Redis outage later demonstrated that state already moved to DynamoDB remained available. After DynamoDB’s higher read latency caused the pool’s supply loop to stall because it performed a state check before each container creation, engineers identified a pre-existing N+1 query pattern masked by Redis’s speed and replaced serialized operations with concurrent supply calls that tolerate limited overprovisioning. Completed in April, the migration removed Redis from warm-pool paths, made essential state durable, and improved the pool-management design by eliminating its dependence on exceptionally low per-query latency.

AI Gateway’s August 2026 Production Index, based on anonymized routing data through July, reports that token volume rose 59% and spending increased 37%, while the average price per token fell 13.6% as companies shifted workloads toward lower-cost models. DeepSeek became the second-largest lab by token volume, surpassing Google with about one-quarter of gateway tokens, largely driven by its low-cost V4 Flash model, while open-weight models reached 36% of volume and 8.6% of spending. New open-weight agent models, Moonshot’s Kimi K3 and Z.ai’s GLM 5.2, contributed most of the increase in open-weight spending by attracting higher-value workloads. Anthropic retained a dominant 65.1% share of spending despite handling about 30% of token volume, reflecting prices averaging 4.4 times those of other labs and continued strength in coding-agent workloads. Google’s token share declined sharply but its Nano Banana models overtook OpenAI’s GPT Image in image-generation volume, while ByteDance’s Seedance led video generation in both volume and spending.

AI’s growing cybersecurity capabilities are changing both offensive threats and defensive practices, with the author arguing that defenders currently retain a temporary advantage through access to stronger safeguarded frontier models than the openly available models capable of offensive research. The post cites a reported Hugging Face-related incident in which models discovered vulnerabilities that bypassed network restrictions and enabled broader exploitation, while also describing tests in which the open-weight Kimi K3 independently investigated potential sandbox escape paths, built a reproduction environment, and created a fuzzer without achieving an escape. It contends that frontier models can already support defensive tasks such as large-scale source-code security reviews, prompting the development of the open-source deepsec tool, which is presented as useful for identifying issues including authorization flaws, cross-site scripting, and server-side request forgery. Vercel says it performs recurring deepsec reviews and automated pull-request checks, has expanded sandbox egress firewall access, plans a HackerOne program focused on sandbox and firewall vulnerabilities, and intends to use AI-assisted triage to manage findings as models become more capable.

Safe execution of untrusted or AI-generated code requires both compute isolation and strict network egress controls, since a microVM alone cannot prevent code from exfiltrating accessible data, scanning internal services, or abusing credentials through permitted network paths. The discussion emphasizes that DNS, proxies, identity systems, package registries, and allowed destinations all form part of the practical sandbox boundary, and that useful environments need selective, temporary connectivity rather than either unrestricted internet access or total disconnection. Vercel Sandbox enforces these controls with a host-level firewall that intercepts outbound TCP and DNS traffic, applies domain and CIDR policies, examines TLS SNI without decrypting ordinary permitted traffic, and can selectively inspect HTTPS requests when credential injection or request forwarding is configured. Credentials can remain outside the microVM and be injected only for narrowly defined destinations and operations, reducing the risk that malicious code can steal reusable secrets. Organizations can also route selected requests through their own proxy to apply contextual authorization, auditing, content filtering, or supply-chain rules. Vercel presents these firewall capabilities as a baseline feature, arguing that a sandbox’s security depends not only on where code runs but also on what it can contact, what authority it receives, and how those permissions evolve during execution.

Agent Plugins 1.0.0 is an open, vendor-neutral standard that provides a common packaging format for reusable AI agent extensions, specifically Agent Skills and MCP servers. A plugin uses a simple directory structure centered on a minimal plugin.json manifest, with Skills placed in a skills directory, MCP server configuration in mcp.json, and optional namespaced files for client-specific extensions. The specification standardizes discovery, validation, and loading while allowing clients to retain control over installation, distribution, policies, user experience, and proprietary capabilities; invalid components also do not prevent unrelated components from loading. Proposed by Vercel and developed with contributors from AWS, Anysphere, GitHub, Microsoft, OpenAI, and Vercel, the project is openly governed and designed to avoid control by any single vendor. Supporting clients at launch include ChatGPT and Codex, Cursor, GitHub Copilot, Kiro, and VS Code, enabling extension authors to package compatible components once for use across these platforms.

Vercel’s generally available v0 API provides programmatic, headless access to its app-building agent, enabling developers to send prompts that generate and modify applications in isolated chat workspaces with live Sandbox previews. Each chat preserves an app’s state across follow-up requests, while v0 can read, edit, run, verify, and fix code in real time; developers can use synchronous, asynchronous, or streaming workflows and display detailed agent activity such as file edits, commands, and tool calls. Apps can be created from prompts, existing repositories, ZIP files, or file sets, embedded through securely proxied preview URLs, customized with MCP tools and saved design-system skills, and deployed to Vercel through the API. The API can also be integrated into external agents through MCP, the AI SDK, or eve, supporting use cases including white-labeled app builders, automated code changes, and agent-driven app generation. Users migrating from the prior API must recreate chats from exported versions and adopt the v2 endpoint, chat-based state model, metadata organization, and message-part rendering.

Next.js 16.3 introduces significant improvements in prefetching, static asset management, and routing to enhance application performance and observability on Vercel. The update reduces prefetch requests by 45% on average, thanks to leaner prefetching strategies and immutable static assets that cut CDN requests by 17% and bytes transferred by 24%. Routing metadata optimizations ensure faster p99 route resolution, doubling the speed for large sites by combining metadata entries into JSONL-formatted shards, which improves cache hit rates. The release also enhances observability, allowing developers to monitor prefetch requests, cache revalidations, and Partial Prerendering (PPR) performance, which integrates Incremental Static Regeneration (ISR) and Vercel Functions to efficiently serve both static and dynamic content. These changes are designed to offer a more efficient and scalable experience for developers using Next.js 16.3 on the Vercel platform.

Factory, a platform enabling autonomous software development, efficiently handles tens of millions of daily backend API requests with a 350ms p95 response time, leveraging Vercel’s infrastructure since its inception. By adopting an agile operation model and using Droids to automate routine tasks, Factory allows engineers to focus on core product development. The platform utilizes Next.js as a full-stack backend to manage customer-facing APIs, middleware, and webhook handlers, scaling seamlessly without the need for separate infrastructure. Factory also empowers non-technical teams through Droids, enabling them to autonomously build and deploy internal tools and customer-specific solutions, while engineers set essential guardrails. To secure its consumer-facing services, Factory employs Vercel’s Web Application Firewall and observability tools to manage threats and ensure continuous protection. As Factory continues to grow, it relies on Vercel’s scalable infrastructure to support its mission of revolutionizing the software development lifecycle with autonomous solutions.