• Building DotAgent — give your Dot its own email → https://teapawt.net/t.co/aUbDJNHK4R • 2 SaaS that shall not be named 🪄 … yet • Front-end developer, UI/UX
United Kingdom
Joined August 2013
- Tweets197
- Following118
- Followers53
- Likes49
Pinned Tweet
Your ChatGPT Dot has its own computer.
So I had a thought…
Why doesn't it have its own email address?
So I'm building DotAgent.
Give your Dot its own email. Let it handle routine conversations - and involve you only when it needs you.
Would you use this?
dotagent.me
Having a model specifically tuned for security work inside Copilot is useful.
The open question is how often teams will still need a separate review step when the agent itself is the one proposing the change.
🆕 @GoogleAI's Gemini 4 Carbon is now generally available in GitHub Copilot.
Designed for complex coding, agentic, and reasoning tasks, it has a special focus in security work.
Try it in the GitHub Copilot app, CLI, and @code.
github.blog/changelog/2026-1…
1
Next.js now has an agent skill that can look at your Turbopack module graph and suggest where JavaScript is being pulled in unnecessarily.
Useful for cutting unused code or moving things to Server Components, but you still need to check the suggestions before applying them.
#NextJS #frontend #webdev
1
42
The shift toward newer models (more than half of requests going to models 60 days old or less) is the part that stands out.
Switching costs are lower when the model is treated as a replaceable piece rather than something locked into the application.
The November 2026 AI Gateway Index is live.
1. New paid teams chose Anthropic models nearly 2:1 over OpenAI.
vercel.com/blog/ai-gateway-p…
5
Running a vulnerability review on every push is useful, but the one-click fix step is the part that decides whether teams actually act on it. Most security tools stop at the report.
Today we are launching Vercel Security Review in public beta.
Run vulnerability reviews on every push, and ship fixes in one click with Vercel Agent.
Read the blog → vercel.com/blog/vercel-secur…
4
The supply-chain angle is the real story here—once a modified package can land under a trusted name, marketplace signing and publisher verification become the actual defense.
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products.
In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk.
If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314: cursor.com/blog/claude-code-…
7
The shift from “did someone read the diff?” to “what check is most likely to catch what can go wrong?” is the real change. Most traditional review processes were never built for this volume.
2
17
This is useful. OIDC setup is one of those things that looks simple until you hit the edge cases around providers, token verification, and form validation.
Having a ready registry that pulls the right pieces together saves a lot of repetitive, error-prone work.
Speaking of security, we created a registry for building OIDC configuration components.
Pick your providers, form and validation libraries, and token verifier (powered by jose). Then run one command to copy everything into your app.
I've built these a few times before. I know how annoying they can be to get right. Hope this helps.
ui.shadcn.com/oidc
12
Automatic resume after failures is the practical piece 👍🏻
Long-running agent work usually dies on a timeout or a transient error, so a harness that keeps the run going removes one of the main reasons these workflows stay fragile.
Introducing 𝚍𝚞𝚛𝚊𝚋𝚕𝚎-𝚑𝚊𝚛𝚗𝚎𝚜𝚜. Run Pi, OpenCode, Codex, Claude Code, eve, fx, or your own harness durably on Vercel.
With 𝚍𝚞𝚛𝚊𝚋𝚕𝚎-𝚑𝚊𝚛𝚗𝚎𝚜𝚜, agents automatically resume work after failures and run for hours, days, or months. vercel.com/blog/making-every…
1
12
A practical frontend observation: most "slow" interfaces I see still come from too many options visible at once, not from the framework or the styling approach.
Cutting a field, a step, or a rarely used control usually improves the experience more than switching CSS solutions or adding animations.
#frontend #UI #webdev
🤖 Made with AI
9
The no-patch-for-PHP-7 note is the real signal—anyone still on 7.x should treat this as the final forced migration window rather than a normal security update.
At 14:00 UTC two critical security vulnerabilities will be patched in PHP.
These are extremely serious vulnerabilities affecting every PHP application on the web.
Laravel Cloud customers: we will begin automatically patching your applications as soon as the patch is released. No manual action is required.
Laravel Forge customers: you will need to manually update your server’s PHP version via the server’s Forge dashboard. If you are unable to update your server, it should be powered down.
Laravel Vapor customers: we will begin automatically re-deploying applications running on PHP 8 as soon as the patch is released. No patch is being released for PHP 7 -- immediately update all applications to PHP 8.
126
🚨 CRITICAL PHP SECURITY ALERT: GET READY TO UPGRADE 🚨
The PHP security team has announced an emergency release on Oct 21 to patch two highly critical vulnerabilities (both rated CVSS v4.0 9.2).
If you manage servers running PHP, you must prepare to apply updates immediately:
👉 Affects currently active & supported PHP branches (8.2, 8.3, 8.4, and 8.5)
👉 Both vulnerabilities carry a CVSS 9.2 severity rating, opening risks to unauthenticated remote code execution (RCE)
👉 Administrators must ready their deployment pipelines for immediate patching.
Plan your update schedules and check with your DevOps teams, web hosts, or system admins as soon as the fixed releases go live.
🔗 Stay updated on the official release: php.net/archive/2026.php#202…
#PHP #InformationSecurity #SysAdmin #SecOps #DevOps #WebSecurity #Vulnerability #CriticalRelease #PHP8
129
We're officially moving past the "prompt-and-pray" era of AI.
The shift to autonomous multi-agent swarms—where specialised models debate, debug, and build complex software architectures collaboratively without human bottlenecks—is changing everything.
Are you building with single models, or are you orchestrating multi-agent systems yet? 🧵 👇
#AI #TechTrends #SoftwareEngineering #FutureOfWork
9
Agents that can read product pages and use MCP for search and carts change how structured product data is used.
With the template generally available, you can test the flow without building the storefront from scratch. Nice!
Vercel and @Shopify are making agents first-class shoppers. Vercel Shop, our Next.js storefront template for Shopify, is GA.
• Built on Shopify's rebuilt Hydrogen SDK
• Agents can read product pages directly
• MCP for product search and carts vercel.com/blog/vercel-and-s…
6
"Let's enable it and hope" ❌
"Capture navigation, write a test, let the agent refactor until it passes" ✅
Such a clean playbook for Next.js prefetching. Stop guessing about UX performance and start test-driving it with agents. Love seeing you build with your own tools like this!
We used a coding agent with Next.js 16.4's new prefetching controls and Skill to improve v0's navigation experience at no added cost.
The loop:
• Capture navigation with 𝚒𝚗𝚜𝚝𝚊𝚗𝚝()
• Define the target UI in the test
• Refactor until it passes
nextjs.org/blog/improving-na…
1
2
28
Next.js shipped an out-of-band security update on 14 Oct (v16.4.1 / 15.5.28).
It fixes two critical unauthenticated RCE issues: one in Cache Components when a use cache function returns multiple typed arrays, and one in SVG image handling via sharp on glibc Linux. There’s also a high-severity DoS in Server Actions.
If you’re on 16.x or 15.x, upgrade. No known workaround for the Cache Components one.
#Nextjs #webdev #security
5
shadcn just released Trace and Code Block, plus AI Elements patterns for agent interfaces.
Trace is a reusable way to show agent steps (reasoning, tool calls, subagents).
Useful if you’re building anything that displays agent activity.
ui.shadcn.com/docs/changelog…
#frontend #AI #shadcn
8