Organization

Vercel

1 mentions in 7 days · 3 in 30 days · 3 total · first seen Aug 27, 2026 · last 5d ago

Timeline3 articles

OpenAI Launches the Agents API in Public Beta, Putting the Codex Harness Behind One API Call

OpenAI released its Agents API in public beta, exposing the managed Codex harness with hosted or self-hosted sandboxes, MCP tools, and subagents.

The Agents API is a managed service built on the open-source Codex harness, handling context compaction, tool search, programmatic tool calling, and multi-agent orchestration. Agents run in OpenAI-hosted sandboxes, self-hosted environments, or partner sandboxes from Blaxel, Cloudflare, Daytona, DigitalOcean, E2B, Modal, Oracle, Runloop, and Vercel. Data residency is US-only and Zero Data Retention is unsupported. Examples use model gpt-6-astra; vendor-reported results include SafetyKit cutting case review cost 60% and Ciridae achieving 4x lower subagent latency.

MarkTechPostupdated Sep 11, 08:11 UTC · 4d agofirst Sep 10, 21:21 UTC · 5d agoAI tools & infra 4 sources1

PRs NOT Welcome: How Top AI Open Source Projects Are Managing Thousands of Contributors

Top AI open source projects like Vercel, Astro, Flue, and tldraw are restricting external PRs and using agent-based software factories to triage, fix, and review contributions.

Several prominent AI-native open source projects are closing or limiting external pull requests, largely because submissions are often AI-generated. Vercel built a multi-agent software factory for its AI SDK (over 20 million weekly npm downloads) that now authors 25-35% of merged PRs and closes 70-80% of issues. Astro adopted similar auto-triage automation, Fred Schott created the Flue framework with automatic PR-to-issue conversion, and tldraw automatically closes external PRs.

Latent SpaceSep 1, 16:17 UTC · 14d agoAI industry

Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Vercel patches two critical Next.js unauthenticated RCE flaws: a libheif AVIF heap overflow (CVSS 9.5) and a Windows path traversal (CVE-2026-75604).

Vercel patched two critical Next.js flaws enabling unauthenticated remote code execution: a heap buffer overflow in libheif's AVIF image scaling (GHSA-2xp9-vwfh-vxw4, CVSS v4 9.5) and a Windows path traversal (CVE-2026-75604, CVSS 9.0). The AVIF flaw affects only sites explicitly enabling AVIF optimization and overwrites roughly 16,384 bytes past the buffer; the path traversal affects Windows-hosted Next.js deployments on versions 13.4-15.5.23 and 16.0-16.3.2. Fixes shipped in Next.js 15.5.24 and 16.3.3 on August 25, 2026, with the AVIF researchers releasing a Python PoC demonstrating RCE on multiple applications. No exploitation had been reported as of August 27, 2026.

The Hacker NewsAug 27, 15:16 UTC · 19d agoVulnerability CVE-2026-75604

Related CVEsby mentions

CVE-2026-756049.02%
Unauthenticated RCE in Next.js on Windows-hosted servers
Next.js, the widely used React web framework published on npm, contains an unauthenticated remote code execution vulnerability classified as CWE-22 (path traversal) and rated critical at CVSS 9.0. The flaw affects applications built with the Pages Router or App Router that do not use Cache Components, and it is triggered only when the server runs on a machine with a Windows filesystem; a remote, unauthenticated attacker can reach it over the network, though exploitability is rated high attack complexity. Successful exploitation yields code execution with high impact to confidentiality, integrity, and availability, and the scope is changed, meaning impact extends beyond the vulnerable component. Only teams self-hosting Next.js on Windows servers are affected; deployments on Linux, macOS, or Vercel's managed infrastructure are not. There is currently no public proof-of-concept, the flaw is not in the CISA KEV catalog, and EPSS assigns a 1.1% probability of exploitation within 30 days, but no workaround exists, so upgrading is the only mitigation.
· Vercel Next.js — applications using the Pages Router (without Cache Components) on Windows-hosted servers · Vercel Next.js — applications using the App Router (without Cache Components) on Windows-hosted serversmoderate

Appears with

vendor Vercel 2 organization Blaxel 1 organization Cloudflare 1 organization Daytona 1 organization DigitalOcean 1 organization E2B 1 organization Hacktron 1 organization Modal 1 organization OpenAI 1 organization Oracle 1 organization Runloop 1 ai model gpt-6-astra 1 product AI SDK 1 product Astro 1 product Codex 1 product Flue 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.