All the research, one tab.
Every research item behind the daily briefs, newest first, in fast pages. Filter by topic, open any card's source, share any page — the URL is the state. The live map stays on the Brief page.
- Dev Tooling & Infra
Vercel workflow steps can now run 30 minutes, up from just over 13
Long agent steps have been split across invocations purely to dodge a timeout; a 30-minute ceiling removes a chunk of that plumbing.
- Dev Tooling & Infra
GitHub Issues gets a throttle for autonomous agents — approvals, confidence scores, a reason for every action
A confidence threshold you can dial is the first practical answer to "how much do I let the agent just do?" — the same shape VS Code shipped for tool calls a week earlier.
- Dev Tooling & Infra
AMD takes aim at the robotics compute default with unified memory and microsecond control loops
A credible second supplier for robot compute changes the negotiating position of everyone currently building on a single-vendor stack.
- Dev Tooling & Infra✓ verified
VS Code 1.130 lets the model judge risk before an agent tool call asks for approval
A shipping example of an LLM risk-prefilter layered ahead of hard approval gates — the pattern agent-tooling teams are converging on.
- Dev Tooling & Infra✓ verified
PyPI now blocks adding new files to releases older than 14 days — a supply-chain hardening move
Python teams with slow multi-platform build pipelines should confirm all their wheels publish within 14 days; everyone else just got a safer dependency chain.
- Dev Tooling & Infra✓ verified
Patch now: Check Point SmartConsole and Microsoft SharePoint flaws join CISA's exploited list
On-prem SharePoint operators must patch and rotate machine keys — patching alone leaves stolen keys valid.
- Dev Tooling & Infra
Vercel opens up Vercel Agent — an AI that investigates incidents, fixes builds, and reviews PRs
A production agent that triages incidents and reviews code is the applied edge of the coding-agent wave — always-on autonomy a team can switch on without building it.
- Dev Tooling & Infra✓ verified
Patch now: a WordPress core RCE chain and a second Langflow flaw land in CISA's exploited list
Unpatched WordPress sites are exploitable by anonymous attackers right now, and self-hosted Langflow has hit the exploited list twice in two weeks — treat exposed instances as patch-or-isolate today, not dev tools you can forget.
- Dev Tooling & Infra✓ verified
GitHub Code Quality reaches general availability — and billing starts automatically
Admins who enabled the preview are now paying for it — audit enablement today — and coverage thresholds can now be enforced mechanically through rulesets.
- Dev Tooling & Infra
Vercel ships a plugin for Moonshot's Kimi Code CLI as the K3 wave spreads through dev tooling
When US infrastructure vendors start shipping first-party plugins into a Chinese lab's coding CLI, adoption has moved past benchmarks — worth watching if you are choosing a coding-agent stack.
- Dev Tooling & Infra✓ verified
Patch now: CISA flags actively exploited Microsoft SharePoint and Fortinet FortiSandbox flaws
If you run on-prem SharePoint or FortiSandbox, attackers are already exploiting these — patch before the weekend.
- Dev Tooling & Infra
VS Code 1.129 ships a dedicated agent host and an editor panel inside the Agents window
The editor most developers use keeps reorganizing itself around agents — worth ten minutes to learn the new agent host before your team asks about it.
- Dev Tooling & Infra
NVIDIA Jetson Thor: edge computers to run robot foundation models on-device
The on-robot 'brain' is the bottleneck for putting large models into physical machines — running foundation-model inference at the edge is what lets a robot act without a round-trip to the cloud.
- Dev Tooling & Infra✓ verified
Patch now: CISA flags an actively exploited Oracle E-Business Suite flaw that can take over Oracle Payments
If your company runs Oracle E-Business Suite — especially Payments — this is exploited in the wild and reachable without credentials; patch before the weekend.
- Dev Tooling & Infra✓ verified
Patch now: record 570 Microsoft fixes, and CISA flags actively exploited AD FS, SharePoint, and SonicWall flaws
If you run AD FS, SharePoint, or SonicWall appliances, these are known-exploited-in-the-wild — patch before the weekend, not after.
- Dev Tooling & Infra✓ verified
Dependabot now waits 3 days by default before proposing dependency updates
A default-on cooldown is a supply-chain defense that reaches every repo using Dependabot — worth knowing whether you keep it or opt out.
- Dev Tooling & Infra
Vercel now redacts Sensitive Environment Variable values from build logs
If you deploy on Vercel, one of the easiest ways to leak a key — echoing it in a build step — is now masked by default.
- Dev Tooling & Infra✓ verified
Meta ships Muse Spark 1.1 — its first coding model with an API
Another credible coding-agent with open API access — more competition and portability for teams picking an AI coding tool.
- Dev Tooling & Infra
VS Code 1.128 ships multi-chat agent sessions, Copilot Vision (GA), and BYOK agent models
The most widely used code editor just made parallel agent sessions and vision-attached chat mainstream defaults — a direct read on where day-to-day developer AI workflows are heading.
- Dev Tooling & Infra
Vercel widens access to its production agent — investigates incidents, fixes builds, reviews PRs
This is the ops-facing version of the autonomous build loop — the same pattern AI Uni runs internally, now packaged for any team's production pipeline.
- Dev Tooling & Infra
Claude Code: subagents run in background by default + auto-open draft PRs; permission default now "Manual"
If you drive Claude Code day to day, the defaults just changed: parallel subagents run in the background and can push branches + open PRs on their own, and the safer "Manual" permission default means you approve more actions explicitly — re-check any hooks or automation that assumed the old behavior.
- Dev Tooling & Infra✓ verified
Claude Code has been quietly running on Bun's Rust rewrite since mid-June — and almost nobody noticed
The runtime under one of the most-used AI coding tools was swapped out in production across millions of devices without incident — 'boring is good' is what a successful large-scale rewrite looks like.
- Dev Tooling & Infra
Vercel ships Agent Runs into its MCP + CLI
Surfacing agent-run traces through MCP + the CLI is the "agents observable inside your own dev tooling" pattern — directly relevant to AIU agent-orchestration + the observability lens.
- Dev Tooling & Infra✓ verified
GitHub secret scanning adds a Supabase-credential detector that blocks the commit
One of the most common AI-built-app failures is the database key shipped to the browser; free push protection on a public repo catches a class of that at commit time — but know which tier you're on.