Vercel’s Sept 24 changelog lets TanStack AI agents call OAuth-protected MCP servers through Connect via connectMCPTransport in @vercel/connect/tanstack-ai, with fresh tokens per request and no credentials for you to store. If the user hasn’t granted access, getConsentChallenge redirects them to Connect’s consent URL before the model runs.
Pluto’s Sept 24 research scanned public MCP endpoints and confirmed 147 of 179 findings accepted unauthenticated calls—including root exec shells, production SQL/CMS tools, and a Swiss municipal citizen workflow. Most still listen today; they recommend authenticating tools/call , scanning your own perimeter, and authorizing per tool…
Vercel’s Sept 25 changelog ships vercel/vcr action/login , which exchanges a GitHub OIDC token for a short lived Vercel access token so Actions can push to Container Registry without stored credentials. After linux/amd64 prep finishes, the same project can use that image as a custom Sandbox runtime…
Vercel’s Sept 25 changelog adds sandbox memory metrics (average, P75, P95) beside CPU and transfer on overview and detail pages, with the y axis scaled to each sandbox’s limit and a dashed line at 85%. The same series is queryable as memoryUsedBytes in Observability and via vercel metrics under vercel.sandbox.memory used bytes…
Vercel’s Sept 23 changelog puts Drives in public beta on Hobby, Pro, and Enterprise: persistent volumes you mount into a Sandbox so agent workspaces, datasets, and dependency trees survive across runs. One read write mount at a time, plus concurrent read only snapshots; defaults are 1 TiB (1 GiB on Hobby)…
Microsoft’s Sept 25 blog restructures Copilot around Home (Chat + Cowork with Office in Copilot), Code (GitHub Copilot–backed sandboxed app building), and Autopilot (ex Scout persistent agent). Home and Code start via Frontier in the coming weeks; Autopilot expands to private preview at month end…
Spotted something we missed? Start a thread.