c/changelog

AI Gateway Production Index — July 2026 Every month, AI Gateway routes tens of trillions of tokens between production applications and AI labs, giving us a view of what AI usage actually looks like in today’s enterprise. We publish that view here. See the Production Index reports published in May an

Precursor, our new continuous behavioral validation engine for bot management, offers visibility into how humans and bots actually interact across the full user journey. By turning session-level behavior into bot detection signals, it identifies advanced automation with higher precision — while redu

Search is how we find nearly everything on the web — creators, merchants, answers. AI is rewriting the rules, leaving creators caught between staying discoverable in an agentic era and getting paid for their work. Today we're launching two initiatives to help.

One year after declaring Content Independence Day, a dynamic market for monetized content has officially emerged. In this report, we examine how the rise of autonomous AI agents is upending traditional search referrals and detail the new infrastructure required to support a sustainable web economy.

Cloudflare Research is building a global consensus service called Meerkat that uses a new consensus algorithm called QuePaxa. We plan to use Meerkat to build a strongly consistent, fault-tolerant key-value store, and other applications.

CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.0, which adds support for Kotlin 2.4.0,… The post CodeQL 2.26.0 adds Kotlin 2.4.0 support and AI prompt injection detection appea

Grok 4.5 from SpaceXAI is now available on AI Gateway.Built for coding, knowledge work, and STEM, the model accepts text and image inputs.Grok 4.5 supports low, medium, and high reasoning levels and defaults to high. Set the level with reasoning to balance speed against depth.To use Grok 4.5, set mo

Muse Spark 1.1 from Meta is now available on AI Gateway.It is a multimodal reasoning model with a 1M token context window built for agentic tasks, accepting text, image, video, PDF, and audio inputs.Muse Spark 1.1 plans and orchestrates work across tools and services, operating as a main agent or as

GPT 5.6 is now available on AI Gateway in three models: Sol, Terra, and Luna.GPT 5.6 from OpenAI is now available on AI Gateway in a limited preview, across three models: Sol, Terra, and Luna. All three are stronger at agentic work across coding, biology, and cybersecurity, and are more token-effici

GitHub Advanced Security enterprise customers can now publish internal security advisories. Innersource advisories work similarly to GitHub’s open source advisories, but their visibility is restricted to repositories owned by the… The post Innersource security advisories are generally av

npm v12 is now generally available and tagged latest. This major release turns on the install-time security defaults we announced in June, and it’s also where we begin a deprecation… The post npm install-time security and GAT bypass2fa deprecation appeared first on The GitHub Blog.

Flags SDK and Vercel Flags now evaluate multiple feature flags in bulk around 10x faster. Flag evaluation time improved by reducing microtask queue overhead and creating fewer promises. The improvement scales with the number of flags.Use await evaluate([flagA, flagB]) instead of Promise.all([flagA()

The pledge is a voluntary framework inviting organizations to commit to foundational cyber security governance, board-level accountability, and supply chain rigor. For over a decade, Cloudflare has pioneered the core pillars of this framework: democratizing security, leadership accountability, and r

We are launching Workers Cache, a regionally tiered cache that sits directly in front of your Worker entrypoints. Infinitely composable, configured via standard HTTP headers

You can now cap how much of your enterprise’s monthly included AI credits a cost center can use. This is available through the REST API today. Management in the cost… The post Cost centers now support AI credit pools appeared first on The GitHub Blog.

Access to Claude Fable 5, the Mythos-class model, has now been restored on AI Gateway following the US Government's decision to lift the export controls.Fable 5 is the same model that was available between June 9 and June 12. What has changed is the safety classifiers, which are now updated and

Vercel AI Gateway now supports routing rules.Routing rules are firewall-style rules that control which models your team can use, applied at the gateway level instead of in your application code.When a model goes down or gets retired, you usually have to ship a code change to move off it. With routin

Your agent can now inspect Agent Runs via the Vercel MCP and CLI for eve, the open-source agent framework.eve traces are automatically ingested when deployed to Vercel and available as Agent Runs. The new Vercel MCP tools and Vercel CLI commands let you find projects with runs, list recent runs, and

We will deprecate Gemini 2.5 Pro and Gemini 3 Flash across all GitHub Copilot experiences (including Copilot Chat, inline edits, ask and agent modes, and code completions) on July 31st,… The post Upcoming deprecation of Gemini 2.5 Pro and Gemini 3 Flash appeared first on The GitHub Blog.

The Vercel Security Dashboard is now in private beta. It aggregates the security posture of every account and project on Vercel. As teams grow and coding agents make it easy to spin up new projects, small misconfigurations can add up quietly and quickly. Team members without 2FA, publicly accessible

OpenAI has started rolling GPT-5.6 out through the API to a select group of trusted partners, with broader availability promised soon. Two things matter for builders: a new *max reasoning effort* setting, and an "ultra mode" that spins up subagents to parallelize complex, multi-step work instead of grinding through it in a single pass.

If you're building agentic products, having subagent orchestration native to the model — rather than something you bolt on — changes how you'd architect long-running tasks. Expect the trusted-partner window to be short before it opens up.

Source: openai.com

At I/O 2026 Google launched Gemini 3.5 Flash, which it says outperforms Gemini 3.1 Pro across almost all benchmarks while running four times faster than other frontier models. It's now the model powering the agentic features across Google's dev stack.

The headline for indie builders: frontier-class quality at Flash pricing and latency. Workloads you previously routed to a Pro-tier model just to get accuracy can likely move down a tier — that's real money at scale.

Source: blog.google

Google rebuilt Antigravity into a full agent platform at I/O 2026. Antigravity 2.0 is a desktop app that acts as a hub for running multiple agents in parallel, with dynamic subagents, scheduled background automation, and integrations into AI Studio, Android, and Firebase. There's also an Antigravity CLI (Gemini CLI users are being nudged to migrate) and an Antigravity SDK for programmatic access you can host on your own infra.

Scheduled background automation is the sleeper feature — set-and-forget agents without wiring your own cron + queue.

Source: blog.google

Buried in the I/O 2026 dev announcements: Managed Agents in the Gemini API. A single API call gives you an agent that reasons, calls tools, and executes code inside an isolated Linux environment — no infra to provision. Environments are persistent and resumable across multi-turn sessions, and you define agent behavior with plain markdown files.

This collapses a whole category of backend work — sandboxing, session state, tool routing — into a managed primitive. Combined with OpenAI's agent-tooling push, the "run untrusted agent code safely" problem is quietly becoming a checkbox.

Source: blog.google

Stripe and Cloudflare shipped a protocol that lets AI agents autonomously create cloud accounts, register domains, start subscriptions, and deploy to production. 32 providers are integrated: Vercel, Clerk, Supabase, Hugging Face, Twilio, Sentry, WorkOS, Browserbase, GitLab, ElevenLabs, and more.

Three components: Discovery (agent queries a catalog of services), Authorization (platform attests user identity, provisions accounts), and Fulfillment (agent deploys and configures). Stripe sets a default spending cap of $100/month per provider.

In practice this means you can tell your coding agent "set up a new project with Supabase database, Clerk auth, Vercel hosting, and a custom domain" and it will create the accounts, provision credentials, wire up env vars, and deploy — all without you opening a browser.

Also in the Cloudflare drop: Workflows now support saga-style rollbacks (specify a compensating action per step), and Self-Managed OAuth is available to all devs.

This is the "infrastructure as conversation" moment everyone predicted. It's here.