Your agent can now reach the parts of your app it couldn'tThis week's releases give your coding agent things it couldn't touch before: your signed-in browser, a scheduler, a security reviewer, real vector icons. Five ways to use them, each with a prompt to paste. Reported we read the primary source and link it. Tested we ran it ourselves and say exactly how.
|
Warning · Deadline Dec 1
If your app calls Gemini 2.5
Google deprecated gemini-2.5-pro and gemini-2.5-flash. From Dec 1, calls to them are automatically sent to gemini-3.8-flash and gemini-3.5-flash-lite and billed at those models' rates. Google lists breaking changes on the new models: thinking_level replaces thinking_budget, and some sampling parameters and prefilled model turns are gone. Find your calls:
Run in your project folder grep -rnE "gemini-2\.5-(pro|flash)([^-]|$)" --exclude-dir=node_modules . |
Found any? Read Google's Gemini 3.8 Flash migration guide before Dec 1. gemini-2.5-flash-lite isn't affected. Reported Source: Gemini API deprecations
|
|
Nov 4 Reported Open weights
Ripple-65B Preview
80.5 Terminal-Bench 2.1, Ricursive's own score. Open weights, Apache 2.0. A 65B dense coding model from new lab Ricursive Intelligence, Apache 2.0, up to 1M tokens of context, on Hugging Face and OpenRouter. It reports 80.5 on Terminal-Bench 2.1, but 76.5 on SWE-bench Verified, below Reflection Beam's 81.6, so the lead depends on the benchmark.
Source: Hugging Face model card · Our brief
|
|
Nov 4 Reported
OpenAI Images 2.6
GPT-Image-2.6 Flare (fast) and Sunburst (detailed), in ChatGPT, Codex and the API. New: SVG and animated GIF output, markup-guided edits and a complexity setting. $30 per 1M image-output tokens.
Source: OpenAI image generation guide · Our brief
|
|
Nov 2 Reported
Claude Code gets faster on long sessions
Anthropic's message threads beta sends only the new turn instead of the whole conversation. It's on by default for most Claude Code users, and Anthropic says median time to first token on 500K to 1M token requests fell about 35%. Price and token use don't change.
Source: Anthropic: message threads · Our brief
|
|
Nov 5 Reported
Cursor builds and hosts live apps
A cloud agent scaffolds the app, adds a Postgres database and sign-in, runs security checks and publishes it at a link. On all paid plans with cloud agents enabled.
Source: Cursor changelog · Our brief
|
Each one runs on a specific upgrade from this week, with a prompt to paste. We haven't run these setups ourselves, so all five are Reported. |
01
Let your agent test the parts of your app that need you signed in
Reported
|
|
Result
A report with a screenshot and a pass/fail line for every step of a flow behind your login. |
Runs on OpenCode Browse (Nov 6), an MIT-licensed MCP server and Chromium extension. Claude Code, Codex, Cursor or any MCP agent drives your real browser with Playwright, in background tabs, using the logins you already have. For a login, 2FA or payment it hands the tab back and waits for you to click Continue. Source: OpenCode Browse page · anomalyco/browse READMEYou'll build A walkthrough of your logged-in dashboard: the agent clicks through a real flow, screenshots each step, saves the network traffic and writes up what broke. Paste into Claude Code, Codex or Cursor Use the browse MCP tools. Allow only localhost:3000 this session.
Open http://localhost:3000/dashboard in a new tab (I'm already signed in).
Create a project, rename it, invite test+1@example.com, then delete the project.
After each step: take a screenshot and note passed / failed / what looked wrong.
Save the network traffic as a HAR and list any 4xx or 5xx requests.
If a login, 2FA or payment page appears, hand the tab back to me and wait.
Write browse-report.md with the steps, screenshots and failing requests. |
- Install the extension from the Chrome Web Store; it walks you through adding the MCP server to your agents. The CLI route is
npm install -g @opencode/browse && browse install. - Use the per-session allowlist. The README says agent code runs in a restricted JavaScript realm that "is not a security boundary", so keep the agent on your own sites.
0 API keys Agents use the sites you're already signed into, per OpenCode's product page. |
Why now An agent's usual browser starts logged out, so anything behind your login meant making test accounts or copying cookies by hand. Now it borrows the session you already have. Cost Free and MIT-licensed; it runs on your agent's plan. It's early software: the latest release is v0.0.16 (Nov 8). |
02
Generate your app's icon set as real SVGs you can edit
Reported
|
|
Result
A folder of matching SVG icons and a component that renders them by name. |
Runs on OpenAI Images 2.6 (Nov 4). Both models, gpt-image-2.6-flare and gpt-image-2.6-sunburst, now return SVG from the Image API: editable paths, shapes and colours instead of a PNG. Source: OpenAI image generation guide · Flare model pageYou'll build A script that turns a list of names into matching icons in public/icons, plus an <Icon name="..."> component. Paste into Codex or Claude Code Write scripts/icons.mjs. For each line in icons.txt (e.g. home, settings, upload):
call POST https://api.openai.com/v1/images/generations with model "gpt-image-2.6-flare",
output_format "svg", n 1, quality "low", and the prompt:
"Minimal line icon of <name>. 2px stroke, rounded caps, one colour #111111,
24x24 grid, no text, transparent background."
Decode data[0].b64_json and save it as public/icons/<name>.svg.
Read OPENAI_API_KEY from the environment. Then run svgo on the folder and
write components/Icon.tsx that renders an icon by name with currentColor. |
- Start with Flare at low quality for drafts; try Sunburst for your logo.
- SVG output needs
n set to 1 and doesn't work on the edits endpoint. OpenAI may ask you to verify your organization first.
$30 per 1M image-output tokens, both Images 2.6 models. OpenAI list price, checked Nov 9, 2026. |
Why now Image models gave you PNGs, so icons meant tracing them or redrawing them by hand. An SVG you can recolour, resize and diff in git is something you can actually ship. Cost $5 per 1M text-input tokens and $30 per 1M image-output tokens (OpenAI model page, checked Nov 9, 2026). We haven't measured the cost per icon. |
03
Let users tell your AI chat "remind me tomorrow at 9" and have it happen
Reported
|
|
Result
Your chat agent can schedule work for a user, with no jobs table and no polling cron. |
Runs on Vercel Schedules, public beta Nov 4. Your app or agent can create, change or cancel one-time and recurring schedules in code, without redeploying. When a schedule is due, Vercel delivers the saved request to your app through Queues. Source: Vercel blog: Introducing Vercel SchedulesYou'll build A scheduling tool for your AI SDK chat agent. The user asks for something later, the agent saves it as a schedule, and a worker runs it on time and saves the result for that user. Paste into Claude Code, Codex or Cursor Add scheduling to my AI SDK chat agent with @vercel/schedules (public beta).
Follow https://vercel.com/blog/introducing-vercel-schedules and Vercel's Schedules docs.
1) lib/schedule-task-tool.ts: an AI SDK tool that calls Schedules.create with
expression {type: "single", at}, the user's IANA timezone, target {topic: "agent-work"},
payload {userId, task}, and namespace set to the tenant id.
2) A Queue consumer for "agent-work" that re-checks the user still has access,
runs the task with the agent and saves the result to that user's inbox.
3) Tools to list and cancel the user's own schedules.
Test with vercel dev before anything else. |
- Test it on a Preview deployment, then use Run Schedule in the project's Schedules tab to fire it without waiting.
- Keep the permission check in the worker. The schedule may run days after the user asked.
0 cron jobs No polling job or jobs table needed to run a user's later request, per Vercel. |
Why now Before, "do this later" meant a database table of pending jobs plus a cron job polling it. Now the schedule itself holds the request and the time. Cost Vercel's post doesn't list pricing for the beta. Check your project's usage page once it's running. |
04
Get a security check on every push before your app leaks someone's data
Reported
|
|
Result
Every push reviewed for security holes, with your own agent fixing each finding. |
Runs on Vercel Security Review, public beta Nov 2, inside Vercel Agent. It scans each push to your connected GitHub repo, traces how the changed code can be reached and rechecks each finding, aiming at flaws like missing authorization checks. Findings land in a Security dashboard, as a PR comment on private repos, and in the CLI. Source: Vercel blog: Introducing Vercel Security ReviewYou'll build A loop where every push is reviewed in seconds, and your own coding agent fixes what it finds, one commit per finding. After you turn it on, paste into Claude Code or Codex Run `vercel security vulnerabilities` and read every open finding.
For each one: show me the file and line, and explain in one sentence
how a signed-in user could abuse it.
Then make the smallest fix and add a test that fails before the fix and passes after.
Don't change anything a finding doesn't mention. One commit per finding. |
- Turn it on in Vercel Agent Settings, for all projects or the ones you pick. It's for Pro and Enterprise teams.
- Add a policy in plain words, like Vercel's example: any endpoint that returns customer data must check the requester owns it.
$0.25 per 1M tokens on top of the model price, once reviews stop being free on Nov 10, 2026. |
Why now When an agent writes most of your code, nobody reads every diff. Vercel says pattern-matching scanners miss logic flaws like a missing ownership check, and this reviews what changed against what's already running. Cost Reviews are free until Nov 10, 2026. After that you pay the model provider's token price with no markup, plus $0.25 per 1M tokens. Fixes made by Vercel Agent are billed at that rate. |
05
Turn the spreadsheet your team shares into a live app with a login
Reported
|
|
Result
A hosted app with a database and sign-in, at a link your team can open. |
Runs on Build Live Apps in Cursor (Nov 5). A cloud agent scaffolds the app, spins up Postgres if it needs one, puts sign-in behind Cursor SSO and provisions hosting. Before publishing it runs security checks for things like secrets in app files. Source: Cursor changelog: Build Live AppsYou'll build An internal tracker (feedback, bookings, inventory, whatever lives in a shared sheet now) with a form, a filtered table and a weekly chart, at a link your team signs in to. Start a Cursor cloud agent and paste I want to build an app.
Build a live internal app for tracking customer feedback:
a form to add an item (customer, request, priority, status),
a table with filters on status and priority, and a chart of new items per week.
Store the data in Postgres. Only people on my team can sign in.
Before you publish, show me the security check results. |
- Cursor's changelog says to tell the cloud agent explicitly that you want to build an app.
- When you publish, you pick a unique domain and get a live link. Share it with people, groups or your whole team; on individual plans you can also share it publicly.
1 link What you get back when you publish: the live app, at the domain you picked. |
Why now Cursor says most apps users build never leave localhost. The database, auth and hosting were each a separate job; now one agent run covers them. Cost On all paid plans with cloud agents enabled. The changelog doesn't give hosting limits or a separate price. GPT-6 Cyber OpenAI's new security model reports 48.5% on ExploitGym, up from 32.1% for GPT-5.6 Cyber, but only approved Daybreak Red customers can use it. If you want your own app checked, #04 is the one you can turn on today. Reported Source: OpenAI, Nov 5 (archived copy) Checked · Nov 8
69 vendor pricing pages reread on Nov 8 |
Every Sunday we reread the pricing page of every tool we list. Two prices changed this week: Qodo credits now cost $0.015 each (was $0.012), and Letta no longer lists its $0.10 per active agent charge. Both fixes are logged in public. Corrections · Site changelog Newsletter we like (swap) The Vibe Diff: a free Monday email on what actually changed in AI coding tools like Cursor, Claude Code, Codex, Lovable and Replit, so vibe coders know what to try that week. No sponsor this week. Sponsor an issue. No affiliate links in this issue. |
