Vercel hardens agent workflows—and makes cache economics harder to ignore

Vercel’s week points toward making agent-driven development safer and easier to operate, rather than simply adding models. Security Review is explicitly in public beta for Pro and Enterprise teams: it checks connected GitHub pushes for vulnerabilities and can hand findings to an agent that proposes a pull request, with approval required before merging. Alongside it, automatic npm blocking moves protection ahead of potentially malicious install scripts. The pattern is security closer to execution, without removing human review of proposed fixes.

The same emphasis appears in agent infrastructure. The rewritten fx adapter keeps orchestration, model requests, and credentials on the host while filesystem and shell operations stay sandboxed. Workflow SDK 5.4.0 makes starts atomic and token-idempotent, closing a duplicate-start race. Daemons gain private service bindings and liveness checks. Meanwhile, vercel doctor supplies noninteractive diagnostics and JSON output, and MCP opens connections to clients without prior Vercel allowlisting while retaining user approval. Together, these changes suggest Vercel wants agents to operate more independently, but across clearer isolation and authorization boundaries. AI Gateway’s additional Kimi ZDR providers reinforce that direction: enforced ZDR fails closed when no qualifying provider is available.

The most immediate builder concern is Data Cache’s move to Runtime Cache. This is an exit from beta and a migration, not just a performance announcement: code stays unchanged, storage allocations increase, and previously unbilled reads and writes become metered after migration. Review cache usage before that transition. Elsewhere, efficiency improves without the same trade-off: Sandbox creation with Drives drops from a 1.7-second median to 0.7 seconds automatically, while Flags SDK 1.5.3 and later removes a cold-start network wait and reporting-related function duration. Builders should distinguish automatic improvements from SDK upgrades—and both from billing changes.