Today's digest · Friday, August 21

The 10 things in AI/dev today.

LiveNext issue at 7:00 CET

Stories

#1 / TODAY

The Hacker News·1 min·10h agoFREE+1 mirror

Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads

A Rust supply chain attack has placed build-time malware in crates that have been downloaded 245 million times. The attack was reported by The Hacker News. The malicious code executes during the build process, potentially compromising systems that use these crates. The scale of downloads indicates a wide potential impact.

Build-time malware in widely downloaded crates can compromise any project that uses them.

rustsupply-chainmalwarecrates

thehackernews.com

Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads

Top Vector Databases for AI Agents in 2026: Qdrant vs Pinecone vs Weaviate vs PgVector vs Milvus

#2 / TOP STORY

DEV CommunityFREE

Top Vector Databases for AI Agents in 2026: Qdrant vs Pinecone vs Weaviate vs PgVector vs Milvus

A DEV Community article compares five vector databases for AI agents in 2026: Qdrant, Pinecone, Weaviate, PgVector, and Milvus. The post appears to be part of a themed challenge with retro styling. The comparison likely covers features, performance, and use cases, though the excerpt provided is mostly CSS styling and does not include the actual comparison content.

smolmachines / smolvm as a sandbox for untrusted Python & JavaScript

#3 / TOP STORY

Simon WillisonFREE

smolmachines / smolvm as a sandbox for untrusted Python & JavaScript

Simon Willison tested smolvm 1.8.3 as a sandbox for untrusted Python and JavaScript, finding it well-suited using hardware-isolated VMs. Features like offline images, no-network execution, CPU/RAM limits, timeouts, storage quotas, and read-only input mounts worked as intended. Cold starts were around 0.6–1.5 seconds, warm executions around 50 ms. Claude Fable 5 in Claude Code for web couldn't run smolvm due to missing KVM, so it used GitHub Actions runners instead.

aigest · daily

Get this every morning.

One email. The signal. Built for builders.

Free · Unsubscribe in one click · No trackers

// Worth acting on1 story

Your GitHub Actions cron fires less often than you declared: what we measured and how to design for it

Developers relying on GitHub Actions cron may need to adjust expectations for job frequency.

github-actionscrondevops

DEV Community3h ago1mFREE

// Worth knowing6 stories

New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data

This attack could expose sensitive AI chat data, highlighting a new security risk for developers building on such platforms.

groksecuritycryptographyai

The Hacker News16h ago1mFREE

A shot-scraper-style JSON API on Bun 1.4's new Bun.WebView

Bun.WebView could enable lightweight, dependency-free browser automation services without Puppeteer or Playwright.

bunbrowser-automationtypescriptwebview

Simon Willison15h ago1mFREE

How v0 authenticates to Snowflake without exposing the user's OAuth token

This approach reduces the risk of OAuth token exposure when using AI tools with data warehouses.

authenticationoauthsecuritysnowflake

Vercel26h ago1mFREE

Vomit: Clean up Claude 5's token output with a separate LLM

Vomit offers a way to refine Claude 5's raw token output, potentially improving AI-generated text quality for developers.

claudellmopen-sourcetooling

Hacker News15h ago1mFREE

AI Content Labels: Build Trust Signals Before Users Stop Believing the Page

Developers need to consider AI content labels to maintain user trust as AI-generated content becomes more common.

aitrustlabelscontent

DEV Community3h ago1mFREE

Code scanning adds a mitigated alert dismissal reason

Developers can now more accurately record why a code scanning alert was dismissed, improving audit trails.

githubcode-scanningsecurity

GitHub Changelog15h ago1mFREE

// Yesterday8 stories