Today's digest · Thursday, October 1

The 11 things in AI/dev today.

LiveNext issue at 7:00 CET

Stories

#1 / TODAY

Cloudflare Developer Platform·1 min·2d agoFREE

Durable Objects - Pending I/O operations allow Durable Objects to continue long-running work without a connected client

Cloudflare's developer platform changelog entry states that pending I/O operations allow Durable Objects to continue long-running work without a connected client. The post, published October 1, 2026, describes this behavior as keeping Durable Objects active for ongoing work when no client remains connected. The source presents the change as a capability of pending I/O operations within Durable Objects, without detailing configuration, limits, or availability.

Durable Objects can keep executing long-running work via pending I/O operations even after a client disconnects, per Cloudflare's changelog.

cloudflaredurable-objectsserverlessworkers

developers.cloudflare.com

Durable Objects - Pending I/O operations allow Durable Objects to continue long-running work without a connected client

Over 543,000 valid credentials exposed in public GitHub repositories

#2 / TOP STORY

BleepingComputerFREE

Over 543,000 valid credentials exposed in public GitHub repositories

BleepingComputer reports that over 543,000 valid credentials were exposed in public GitHub repositories. The publication's headline states the exposure figure directly, describing the credentials as valid and the repositories as public. The source text provides no further detail on which repositories, which services the credentials belong to, how the exposure was discovered, or who reported it. The stated consequence is that the credentials were exposed publicly on GitHub.

Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures

#3 / TOP STORY

The Hacker NewsFREE

Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures

The Hacker News reports that attackers are abusing ChatGPT custom GPTs to deliver a remote access trojan (RAT) through ClickFix lures. According to the source, the custom GPTs are used as part of the delivery chain for the ClickFix-style lures, which lead to the RAT. The report frames this as abuse of ChatGPT's custom GPT feature rather than a flaw in the underlying model. The source does not name the specific RAT family, the number of affected users, or any remediation status.

aigest · daily

Get this every morning.

One email. The signal. Built for builders.

Free · Unsubscribe in one click · No trackers

// Worth knowing8 stories

AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub

The report indicates that AI coding agents can place internal images and billing records into GitHub, a platform developers commonly use for code and automation.

githubagentssecuritydata-exposure

The Hacker News3d ago1mFREE

OpenAI makes ‘Sign in with ChatGPT’ a way to use your subscription in third-party developer tools

Developers using third-party AI and coding tools may be able to apply their existing ChatGPT subscription allowance there, per the source.

openaichatgptdevtoolsauth

The New Stack3d ago1mFREE

Vercel Agent now installs private packages from npm and custom registries

Developers using Vercel Agent can now have it install private packages from npm and custom registries, per the changelog.

vercelagentsnpmregistries

Vercel2d ago1mFREE

Cohere’s faster query model barely dents retrieval quality in its tests

Developers weighing query embedding latency against retrieval accuracy now have a Cohere option whose tested quality loss is described as small.

cohereembeddingsretrievalmodels

The New Stack2d ago1mFREE

AI Gateway adds Browserbase Search and Fetch tools

Developers using Vercel's AI Gateway can now access Browserbase Search and Fetch tools through the gateway, per the changelog title.

vercelai-gatewaybrowserbasetools

Vercel2d ago1mFREE

Query claims in natural language with Amazon Bedrock Knowledge Bases

Developers building retrieval-based assistants can follow the post's pattern for querying claim documents with citations using Bedrock Knowledge Bases and the AgenticRetrieveStream API.

awsbedrockragknowledge-bases

AWS ML Blog3d ago1mFREE

OpenSSL Fixes High-Severity DTLS Flaw That Can Leak Heap Memory Unencrypted

The source says a high-severity DTLS flaw in OpenSSL can leak heap memory unencrypted, a library widely used for TLS and DTLS in networked software.

opensslsecuritydtlsvulnerability

The Hacker News3d ago1mFREE

Photo Scrubber — local face blur & metadata removal

The post describes a locally run tool for blurring faces and stripping photo metadata, which developers can evaluate as an on-device alternative to uploading images to a service.

privacyimagesmetadatalocal

Simon Willison4d ago1mFREE

// Yesterday7 stories