Explore what to build next

On October 7, 2026, GitHub announced via Changelog: starting with CLI 1.0.94-0, the /model command discovers models in your local Ollama instance, listed alongside configured and cloud models. Discovery doesn't auto-enroll — each model needs manual confirmation — and models must support tool calling and streaming. GitHub also teased intelligent routing, and clarified: a local model neither enables offline mode nor disables telemetry.

On October 1, 2026, Microsoft AI shipped three voice models at once: MAI-Transcribe-2-Streaming (streaming transcription, #1 on Artificial Analysis for streaming accuracy at 2.5% WER, final transcript 0.13s after end of speech), MAI-Voice-2.1 (23 languages, one consistent voice across languages), and 2.1-Flash (45s of audio at ~150ms end-to-end). With listening and speaking covered, a voice agent on a pure-Microsoft stack can now complete a turn in under a second.

On October 1, 2026, the Svelte team shipped SvelteKit 3.0: config moves from svelte.config.js into vite.config.ts, the private $lib alias retires in favor of Node-native #lib subpath imports, service workers shed boilerplate, and error handling improves across the board. The sv CLI hit 1.0 the same day, and its one-command migration turns the leftovers into a TODO list for your agent.

Traffic is moving from the search box to the AI answer box. A vibe coder ships a product in a week — and nobody finds it. This guide turns the SEO fundamentals (sitemaps, JSON-LD, Core Web Vitals) and the new AI-discovery toolkit (llms.txt, per-page Markdown versions, FAQ schema, agent-readable pricing and API docs) into a shippable 30-day checklist. The core judgment: how well you document sets your product's ceiling in the agent economy.

The Zephos team planted 16 launch-killer bugs in Notely, an agent-built Next.js + Supabase + Stripe notes app — two payment-related: unsigned webhooks accepted, pro granted from a self-declared client_reference_id. This guide turns those traps into a playbook: webhook signature verification, a server-side single source of truth, the subscription state machine, test clocks, and a launch checklist. Money logic must be hand-written or audited line by line.

Reported by InfoQ on October 3: a GPT-4 coding agent given CVE descriptions successfully exploited 87% of 15 test vulnerabilities, versus 7% without descriptions. rclone's author received 40+ security disclosures in a single month — more than the project's previous decade combined; QEMU has shortened its embargo period. The vulnerability disclosure timeline is collapsing under agent speed.

On October 7, OutSystems announced Agent Experience is generally available: its low-code platform is now open to any AI coding agent — Claude Code, Cursor, Codex, Kiro — with agents working at the design level, the platform generating code deterministically, and governance built in. This is the "vibe coding goes enterprise" playbook: taming shadow AI with a compliant path. But the 74% rework figure is vendor-survey data — discount it. The real bill is the hidden cost of platform lock-in.

On October 2, GitLab disclosed CVE-2026-90970: the prompt template sandbox in the self-hosted AI Gateway can be escaped, letting a logged-in user with Duo Agent Platform permissions execute arbitrary commands on the gateway host. CVSS 9.9. It is the component's second 9.9 this year — February's CVE-2026-1868 was the same template engine, the same CWE-1336. Eight months apart, both patches fixed specific escape paths without moving the trust boundary.

Getting signups is only the start — users churn by day 3 and you have no horn to call them back. This guide covers notification systems for vibe projects: channel selection, email with Resend from day one, SPF/DKIM/DMARC done right, when SMS is worth the money, frequency caps and unsubscribe, retries and dead letters, plus a launch acceptance checklist.

One 10MB avatar upload and your Node server's memory is gone. Presigned direct uploads, browser-side compression, magic-number validation, chunked resumable uploads, orphan cleanup — seven opinionated sections covering the highest-crash-rate feature in indie projects.

On October 1, Tavus launched Griffin — the first "Human Interaction Model" (HIM): full-duplex video-to-video that listens, watches, and speaks at the same time. In a blind study, 48% of participants believed they were talking to a real human, versus 2% at best for previous systems. The fact that it can fool people is exactly why it isn't generally available yet.

Cloudflare's Birthday Week blog makes the case plainly: GitHub was designed for humans writing code; the agent era needs the collaboration layer reinvented. Artifacts enters open beta with a repo for every agent, plus a developer competition — $25,000 in credits for first place, deadline October 14. This is the first time a major infra vendor has put 'infrastructure for agents writing code' on the table as a public proposition.