Agent foundations: gateways, sandboxes, and observable debugging

The agent runtime takes shape

This week's clearest throughline is platform work aimed squarely at AI agents. Cloudflare's Kitesurf browser is the headline: a stateless browser built on Workers that uses 3–7x less CPU and memory than Chromium for agentic tasks like screenshots and HTML extraction. Existing Browser Run clients work by adding browser=kitesurf to any CDP or Quick Action endpoint, so it's a drop-in upgrade during a free beta. It's a strong signal of where Cloudflare thinks agent workloads are headed — cheaper, more scalable browser sessions that aren't tied to persistent VM state.

That's not the only agent-facing move. Cloudflare's local debugging with automatic trace capture turns wrangler dev and vite dev into an observability platform for AI agents: structured OpenTelemetry traces and correlated console logs are captured automatically, and a Local Explorer API exposes an OpenAPI schema so agents can query telemetry, fix code, and verify results without deploying. The related Workers Vite plugin 1.51.0 refines those views — console output renders like the console, traces are searchable by span ID, and the "View trace" button jumps to the emitting invocation even across multi-invocation traces. In headless agent environments, the plugin now prints the API URL to stdout so agents can discover it programmatically. Collectively, Cloudflare is building the debugging loop agents need to be self-sufficient.

Meanwhile Vercel shipped Agent Plugins 1.0.0, a common format for packaging Agent Skills and MCP servers into portable plugins, and the CLI now auto-installs provider agent skills when you install a Marketplace integration. The Hermes Agent update ties the story together: inference across 200+ models via AI Gateway with no token markup, plus commands running in isolated Sandbox microVMs. Add skill packs for one-command downloads of bundled skills, and the week reads as Vercel and Cloudflare both racing to make agents first-class platform citizens.

Postgres on Railway, and AI Gateway as a control plane

Railway's CLI v5.33.0 is a substantial Postgres release: management for high-availability clusters, point-in-time recovery, and PgBouncer connection pooling, plus a cluster config model and template apply/revert controller that make these composable features declarative. Live HA scaling and a persistent ops trail with upgrade guidance round out what's effectively a managed Postgres console in the terminal. The coding-agent support in v5.32.0 — driving agents on cloud VMs via a new railway ca command — ties back to the agent theme.

AI Gateway is consolidating into a genuine control plane. Cloudflare's unified Workers AI and AI Gateway is the big one: one AI binding, one REST API, one observability path, and prepaid gateway credits now pay for Workers AI inference — with the rate limit raised from 20 to 50 requests per minute. The User Insights dashboard adds spend tracking and anomaly detection by baselineing each user's 30-day p95 session cost, while the Access integration brings identity-aware controls — verified user IDs land in request metadata as cf.user_id, enabling per-user spend limits and policy. Vercel's gateway moved too: OpenTelemetry trace export via Drains, Seedance 2.5 video generation, Grok Imagine Image 2.0, and AWS Marketplace availability.

SDK hygiene and security patches

Three Baseten provider releases across the AI SDK corrected a real footgun: AI SDK Baseten 0.1.0, Baseten v1.1.0, and @ai-sdk/baseten v2.1.0 all make the native performance client opt-in — it's a NAPI addon with 16 platform binaries that couldn't load in edge runtimes, and it was imported at module top level. Embeddings now go over plain HTTP by default, with a 128-value per-call limit, plus fixed streamed token usage reporting. The AI SDK 7.0.56 and Gateway v4.0.44 both fix idempotent video retries — a lost-response retry on doStart could have started a second billable generation, now prevented with an idempotency-key header. Also new is the Fish Audio provider for speech and transcription. On the security front, Cloudflare's WAF rules block SharePoint RCE and an updated Rails Active Storage RCE, plus improved SSRF detection, and Next.js 15.5.23 ports ReplyServer traversal guards to the FlightClient transport.