AI coding tools move from magic to control planes

The AI coding market spent the fortnight turning agentic promise into operating surfaces. Vercel was the clearest example. On 19 Oct it added Mercury 3 to AI Gateway with one API key, no provider account requirement, spend tracking and request traces. On 21 Oct it made WebSocket support generally available in Vercel Functions and added DeepSeek V4.1 Flash in Token Pass. On 23 Oct it put Spend Management into the CLI, letting users manage budgets and view spending.

That is not launch theatre. It is the infrastructure layer around AI development being made visible to teams that now have to govern usage, cost and runtime behaviour. Vercel also changed Hobby packaging on 20 Oct, adding Global Points of Presence, Vercel Regions, Automatic Routing, HTTPS Certificates, TLS/SSL Encryption, Traffic Load Balancing, Private Inter-Region Network and Automatic Region Failover, while removing included 1M CDN requests per month and 100 GB data transfer per month from Hobby.

GitHub moved in the same direction from the security side. On 21 Oct it launched package firewall in public preview and announced updates to secret scanning. Its gh-aw releases over the period repeatedly touched firewall, validation, workflow linting, safer checkout credential handling and work-queue reliability. The category is still marketed as acceleration, but the product work observed this fortnight is about control.

Vercel's Jev push was sustained across the period. On 19 Oct, four articles highlighted Jev as the fastest-adopted model in Vercel AI Gateway history, with one report saying it was twice as popular as the previous model, Sonnet 5.5. On 20 Oct, Vercel said Jev had reached 35% adoption among paid teams within two weeks. On 21 Oct, an open-source reference app for durable agent state was available on AI Gateway. On 24 Oct, Vercel launched Jev as an open-source model and tied it to a broader Shopify integration for AI storefronts.

The shape is coherent: gateway, model, state, spend, traces and deployment are being presented as one stack. Vercel also released [email protected] on 26 Oct, with a security update removing the `nanoid` dependency, and released Next.js 16.5.0-canary.27 on 25 Oct with changes including inline Flight script construction from React strings and a fix for the dist dir lockfile issue.

The company is also pruning and repackaging the front door. On 22 Oct it added product pages for mem, raycast, terraform, vercel-analytics and zeitgeist-app while removing five pages including railway and several templates. On 23 Oct it added 25 product pages and removed 27. On 24 Oct it launched pages for Remotion and Next.js and removed pages related to partnerships and composable commerce migration. On 26 Oct it launched a page for Ratzilla and removed the page for CQRS. The edits read like a catalogue being actively re-sorted around what Vercel wants developers to find first.

The loud launches were easy to see. The subtler move was the simultaneous page churn across several vendors. Cursor added 48 product pages and one documentation page on 22 Oct while removing 47 product pages and two documentation pages. On 23 Oct it added 51 product pages and one documentation page while removing the same counts. On 25 Oct it added three Grok Bot documentation pages, covering approvals, media creation and memory, alongside 105 new product pages and 108 removed product pages.

Lovable did the same in a more demand-generation-heavy way. On 20 Oct it added 32 product pages for builders, including dashboard, database, portfolio website and SaaS builders across English, German and Spanish, while removing 27 product pages. On 21 Oct it added two blog pages, one careers page, one documentation page and 13 product pages, while removing one careers page and 16 product pages. Its ads also stayed live at scale: on 21 Oct there were 34 new Google ad creatives with 40 creatives running in total, on 22 Oct there were 24 new creatives with 40 running, and by 26 Oct there were 29 new creatives with 40 running.

This is the useful read of the week. The market is not just shipping features. It is rewriting how it wants to be compared. Vercel shifted product pages across 22, 23, 24, 25 and 26 Oct. Cursor rewrote large parts of its product and documentation surface on 22, 23 and 25 Oct. Lovable changed product pages, jobs and ad creative in the same window. When positioning, hiring and documentation all move together, the category is making decisions before the press release catches up.

GitHub's fortnight was security, enterprise proof and Copilot distribution. On 20 Oct it announced that several Copilot models would be deprecated on 19 Oct 2026, with reporting also noting the retirement of six models for GPT-5.6. On 24 Oct it published a GitHub Copilot integration into Microsoft Teams, introduced a usage metrics API that tracks usage from tools such as OpenCode, and updated HydraFusion with more AI models and a new Max option.

Its customer surface also widened. On 20 Oct GitHub added logos from The Home Depot, Stripe and Mercedes-Benz. On 21 Oct it added Braintree and Coinbase, with case studies for Braintree, Coinbase, Buffer, Cesium and Knock. On 22 Oct it added Costco, with a case study saying GitHub Enterprise helped alleviate engineering overhead. On 23 Oct it added BuzzFeed, John Wiley And Sons, Dominion Enterprises and CyberAgent, with case studies including BuzzFeed's DevOps workflows and John Wiley And Sons improving development speed by eliminating silos.

Replit made an explicit institutional turn. On 20 Oct it acquired Atta, identified as an AI analytics startup, with no deal value disclosed. On 23 Oct it added a government-sector product page and reported Michael Greenwald's appointment as President of Corporate Affairs to lead expansion into the global government sector. On 24 Oct the appointment was repeated in leadership-change monitoring, and CEO Amjad Masad was reported as saying Replit had made OpenAI its default AI provider and discontinued its partnership with Anthropic. Replit also added 98 documentation pages on 24 Oct addressing agent troubleshooting and functionality questions, plus a new pricing page.

The fortnight also showed the operational burden behind the category's growth. GitHub reported a critical incident on 20 Oct with degraded availability for Actions, Pages and Webhooks lasting around 68 minutes. On 22 Oct it reported a critical incident causing delays for Pull Requests and Webhook deliveries lasting around 270 minutes. On 23 Oct it reported minor incidents for delayed project updates and Actions results, lasting around 662 minutes and 61 minutes respectively. On 24 Oct it reported three further minor incidents, including Grok 4.6 and Grok 4.7 service issues, Dependabot Alerts disruption and delayed Actions status check results.

Cursor reported three Grok Bot service degradations on 20 Oct with minor impact, lasting around 19, 67 and 27 minutes. On 22 Oct it reported elevated errors for Bitbucket Cloud integrations lasting around 13 minutes, a service degradation lasting around 114 minutes and another degradation resolved immediately. On 24 Oct it reported a major incident where Grok models were unavailable for around 41 minutes.

Lovable reported five incidents on 24 Oct, including three major outages affecting database setup, Lovable Cloud enablement and GitHub syncing, lasting around 36, 27 and 129 minutes. On 25 Oct it reported a major incident where chat and project changes failed for some users for around 19 minutes. Vercel reported a minor issue on 23 Oct causing delays in Logs and Observability data, resolved the same day, and was also reported on 23 Oct as having implemented emergency firewall rules in response to a critical Brotli decoder flaw. In a market that sells developer speed, resilience and incident communication are now visible buying criteria.