Vercel AI Updates: October 23, 2026

1. Vercel Pushes OIDC for Agents and Sets Deadlines for Marketplace Vendors Using Static Keys

Vercel. Vercel CTO Malte Ubl announced a push to replace long-lived static credentials with short-lived OIDC tokens, citing agents and prompt injection as new paths for leaked keys; Vercel says applications can already reach Blob, AI Gateway and Sandbox via OIDC, and Vercel Connect lets apps and agents request scoped provider tokens at runtime instead of storing secrets. The company released OIDC UI, a shadcn/ui registry with trust-policy forms and a server-side token verifier for providers, and is extending OIDC to the Vercel API and CLI. Vercel says only 8.4% of more than 1,000 surveyed SaaS vendors support secure authentication; Marketplace vendors without OIDC support will get a “Not secure” label by November 30, 2026 and be delisted by January 2027. Source