Vercel AI Updates: October 24, 2026

1. Vercel Agent Ties Production Permissions to Approved Plans

Vercel. Vercel published how Vercel Agent handles access to production: the agent investigates under a read-only baseline (every registered read: scope), then proposes a plan listing its tasks and the scopes each one needs, and approving the plan as a whole grants the extra permissions. Vercel Agent runs as a Vercel App limited by the user’s existing permissions, and the Vercel OAuth service issues short-lived scoped tokens that Vercel APIs check on every request, so an operation outside the token is rejected even if the model decides it is needed. External actions such as opening a GitHub pull request use separate provider credentials scoped to a specific repository. Plans are validated against the same scope registry the OAuth service uses, so unknown or outdated scope names are rejected during planning rather than falling back to broader access. Source

2. Kimi K3.1 Pro and K3.1 Pro Highspeed Arrive on AI Gateway

Vercel. Moonshot AI’s Kimi K3.1 Pro and a faster Highspeed variant for interactive use are now available on AI Gateway as moonshotai/kimi-k3.1-pro and moonshotai/kimi-k3.1-pro-highspeed. Vercel says the model builds on Kimi K3 with improvements in coding, 3D modeling, financial analysis and long multi-step agent runs, and keeps the 1M-token context window and image input. The models can be called through the AI SDK, the Chat Completions, Responses and Anthropic Messages APIs, or coding agents such as Claude Code, Codex and Cursor via the Vercel CLI setup. Moonshot plans to release the weights by November 4, with more providers to follow. Source

3. Vercel Connect Issues Per-Agent Restricted Stripe Keys

Vercel. Vercel Connect’s Stripe connector now offers a Managed API Key option that creates a separate restricted Stripe key for each agent or task, limited to the permissions the developer selects (for example, read-only access to charges for a revenue-report agent). Vercel creates and stores the key so no secret is pasted into the project, and keys can be rotated from connector settings without redeploying, with the old key valid for up to 24 hours. The existing MCP and bring-your-own-key connection methods are unchanged. Source

4. Agents Can File Feedback Through Vercel MCP and the CLI

Vercel. Vercel MCP added a submit_feedback tool that lets an agent or harness send bug reports, friction reports and feature requests to Vercel with structured context about the task, expected behavior and what went wrong; it requires sign-in and only sends when the user asks. The Vercel CLI gained a matching vercel feedback command with repeatable -f/--field key=value flags, which Vercel says coding agents can also use when they hit issues. Source Source