Malte Ubl
@industrialempathy.com
CTO at Vercel @cramforce on Twitter industrialempathy.com
We just released 𝚛𝚎𝚊𝚌𝚝-𝚋𝚎𝚜𝚝-𝚙𝚛𝚊𝚌𝚝𝚒𝚌𝚎𝚜, a repo for coding agents. React performance rules and evals to catch regressions, like accidental waterfalls and growing client bundles. How we collected them and how to install the skill ↓ vercel.com/blog/introd...
Introducing: React Best Practices - Vercel
We've encapsulated 10+ years of React and Next.js optimization knowledge into react-best-practices, a structured repository optimized for AI agents and LLMs.
vercel.com
We're celebrating the life of Mikeal, creator of request, forker and reuniter of Node.js, renaissance and family man on November 12. We received a very generous donation and are now able to make this event completely free. Looking forward to see all of you! an-event-mikeal-would-have-liked.com
An Event Mikeal Would Have Liked
Memorial charity event celebrating Mikeal Rogers' life - November 12, 2025
an-event-mikeal-would-have-liked.com
To honor a great friend and open-source pioneer Mikeal Rogers we're organizing a "conf" and charity auction. I'll be auctioning an exclusive wagyu BBQ at my house for up to 15. Join us and ideally offer more donations! All proceeds go to his wife and 2 kids an-event-mikeal-would-have-liked.com
An Event Mikeal Would Have Liked
Memorial charity event celebrating Mikeal Rogers' life - November 12, 2025
an-event-mikeal-would-have-liked.com
Cold starts are the Achilles' heel of serverless. Fluid fixes that. Learn how Vercel achieves a sub-0.6% cold start rate automatically through platform optimizations. vercel.com/blog/scale-...
Scale to one: How Fluid solves cold starts - Vercel
Learn how Vercel solves serverless cold starts with scale to one, Fluid compute, predictive scaling, and caching to keep functions warm and fast.
vercel.com
Prompt injection is sometimes called an "unsolvable". But we shouldn't give up like that. I've been on a mission to introduce hard security boundaries into AI agents and this is the next step: What if compromised MCP tools couldn't just passively prompt inject your app?
Vercel@vercel.com · 11mo agoAgents that load dynamic MCP tools risk security and quality issues: • Prompt injection • Unreliable tool calls • Unexpected changes • Wasted tokens 𝚖𝚌𝚙-𝚝𝚘-𝚊𝚒-𝚜𝚍𝚔 generates static tools you control so they stay stable and predictable. vercel.com/blog/genera...
Search 1M+ GitHub repositories from your AI agent using Grep's MCP server. Your agent can now reference coding patterns and solutions used in open source projects to solve problems and answer questions. vercel.com/blog/grep-a...
Grep a million GitHub repositories via MCP - Vercel
Search 1M+ GitHub repositories from your AI agent using Grep's MCP server. Your agent can now reference coding patterns and solutions used in open source projects to solve problems.
vercel.com
At Vercel Ship 2025, Malte Ubl shared a no-nonsense approach to building AI agents. Learn how to build and secure AI agents that automate complex workflows, and understand the product and business impact behind them. vercel.fyi/J9sgXzv
Vercel Ship 2025: The no-nonsense approach to AI agent development with Malte Ubl
Learn how to build secure, production-grade AI agents.
vercel.fyi
I am delighted to announce that @vercel.com are investing in Nuxt! they are backing our vision of the open web, hiring me as well as other core team members (@atinux.com, @pi0.io + @antfu.me), to continue to work full time on Nuxt we remain independent — and our vision and ethos are not changing 💚
NuxtLabs, creators of Nuxt and Nitro, are joining Vercel. Same license, roadmap, and open governance, but now in a joint mission to build the best web.
Building AI agents (and workflows) doesn't have to be complicated. In fact, it's more approachable than you might realize. Hear practical advice from Vercel CTO @industrialempathy.com on building agents. vercel.com/blog/the-no-...
The no-nonsense approach to AI agent development - Vercel
Learn how to build reliable, domain-specific AI agents by simulating tasks manually, structuring logic with code, and optimizing with real-world feedback. A clear, hands-on approach to practical autom...
vercel.com
I'm traveling to Berlin next week and we're doing a Vercel meetup to celebrate the opening of our new Berlin office. I have a whole queue of blog posts about agents coming out and will be turning them into a lightning talk, and we'll have a panel, etc. The usual! partiful.com/e/9Is88RwZV9...
RSVP to Vercel Berlin Meetup | Partiful
Berlin! 🇩🇪 Vercel is coming to Berlin to host its June meetup. Join us for community talks, a Vercel q&a panel, and networking. Bring all your Vercel & Next.js questions. And yes, come hungry! We'l...
partiful.com
MCP allows you to build integrations for AI models. Deploy your Model Context Protocol (MCP) server on Vercel and connect to it from clients like Claude, Cursor, and more. Learn more and get started with our updated template. vercel.com/changelog/mc...
![Code snippet: // app/api/[transport]/route.ts
import { createMcpHandler } from '@vercel/mcp-adapter';
const handler = createMcpHandler(server => {
server.tool(
'roll_dice',
'Rolls an N-sided die',
{ sides: z.number().int().min(2) },
async ({ sides }) => {
const value = 1 + Math.floor(Math.random() * sides);
return { content: [{ type: 'text', text: `🎲 You rolled a ${value}!` }] };
}
);
});
export { handler as GET, handler as POST, handler as DELETE };](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:m2jwplpernhxkzbo4ev5ljwj/bafkreicgk7cyi6xecgfzaiaoqppevkcr4rkanrlxfoexavx3kfhnf7g6gy)
We looked deeply into the recent React Router/Remix CVE & deployed mitigation for Vercel customers through our firewall - It enables stored XSS - High likelihood that any React Router app is impacted - If using another CDN action may be required - Upgrade recommended vercel.com/changelog/pr...
Protection against React Router and Remix vulnerabilities - Vercel
Security researchers reviewing the Remix web framework have discovered two high-severity vulnerabilities in React Router. Vercel proactively deployed mitigation to the Vercel Firewall and Vercel custo...
vercel.com
Next.js 15.2 • Redesigned Error UI & Improved Stack Traces • Streaming Metadata • Turbopack Performance Improvements • View Transitions (experimental) • Node.js Middleware (experimental) nextjs.org/blog/next-15-2
Next.js 15.2
Next.js 15.2 introduces an improved error experience, streaming metadata, Turbopack performance improvements, and more.
nextjs.org
I finished university in 2004 and made a big stupid mistake: I wrote my thesis in German. I've literally been sad about this ever since. But AI to rescue: I dusted off an old PDF and had Gemini Pro translate it to English
A PKI based on decentralized trust for P2P transaction processing [2004]
The text below is Malte Ubl's diploma thesis from 2004. Diploma was the name of the primary academic title
industrialempathy.com
Does anyone know the status of the Private State Token API? It seems shipped in Chrome but the demos appear broken and it doesn't look like Google shipped a generic issuer like Apple did for Private Access Tokens.
I just remembered how an internet mob chastised the Google intern who wanted to ship an async version of Local Storage using tech that allowed shipping Chrome feature using only JS knowledge. Both the feature and the underlying tech was killed. Imagine what could have been.
Fingerprinting is bad for privacy because it is out of user control. The villainification of browser cookies has pushed the world into a direction that is objectively worse for users. Cookies you can delete, auto-rotate, scope per site. Fingerprints stay with you ico.org.uk/about-the-ic...
Our response to Google’s policy change on fingerprinting
ico.org.uk
Corporate organizations are distributed systems! My new blog post somewhere between tautology, cause of course they are, and hot take. But I think I might have stumbled over a helpful framing to manage risk & velocity when shipping software in larger teams www.industrialempathy.com/posts/organi...
Organizations are distributed systems
The assertion that “corporate organizations are distributed systems” hovers between being a tautology—since it is literally true—and a hot...
industrialempathy.com
Most folks outside the US don't realize that Fahrenheit is a super intuitive temperature unit. The degrees Fahrenheit, represent the maximum miles per hour you can drive safely at the temperature
I was randomly looking at the Vercel Firewall for my personal site. Turns out a small attack was mitigated. I then looked at our global dashboard, and, indeed, the attacker only hit my site and they got a total of 19 requests through before they were blocked. What have I done to you, attacker?
Vercel Remote Cache is now free for all plans. Never do the same work twice in your Turborepo or Nx repository with a shared store of build outputs and logs for your team. vercel.com/changelog/fr...
Vercel Remote Cache is now free - Vercel
Vercel Remote Cache is now free for all plans. Never do the same work twice in your Turborepo or Nx repository with a shared store of build outputs and logs for your team.
vercel.com
Right now Vercel responds with your project's HTML 404 response for all system-identified 404s (for functions/APIs you control the response directly). How would you feel if we changed it such that we responded with a generic response if the client doesn't expect HTML?
Excited about my demo tomorrow at the internal Vercel hackathon
Vercel TypeScript SDK • Full type safety for accessing the Vercel REST API with Zod schemas • New documentation for every function, argument, and type • Better tree-shaking support with optional standalone functions vercel.fyi/sdk
Introducing the Vercel TypeScript SDK
A new type-safe SDK for working with the Vercel REST API.
vercel.fyi
You can't make this up: The spec for SSRing web components is itself not isomorphic. It only works when running through the document parser, but not innerHTML. Respectively, the code needs to know where it is running and use vastly different code paths.
