☕️ Google's AI found a 13-year-old Chrome bug

Hi there, this is your daily ☕️ Devshot.

In today's Devshot:

🔒 Google's AI found a 13-year-old Chrome bug

🐙 GitHub Copilot app adds stacked PRs

🦆 DuckDB v2.0 adds async Parquet reads

☁️ Cloudflare adds API for MoQ relays

Plus: 🎁 13 other news you might like, 🧰 6 tools, and 📚 5 papers.

🔒 Google's AI found a 13-year-old Chrome bug LINK

Google deployed a Gemini-powered AI agent that scans Chrome's entire codebase for vulnerabilities, uncovering a sandbox escape bug that tricked the browser into reading local files after lurking undetected for over 13 years.

The pipeline chains specialized agents: a fixing agent drafts candidate patches, a critic agent reviews them, and test-writing agents verify everything across every supported platform, plus automated triage that filters, reproduces, and rates incoming reports.

Across Chrome versions 149 and 150, Google patched 1,072 security bugs combined-more than the previous 23 updates together-while piloting twice-weekly releases and testing dynamic patching to skip browser restarts.

🐙 GitHub Copilot app adds stacked PRs LINK

The GitHub Copilot app now supports stacked sessions and stacked pull requests, letting you chain a series of related tasks in one repo where each session and its PR builds directly on the work below it.

You trigger a stack by asking Copilot to ship your current changes as a PR and spin up a new session that branches off that existing work, forming an ordered chain of PRs that ultimately lands on your main branch.

The author used it to modernize a decade-old React 15 app, planning in Plan mode with Claude Opus 4.8, and stacked a react-bootstrap removal on top of a CSS cleanup to avoid one giant PR.

🦆 DuckDB v2.0 adds async Parquet reads LINK

DuckDB v2.0, arriving this fall, will enable asynchronous I/O pipelines by default for Parquet and uncompressed seekable UTF-8 CSV files, letting worker threads decode data instead of blocking while remote byte-range reads complete.

A dedicated ASYNC thread pool (default 4× system threads, capped at 256) runs a read-ahead queue that prefetches upcoming row-group jobs, tuned via the `read_ahead_depth` option and governed by DuckDB's temporary memory manager to avoid out-of-memory issues.

On TPC-H Query 6 at SF100 reading a 22 GB Parquet file from S3, runtime dropped from 8.23s to 2.84s-nearly 3× faster-and a tuned config saturating a 25 Gbit/s link hit 2.23s, roughly 3.7× faster than v1.5.5.

☁️ Cloudflare adds API for MoQ relays LINK

Cloudflare shipped a MoQ provisioning API that lets you create isolated relays for your application and issue separate credentials for publishers and subscribers, with relays live across its network within seconds and no servers to deploy.

Provisioning creates an isolated scope over the existing Anycast network rather than starting a container or process, separating your namespaces, tracks, and objects, while scoped tokens grant publish, subscribe, or both, with per-token expiry and revocation.

Relays now support draft-14 and draft-16 of the MoQ Transport spec, adding PUBLISH so a relay receives a track before viewers connect, and SUBSCRIBE_NAMESPACE to request every track under a namespace; everything is free during the beta.

Other news you might like

• Skybridge: Build ChatGPT apps and MCP connectorsLINK

• Scaling Kubernetes pods with KEDA based on Amazon SQS queue depthLINK

• How to Use CI as Your Agent LoopLINK

• Article: Virtual Threads After JDK 24: What Changed for Production JavaLINK

• A deep dive into React FiberLINK

• llm 0.32rc2LINK

• Why do OpenAI's GPT-2 weights beat mine? Part three: testing overtrainingLINK

• Valve funding port of Linux RADV Radeon Vulkan driver to Windows, cross-platform effort already runs 'Counter-Strike 2'LINK

• Streaming QR codes at 60 FPS achieves nearly 190 KB/s data rate in phone-to-phone tests, browser-based method requires no app, no networking, no pairing, and no permissions beyond camera accessLINK

• Telemetry-driven development: How to gain confidence in your coding agents' behavior with gcx and Grafana MCPLINK

• OpenAI cuts GPT-5.6 pricesLINK

• Amazon accidentally spent $1.8 million using Claude for menial coding task, went 860% over budget, 'catastrophically expensive' coding blunders discovered in internal Amazon AI usage metricsLINK

🧰 Trending tools

Prefactor: an evaluation layer that scores agent runs in real time, flags quality regressions or drift, and pauses high-risk actions for human approval before production.LINK

Humalike x Hermes: provides turn-taking, timing, and memory APIs that help AI agents decide when to speak, wait, or interrupt naturally.LINK

ZooData: converts webpages into structured JSON, cutting LLM token usage by 75% while delivering pre-analyzed Amazon and TikTok e-commerce insights for AI agents.LINK

CartAI: automates checkout on any merchant site through a single API call, managing payments, shipping, and order tracking without custom integration work.LINK

ditto.site: converts any public URL into clean Next.js or Vite code deterministically, preserving components, design tokens, and hover states via a free API or MCP server.LINK

Replay QA: records website sessions with devtools access, letting you create detailed, shareable bug reports without running manual QA processes.LINK

📚 Trending papers & reports

Automated research digests generated by breaking the task into multiple guided steps succeeded 100% of the time versus only 50% for a single, one-shot prompt, while also producing higher-quality summaries.LINK

Oncall incident diagnosis tests show top AI agents correctly pinpoint the root cause of realistic production outages only 25.3% of the time, with one model inventing false causes 40% of the time.LINK

Automated coding-task generation turns real historical code updates into verified test tasks for training and evaluating AI coding agents, succeeding on ~80% of attempts and recovering ~29 points more usable tasks than prior methods.LINK

Human-robot teamwork rules get organized into one master checklist of 6 categories and 21 subcategories, built from 361 real requirements and validated on another 448, helping teams design safer joint human-machine systems without reinventing standards each time.LINK

AI-assisted requirements teaching found students who used a guided AI tool as an analysis aid, not an autopilot, got better at spotting clear, testable requirements, showing thoughtful course design beats letting AI just do the work.LINK

See you tomorrow for a new dose of ☕️ Devshot!