DeepSec Goes Open Source, TinyFish Goes Free, Grok Joins the Connector Economy, Workspace Agents Hit the Meter, and Claude Opus 4.7 Lands in Your Spreadsheet — Vibe Coding's Surround Week

The Vibe Coding Desk··16 min read

DeepSec Goes Open Source, TinyFish Goes Free, Grok Joins the Connector Economy, Workspace Agents Hit the Meter, and Claude Opus 4.7 Lands in Your Spreadsheet — Vibe Coding's Surround Week

Last week's recap was about the brain. Mistral Medium 3.5 with Remote Agents in Vibe, Visual Studio's cloud agent running on GitHub Actions, Kaltura's open-source skills for any agent that loads SKILL.md, and the VS Code 1.119 commit-attribution reset that put non-technical builders' names back on the door. Four launches that all said the same thing: the brain of vibe coding moved to the cloud.

This week, between April 30 and May 6, 2026, the brain stayed where it was. The change was everything around it.

Five launches landed back-to-back, and at first glance they look unrelated. An open-source security harness from Vercel. Free web tools for every coding agent from a Bay Area startup most builders haven't heard of. A connector rollout from xAI. A pricing change at OpenAI. And a financial-services briefing in New York where Anthropic shipped a model, ten templates, and four Microsoft 365 add-ins in a single morning.

Stack them up and one shape becomes obvious. The brain of vibe coding is no longer the part that moves the most. The senses, the auditor, the connectors, the receipts, and the workspace presence are.

None of these is "a new app builder." All of them are about the surfaces that touch the agent: how it gets audited, what it can see, what it can connect to, how you pay for it, and where in your day it shows up.

Here's what each story changed and how to take advantage of the new shape.

1. Vercel DeepSec — Open-Source, Agent-Powered Security Review for Anyone Who Ships

For two years, the most legitimate, hardest-to-dismiss objection to vibe coding has been some version of: the agent might be writing code with security holes you don't have the eyes to see. The ACM TechBrief on April 30, 2026 flagged it. Every responsible piece of coverage flagged it. The fair response from the platforms has been "we're working on it."

Five days later, on May 4, 2026, Vercel shipped a working answer — and open-sourced it.

DeepSec is, in Guillermo Rauch's framing on the launch tweet, "an open-source agent orchestrator for deep security reviews." Practically, it is a small CLI you can run with a single command:

npx deepsec

The harness combines two passes. A static-analysis pass identifies security-sensitive files — anything that touches authentication, data flow, secret handling, or external input. A coding-agent pass investigates each candidate, traces the data through the codebase, checks for mitigations, and writes up a finding with a severity rating. Vercel built it for internal use, then ran it against major open-source projects, then released it once they had conviction. The reported false-positive rate sits at roughly 10–20% — high enough to require triage, low enough that triage is the right word.

The deployment story is the part most non-technical builders will appreciate. DeepSec runs on your own machine, with your own keys, against your own source code. You don't upload your codebase to Vercel. You don't sign up for a service. You can use Vercel's infrastructure to scale it to 1,000+ concurrent sandboxes when you want to, but you don't have to. The base case is: download, run, read the report.

Three reasons this is a vibe coding milestone, not just a Vercel release:

  1. It directly addresses the ACM brief's biggest concern. Inherited training-data vulnerabilities, untested code paths, and "hard for humans to review" output are exactly what an agent-powered security review can find. The brief and the harness sit five days apart, and they read like a question and an answer.
  2. It is open-source. Other platforms can fork it. The pattern — pair a static-analysis sieve with a coding-agent investigator — is the kind of architecture every AI app builder will want to ship under the hood. By open-sourcing it, Vercel turned a competitive feature into a category capability.
  3. It belongs to the builder. A non-technical builder shipping a vibe-coded app to real users no longer has to choose between "ship without an audit" and "hire a security engineer for a week." The middle path — run an agent-powered audit yourself, triage the findings, ask your favorite agent to fix them — is now real.

You should run it once this week, even just on your most-deployed app. The cost is a few minutes. The output is something you didn't have yesterday: a list of issues, ranked, with reasons.

2. TinyFish Goes Free — Every Agent Just Got Live Web Eyes

The second story is the one that will compound the fastest in your day-to-day use.

On May 4, 2026, TinyFish — a startup that ships web infrastructure for AI agents under a single API key — made its Search and Fetch endpoints free for every developer and every agent. No credit card. No paid tier required. 500 onboarding steps included; 5 Search queries per minute and 25 Fetch URLs per minute on the free tier; production volumes available on paid plans for users who need them.

The supported agent list reads like a who's-who of where vibe coding actually happens in 2026:

  • Claude Code
  • Cursor
  • OpenAI Codex
  • OpenClaw
  • Hermes Agent
  • OpenCode
  • Cline
  • Goose
  • Antigravity

Setup is two steps. One terminal command — npm install -g @tiny-fish/cli — and a tiny-fish setup. The CLI exposes Search, Fetch, Browser, and Agent endpoints; the SKILL.md instruction file teaches your agent of choice when to call which one and how to interpret the response.

The benchmark numbers are the interesting part. According to TinyFish's published methodology — which you can verify by running the same tests yourself — the CLI-plus-Skill approach uses 87% fewer tokens per web operation than native MCP flows and doubles task completion on complex multi-step tasks. The reason is structural: instead of streaming a giant blob of HTML through the model, the skill gives the agent a structured, opinionated way to ask for exactly what it needs and parse what comes back.

For a non-technical builder, the immediate effect is the one most people don't notice until it disappears: the agent stops guessing about the web. Pricing pages get fetched accurately. Documentation gets read in full. Competitor sites get summarized correctly. The "but where did the agent get that number?" problem softens, because the agent has a free, fast tool to actually go look.

The strategic effect is bigger. For a long time, "give the agent web access" was a gated capability — you needed a paid Bing key, a SerpAPI subscription, a Bright Data plan, or a corporate browser-automation tool. The reason those mattered wasn't that they were technically uncopyable. It was that they cost money. As of May 4, that's no longer the gate. Web context is now table stakes for any agent that wants it. Every vibe coding tool above the agent layer should ship this within weeks.

If you do one thing from this week's list, install the CLI tonight. The compounding will start tomorrow.

3. Grok Joins the Connector Economy

On the same day, on the other side of the model market, xAI began rolling out Grok Connectors — first-party integrations available at grok.com/manage-connectors for paid Grok accounts.

The launch lineup is pragmatic, not flashy:

  • GitHub — repos, issues, PRs
  • Notion — pages, databases
  • Linear — issues, projects
  • Google — Drive, Gmail, Calendar, Docs
  • Microsoft — Outlook, OneDrive, Excel, Word, PowerPoint

Past the prebuilt list, the more important capability is support for custom remote MCP servers. You provide a server URL and optional configuration, Grok handles the auth handshake, and the server's tools become available inside the conversation — exactly the way Claude's tools and ChatGPT's connectors work. The Model Context Protocol, born inside Anthropic and adopted across the open-source agent ecosystem, is now spoken by all four major chatbots.

Two reasons this matters more than a "vendor X added integrations" headline suggests:

First, the lock-in story is dissolving. A year ago, the answer to "but my agent can't talk to Notion / Linear / Calendar" was either "use a different agent" or "build it yourself with their API." This week, every major agent on the market — Claude, ChatGPT, Grok, plus the open-source CLI agents that already speak MCP — can connect to the same set of business apps using the same protocol. The chat surface stays a preference. The wiring underneath is becoming a commodity.

Second, this is the moment Grok stops being a chat app and starts being a daily-apps glue layer. TestingCatalog's read on the connector rollout — "the steady drip of new endpoints points to a plan to turn Grok from a chat companion into the glue holding a user's daily apps together" — is the right read. For a non-technical builder, that means there are now four production-grade options for the connector layer of your stack, and you can pick whichever one's UX clicks.

If you've been building inside one assistant out of inertia, this is a good week to spin up an account on a second, hook it to two of your daily apps, and run the same task through both. The differences will tell you which interface actually fits your brain.

4. OpenAI Workspace Agents Hit the Meter — The Workplace Agent Is a Line Item Now

On April 22, 2026, OpenAI introduced Workspace Agents, described as the official successor to custom GPTs for ChatGPT Business, Enterprise, Edu, and Teachers plans. They're shared, long-running agents that operate inside an organization's permissions and identity boundaries, run in the cloud (so they keep working when your laptop is closed), and can be created from scratch or instantiated from pre-built templates. Under the hood, they're powered by Codex — the cloud-based agent harness OpenAI has been building out aggressively all year. The plug-in surface area covers Slack, Google Drive, Microsoft apps, Salesforce, Notion, Atlassian Rovo, and other enterprise apps, with a 90+ connector ecosystem behind them.

The launch came with a free preview window. That window closed on May 6, 2026. Pricing is now credit-based.

The price tag is the small part of the news. The bigger part is what the price tag confirms:

A shared, long-running, multi-tool agent is now a line item — billed, audited, and accountable — inside an organization, the same way a Slack seat or a Salesforce license is.

That's the moment a category becomes infrastructure. It happened to email in the 1990s, to Slack in 2014, to Zoom in 2020. It is happening to workplace agents now, and the May 6 transition is the cleanest dateable marker.

For non-technical builders inside an organization, four things follow from that:

  1. The "should we try one?" conversation is largely over. The actual conversation is "how many do we want, which workflows, and who owns each agent's behavior?"
  2. The agents you build will outlive your laptop sessions. Workspace agents run in the cloud regardless of whether you're at your desk. Treat them like a coworker, not like a Spotify queue.
  3. The audit and compliance perimeter is not a future feature. Workspace Agents inherit organizational identity, permission scopes, and credit usage logs from day one. The thing finance and security ask about — "where did that agent's data access come from, and is it auditable?" — is part of the product.
  4. The cost-per-agent will drive a different kind of build discipline. Free meant "spin up everything, see what sticks." Credit-billed means "what is each agent worth to us this quarter?" That discipline is good for non-technical builders specifically, because it forces explicit value attribution to work the agent does on your behalf — and value attribution is how a non-technical builder's contribution gets recognized.

If you're on a Business, Enterprise, Edu, or Teachers plan, this is also a good week to take inventory of any custom GPTs your team has accumulated. OpenAI has signaled that the custom GPT standard for organizations will be deprecated on a future date, with a required upgrade path to Workspace Agents. Doing the migration now — while you have the headspace and before the deadline — is meaningfully easier than doing it under pressure.

5. Claude in Your Spreadsheet — Anthropic's Wall Street Day, Read From the Cheap Seats

The largest single news beat of the week was May 5, 2026, in New York, at Anthropic's invite-only financial services briefing. The headlines about Wall Street agents and Jamie Dimon's endorsement were earned. The story underneath them is the one that matters for non-technical builders.

What shipped, in order:

Claude Opus 4.7. The most capable Claude model to date for complex agentic coding and long-horizon financial reasoning. Strong gains on long-running tasks, fewer hallucinations on multi-step traces, and tighter response calibration. The model is what powers the rest of the announcements; if you're already on Claude, you'll feel it.

Ten finance agent templates. Pre-built agent definitions covering credit decisioning, deposit retention, customer onboarding, fraud prevention, and other workflows. The relevant pattern for non-technical builders isn't the finance domain — it's the templating. Anthropic shipped these the same way Workspace Agents ship templates, the same way agent skills ship via SKILL.md, the same way Kaltura shipped its open-source skills the previous week. Domain templates are now how agents arrive. Expect a marketing-templates announcement, an HR-templates announcement, a creator-templates announcement on the same cadence over the coming weeks.

Full Microsoft 365 integration. Claude add-ins for Excel, PowerPoint, and Word went generally available. Claude for Outlook entered beta. Each add-in carries shared context across the four — meaning Claude can read a number out of Excel, drop it into a PowerPoint chart, write the email about it in Outlook, and pull a snippet from a Word doc, all in one conversation. As Fortune put it, this is the integration financial services firms have been asking for — but the use case generalizes immediately to any non-technical builder who lives in the Microsoft suite. Which is most of them.

Native data apps from nine partners. Moody's, Verisk, Dun & Bradstreet, Experian, GLG, Guidepoint, IBISWorld, Third Bridge, and Fiscal AI — joining the existing roster of LSEG, S&P Capital IQ, Morningstar, and PitchBook — became native apps inside Claude. The pattern is the same as Kaltura's skills: a domain provider ships an officially maintained, agent-readable surface for its data, and any agent that supports the standard can use it.

The FIS Financial Crimes AI Agent. Announced May 4, co-built with Anthropic, with BMO and Amalgamated as launch banks. The agent compresses anti-money-laundering investigations from hours to minutes — assembling evidence across core systems, scoring activity against typologies, and surfacing the highest-risk cases for human review. Anthropic's Applied AI team and forward-deployed engineers are embedded with FIS to transfer the playbook so FIS can build the next nine agents themselves.

Jamie Dimon's endorsement. JPMorgan's CEO publicly endorsed the direction at the New York event. Read literally, that's a banking-industry signal. Read for the surround-sound week, it's a piece of the same picture: the most conservative chair in the most conservative industry standing on stage and saying yes, this category is the future. For non-technical builders, that's a free legitimacy boost any time someone's spouse, parent, or skeptical colleague asks if "this AI thing" is real.

The takeaway non-technical builders should bookmark: the Microsoft 365 integration is the part of this announcement you can use today. If you build in Excel, Word, PowerPoint, or Outlook — and the chances you do are high — install the Claude add-ins (or, if you're a ChatGPT-first user, install the equivalent ChatGPT for Microsoft 365 connectors). The grunt work that used to keep your side project from shipping — formatting, summarizing, cross-referencing, drafting — gets eaten by an agent that already lives where you live.

What All Five Stories Have in Common

Sketch them on a whiteboard and the five aren't a list. They're five sides of the same shape:

| What got plumbed last week (April 28–May 5) | What got plumbed this week (April 30–May 6) | |---|---| | The brain moved to the cloud (Mistral Medium 3.5 + Remote Agents) | The auditor opened up (Vercel DeepSec, open source) | | The IDE became a door, not a destination (Visual Studio cloud agent) | The senses went free (TinyFish Search + Fetch for every agent) | | The skills standardized as a SaaS deliverable (Kaltura) | The connectors unified (Grok Connectors + custom MCP, joining Claude/ChatGPT's existing economies) | | The byline stayed yours (VS Code 1.119 reset) | The receipts arrived (OpenAI Workspace Agents on credit pricing) | | | The workspace presence went mainstream (Claude Opus 4.7 + Microsoft 365 add-ins + 10 finance templates + 9 data apps) |

Last week was about the part of the agent that thinks. This week is about the parts of the agent that see, audit, connect, get billed for, and show up at your desk. Both are necessary. Neither is sufficient on its own. Stacked together, they describe what 2026 vibe coding actually feels like to use: a brain that runs in the cloud, eyes that read the live web for free, an auditor that runs on your laptop, connectors that work across tools, billing that makes the work a budget line, and presence inside the same documents you've been opening for ten years.

That's not "AI replaces non-technical builders." That's "the boring infrastructure of building software finally caught up to the chat box."

Five Moves to Make This Week

1. Run DeepSec on your most-deployed app. One npx deepsec. One coffee. Read the report. Triage what's real. Ask your agent to patch what's worth patching. (Vercel blog · GitHub)

2. Install the TinyFish CLI on your default agent. npm install -g @tiny-fish/cli plus the SKILL.md gives your agent live web context for free, with a 2x complete-rate boost on complex tasks per the published benchmarks. (TinyFish blog)

3. Wire up two new connectors. Pick the two business apps you use most (Notion, GitHub, Linear, Calendar, Drive — your call) and connect them to whichever agent you live in. With Grok joining the connector economy, all four major chatbots now speak a compatible wiring vocabulary; experiment with one you haven't tried. (Grok Connectors via xAI)

4. Take inventory of your custom GPTs. If your organization has a ChatGPT Business/Enterprise/Edu/Teachers plan, list out every custom GPT your team has built. With Workspace Agents now on credit-based pricing and a future deprecation date for legacy custom GPTs, doing the migration on your schedule beats doing it under deadline pressure. (OpenAI)

5. Install the Claude (or ChatGPT) Microsoft 365 add-in. Whichever one matches your default agent. The Claude add-ins for Excel, Word, and PowerPoint are GA; Outlook is in beta. The grunt work in your day-to-day workspace tools is the cheapest possible win this week. (Fortune coverage)

The Bigger Picture

Every weekly readout of vibe coding for the last six months has had the same temptation — to hold up a single launch as the moment "everything changed." The honest pattern is the opposite. Every week has had four or five smaller launches that together changed the shape of what builders can do.

This week's surround layer is the one that quietly removes the last set of asymmetries that used to gate non-technical builders out:

  • The security asymmetry — engineers had review tools, you didn't. DeepSec closes that.
  • The information asymmetry — engineers had paid web tools, you didn't. TinyFish closes that.
  • The integration asymmetry — engineers had APIs and SDKs, you had no-code tools that broke at the third edge case. The connector economy + MCP closes that.
  • The accountability asymmetry — engineers had budget lines and ownership, you had a "where did this come from?" question every quarter. Workspace Agents on the meter closes that.
  • The presence asymmetry — engineers got AI in their IDEs first, you got it in your spreadsheets last. Claude Opus 4.7 + Microsoft 365 closes that.

The agent's brain still matters. But the brain is no longer the difference. The difference is everything around it — and this was the week the everything around it got serious for the people the category was supposed to serve from the beginning.

Andrej Karpathy's "agentic engineering" framing from April 30 captured a craft. This week's launches built the scaffolding the craft runs on. Both of them, together, describe a category that's no longer experimenting at the edges. It's furnishing the room.

You're the one in the chair. The agent is doing the typing. The auditor is on duty. The senses are free. The connectors are universal. The receipts are itemized. And the spreadsheet you opened ten years ago is suddenly the smartest tool on your desktop.

Keep building.

The Vibe Coding Desk is Voxel's weekly readout on AI app builders, agentic coding, and what every shift means for non-technical builders. New posts ship most weeks.

Sources: