WEBVTT

1
00:00:00.660 --> 00:00:06.630
What's up, everyone? Welcome to Next in Dev, a weekly overview of all the news I could find in the modern web dev industry.

2
00:00:07.150 --> 00:00:23.380
This week, Anthropic is suing the US government, AI just found a fifth of Firefox's annual high-severity bugs in two weeks, OpenAI is buying another company, Astro 6 just dropped, and there's a ton of tooling news across Cloudflare, ShadCN, Cursor, Figma, and more.

3
00:00:23.420 --> 00:00:28.250
Let's dive in. The biggest story this week is a lawsuit. It's always a lawsuit these days.

4
00:00:28.260 --> 00:00:38.800
Anthropic filed suit against the Trump administration, the Department of War, and 16 other government agencies after being designated a supply chain risk by Defense Secretary Pete Hegseth.

5
00:00:38.940 --> 00:00:44.800
If you don't already know, Anthropic has had tools deployed in classified government work since 2024.

6
00:00:45.460 --> 00:00:56.040
Their contracts always included restrictions, specifically around lethal autonomous weapons and mass surveillance of Americans. Hegseth demanded those restrictions be removed entirely.

7
00:00:56.120 --> 00:01:07.619
Anthropic tried to negotiate a compromise, and while those talks were still happening, Trump publicly called the company left-wing nut jobs and directed all agencies to stop using Anthropic tools.

8
00:01:07.700 --> 00:01:16.039
Hegseth followed up by labeling them a supply chain risk, which also prohibits any government contractor from using Claude. Anthropic isn't seeking money in this lawsuit.

9
00:01:16.080 --> 00:01:20.860
They want the court to declare the directive unconstitutional and reverse the supply chain designation.

10
00:01:21.110 --> 00:01:27.180
They say hundreds of millions or even billions of dollars in contracts, both government and private sector, are now in jeopardy.

11
00:01:27.400 --> 00:01:38.560
Nearly 40 employees from Google and OpenAI filed a court brief supporting Anthropic's position on limiting dangerous AI uses. These are people from direct competitors publicly backing Anthropic's stance.

12
00:01:38.980 --> 00:01:49.070
Meanwhile, OpenAI's Sam Altman admitted to rushing through a new DoD contract to fill the gap. How convenient. Microsoft, Google, and Amazon said they'll keep using Claude outside of defense work.

13
00:01:49.640 --> 00:01:56.160
Legal experts expect this could go all the way to the Supreme Court. Every AI company with government ambitions is watching this.

14
00:01:56.380 --> 00:02:03.820
The question it raises is really about whether any AI company can maintain usage restrictions when the government decides it wants unrestricted access.

15
00:02:03.960 --> 00:02:14.850
Well, I guess everyone but Sam Altman, who signed without any regard to standards. Sticking with Anthropic, they partnered with Mozilla to sic Claude Opus 4.6 on the Firefox code base as an automated bug sniffer.

16
00:02:15.100 --> 00:02:25.620
Over two weeks, it found 22 vulnerabilities, 14 of which Mozilla classified as high severity. That's nearly a fifth of all high-severity Firefox bugs fixed in the entire year of 2025.

17
00:02:26.220 --> 00:02:37.280
The first vulnerability was found within 20 minutes. The team scanned nearly 6,000 C++ files and submitted 112 unique reports total. Most fixes already shipped in Firefox 148.

18
00:02:37.320 --> 00:02:48.720
Anthropic also tested whether Claude could exploit the bugs it found. After several hundred attempts costing about 4,000 in API credits, it only succeeded twice, and only with security features like sandboxing disabled.

19
00:02:48.800 --> 00:02:59.260
So Claude is dramatically better at finding vulnerabilities than exploiting them. That's good news for defenders right now. But Anthropic themselves warned that the gap is unlikely to last long.

20
00:02:59.300 --> 00:03:02.170
Time will tell if that's just fear-mongering or thinking ahead.

21
00:03:02.360 --> 00:03:15.820
If a two-week automated scan can find this many high-severity bugs in one of the most heavily audited code bases on the internet, think about what that means for the average NPM package or WordPress plugin that nobody's seriously auditing.

22
00:03:16.360 --> 00:03:25.440
There's usually at least one WordPress vulnerability disclosed every day. The defense applications are genuinely exciting. The offensive implications are genuinely concerning.

23
00:03:25.640 --> 00:03:35.080
Anthropic also launched the Anthropic Institute this week, a research organization led by co-founder Jack Clark, focused on studying societal challenges from powerful AI.

24
00:03:35.280 --> 00:03:46.780
It consolidates their Frontier Red team, societal impacts, and economic research groups under one roof, with new efforts around forecasting AI progress and understanding AI's interaction with the legal system.

25
00:03:47.100 --> 00:03:58.300
Notable founding hires include one from Google DeepMind leading work on AI and the rule of law, an economist from UVA, and a researcher who previously worked on AI's economic impacts at OpenAI.

26
00:03:58.480 --> 00:04:08.620
Anthropic's also opening a DC policy office this spring. The cynic in me is worried that a company-funded institute studying the impacts of its own technology has obvious conflicts of interest.

27
00:04:08.630 --> 00:04:16.279
The more charitable side of me thinks that the people closest to the capabilities are best positioned to flag what's coming. Both can be true.

28
00:04:16.519 --> 00:04:24.130
OpenAI is acquiring PromptFu, the open source AI security and evaluation platform used by a quarter of Fortune 500 companies.

29
00:04:24.680 --> 00:04:36.500
PromptFu handles red teaming, prompt injection detection, data leak testing, and compliance monitoring. The technology is being integrated into OpenAI Frontier, their enterprise platform for AI agents.

30
00:04:36.640 --> 00:04:48.070
PromptFu has about 130,000 monthly active users and an 11-person team. Deal terms weren't disclosed. The we'll keep it open source and multi-provider promise is the part to watch here.

31
00:04:48.640 --> 00:04:54.280
PromptFu's value has always been that it works with any model, Claude, Gemini, open source, whatever.

32
00:04:54.320 --> 00:05:05.560
OpenAI has every incentive to say the right things now and gradually tilt the best features toward their own ecosystem over time. If you rely on PromptFu for non-OpenAI workflows, track this closely.

33
00:05:06.040 --> 00:05:12.280
I don't have a lot of trust for OpenAI to do the right thing currently. Now, let's move to a broader AI transparency conversation.

34
00:05:12.520 --> 00:05:23.000
Apple Music announced transparency tags this month, a metadata framework that lets labels and distributors flag whether a track, composition, artwork, or music video involved AI.

35
00:05:23.140 --> 00:05:32.190
The tags are optional for now, with Apple saying they'll eventually become mandatory. This matters because the scale of AI-generated art, specifically music, is already staggering.

36
00:05:32.660 --> 00:05:41.710
Deezer reported it's receiving over 60,000 fully AI-generated tracks per day. This is up from 10,000 when it first deployed detection tools in early 2025.

37
00:05:42.220 --> 00:05:54.980
Synthetic content now makes up roughly 39% of all music delivered to the platform daily. And here's the stat that should bother you. Deezer found that up to 85% of streams on AI-generated tracks were fraudulent in 2025.

38
00:05:55.500 --> 00:05:58.880
This was used to cheat royalty payouts, not reflect real listeners.

39
00:05:59.080 --> 00:06:09.100
This came into focus last fall when an AI-generated country song called Walk My Walk hit number one on Billboard's country digital song sales chart under a fictional artist with a fake cowboy persona.

40
00:06:09.160 --> 00:06:19.168
Over two million monthly Spotify listeners.No disclosure. Apple's asking the people uploading synthetic content to voluntarily label it. That's more like a suggestion box than a defense.

41
00:06:19.388 --> 00:06:28.548
When 85% of streams on AI music are already not real listeners, you're dealing with a monetization exploit that voluntary tagging will never solve.

42
00:06:28.588 --> 00:06:39.948
The platforms that actually invest in detection infrastructure, like Deezer has, are the ones taking this seriously. Everyone else is publishing suggestions that let them say that they tried. Astro 6 finally dropped.

43
00:06:39.968 --> 00:06:52.188
The most important change is under the hood. The dev server has been completely rebuilt using Vite Environment API, so it now runs your actual production runtime during development. For Cloudflare users, this is huge.

44
00:06:52.668 --> 00:07:03.308
The rebuilt Cloudflare adapter runs Worker D at every stage, dev, pre-rendering, and production, so no more works in dev, breaks in prod with bindings like KV, D1, and R2.

45
00:07:03.528 --> 00:07:18.428
Beyond that, a built-in fonts API that handles downloading, caching, and self-hosting from config, a stable content security policy API that auto-hashes scripts and styles, and live content collections that fetch CMS content at request time without rebuilds.

46
00:07:18.648 --> 00:07:25.248
Infrastructure upgrades include Vite 7, Zod 4, and a Node 22 minimum. There are three experimental features to watch.

47
00:07:25.708 --> 00:07:41.528
There's a Rust compiler replacing the original Go-based one that's already faster and more reliable in some cases, queued rendering showing up to two x improvements, and a platform-agnostic route caching API with automatic invalidation tied to content collections.

48
00:07:42.088 --> 00:07:53.948
The Rust compiler move mirrors the industry trend, and if it becomes the default in 6, Astro's build performance gets significantly stronger. Cloudflare's browser rendering API added a crawl endpoint in open beta.

49
00:07:54.528 --> 00:08:04.988
One API call, submit a URL, and Cloudflare discovers pages via sitemaps and links, renders them in a headless browser, and returns content as HTML, Markdown, or structured JSON.

50
00:08:05.028 --> 00:08:15.188
You get controls for crawl depth, page limits, incremental crawling, and a static mode that skips rendering for faster crawls. It honors robots.txt, and it's available on both free and paid plans.

51
00:08:15.248 --> 00:08:22.648
Shadcn CLI version 4 seeks to make the CLI the interface layer between your design system and your AI coding agent.

52
00:08:22.688 --> 00:08:30.138
The headline feature is Shadcn Skills, which gives agents like Claude, Codex, and v0 structured context about your components and registry.

53
00:08:30.657 --> 00:08:38.128
The new preset flag puts your entire design config into a single short code you can share, put into prompts, or use to set up projects instantly.

54
00:08:38.148 --> 00:08:48.108
You also get dry run, diff, and view flags for inspecting changes before they write. They added a new initialize template flag for setup across Next.js, Vite, TanStack Start, and more.

55
00:08:48.308 --> 00:09:01.208
Lastly, they're maintaining support for both Radix and base UI primitives. Cursor added over 30 new plugins from Atlassian, Datadog, GitLab, and more. Each plugin bundles MCP servers with agent-specific skills.

56
00:09:01.268 --> 00:09:11.468
They claim that their users report this combination is much more powerful than MCPs alone. Most plugins work with Cursor's cloud agents and can be triggered automatically through their automations feature.

57
00:09:11.828 --> 00:09:23.808
Three Figma updates worth mentioning this week. A new MCP server lets GitHub Copilot users push AI-generated UI directly onto the Figma canvas as editable frames and pull design context back into code.

58
00:09:24.368 --> 00:09:28.768
This matches what Figma has already done with Claude Code and Codex already.

59
00:09:28.808 --> 00:09:37.928
Next up, Figma Slots hit open beta, letting you add dynamic content to component instances without detaching, a long-standing pain point for design system maintainers.

60
00:09:38.548 --> 00:09:51.428
And Figma Community now includes apps alongside plugins and widgets in a unified extensions hub. Now for a few quick hits. Claude Code pushed five releases this week, 2.1.70 through 2.1.74.

61
00:09:52.088 --> 00:10:18.208
Highlights include a new loop command for recurring prompts, default Opus model updated to 4.6 on Bedrock and Vertex, a new /context command that identifies memory bloat and suggests optimizations, and a fix for a memory leak causing unbounded RSS growth on the Node.js path, plus a massive batch of stability fixes across voice mode, plugin reliability, MCP OAuth, RTL text rendering, and lengthy sessions.

62
00:10:18.378 --> 00:10:23.248
Next.js 16.2 is churning through canary releases, 81 through 93 this week.

63
00:10:23.288 --> 00:10:34.048
Mostly Turbopack persistence and stability work, plus an experimental Lightning CSS features config, cached navigations flag, and continued iteration on the instant navs dev tools.

64
00:10:34.568 --> 00:10:38.348
At this point, I think we'll see Next.js 17 announced before 16.2.

65
00:10:38.428 --> 00:10:48.548
Railway launched domain purchasing directly in the platform, refreshed the project dashboard UI, and added an AI agent panel that's aware of your services and deployments.

66
00:10:48.788 --> 00:10:59.048
Docploy version 0.28.4 through 0.28.6 added white labeling support, GitHub-labeled action deployments, and a steady stream of backup and Docker fixes.

67
00:10:59.268 --> 00:11:09.398
That's it for this week, a lot going on, everything from constitutional law to Rust compilers. It's been a long week. But what did I miss? There's so much happening in modern web dev that I know I missed something.

68
00:11:09.928 --> 00:11:20.208
Let me know by leaving a comment wherever you're watching or listening or by joining my Discord server and subscribing to the Next in Dev newsletter at nlvcodes.com. Thanks for watching or listening.

69
00:11:20.468 --> 00:11:21.328
I'll see you in the next one.

70
00:11:21.547 --> 00:11:41.388
[outro music]