WEBVTT

1
00:00:00.280 --> 00:00:06.460
What's up everyone? Welcome to Next In Dev, a weekly overview of all the news I could find in the modern web dev industry.

2
00:00:06.760 --> 00:00:17.020
This week, Anthropic announced an unreleased AI model that's finding zero day vulnerabilities in every major operating system and browser, then lost a court ruling in their fight with the Pentagon.

3
00:00:17.040 --> 00:00:24.380
We also got Cursor 3.0 and a critical Next.js security patch that's just a little ironic given recent events. Let's dive in.

4
00:00:24.420 --> 00:00:33.160
The lead story this week is Project Glasswing, a new cybersecurity initiative from Anthropic built around an unreleased frontier model called Claude Mythos Preview.

5
00:00:33.340 --> 00:00:43.700
This model is so good at finding security vulnerabilities that Anthropic assembled a coalition of major tech companies to use it defensively before those same capabilities end up in the wrong hands. How good is it?

6
00:00:43.740 --> 00:00:50.490
Anthropic says Mythos Preview has found thousands of vulnerabilities in every major operating system and every major web browser.

7
00:00:50.660 --> 00:01:01.860
One example is a 27-year-old vulnerability in OpenBSD, one of the most security hardened operating systems in existence, that let an attacker remotely crash any machine just by connecting to it.

8
00:01:01.900 --> 00:01:05.480
It's interesting that it couldn't catch their own code leak from a couple weeks ago, though.

9
00:01:05.519 --> 00:01:15.500
The partnership list is star-studded: AWS, Google, Microsoft, Apple, Broadcom, Cisco, CrowdStrike, JPMorgan Chase, NVIDIA, and the Linux Foundation are all a part.

10
00:01:15.510 --> 00:01:24.010
Anthropic is committing up to $100 million in usage credits and $4 million in donations to open source security. Anthropic is not making Mythos Preview generally available.

11
00:01:24.360 --> 00:01:32.680
They're saying the model's offensive cyber capabilities are too dangerous for broad release and plan to develop safeguards for an upcoming Claude Opus model first.

12
00:01:32.740 --> 00:01:41.280
Announcing a model to explain why you're not releasing it is unusual, but the timing is interesting too. They're launching a national security initiative while fighting the Pentagon in court.

13
00:01:41.720 --> 00:01:51.290
Speaking of the Pentagon fight, Anthropic lost a key ruling this week. A DC appeals court denied their request to temporarily block the Pentagon's designation of the company as a supply chain risk.

14
00:01:51.600 --> 00:02:02.350
If you've been living under a rock, here's a recap. The Pentagon wanted unfettered access to Claude for all lawful military purposes. Anthropic drew red lines at fully autonomous weapons and domestic mass surveillance.

15
00:02:02.640 --> 00:02:07.780
They were then labeled as a supply chain risk. Now, there are two parallel cases with opposite results.

16
00:02:08.190 --> 00:02:19.020
A California federal judge blocked the broader ban last month, calling it Orwellian, but the DC appeals court sided with the government, saying the balance favors the Pentagon given the ongoing military conflict.

17
00:02:19.200 --> 00:02:30.079
Oral arguments are set for May 19th. The DC court even noted that Anthropic's App Store downloads surged during the controversy, essentially arguing that the company benefited financially from the fight.

18
00:02:30.360 --> 00:02:35.600
In my opinion, it's hard to say how a surge of free downloads makes up for potential billions in lost sales.

19
00:02:35.640 --> 00:02:42.780
Whether the government can blacklist a domestic company for refusing to remove safety guardrails from its product is the question that hasn't been answered yet.

20
00:02:42.820 --> 00:02:47.080
Cursor released version 3.0 and it's a significant rethink of the interface.

21
00:02:47.100 --> 00:02:56.600
The headline feature is the new agents window, a dedicated view where you can run multiple agents in parallel across repos, worktrees, cloud environments, and remote SSH sessions.

22
00:02:56.800 --> 00:03:07.500
You can switch back to the traditional IDE at any time or run both simultaneously. Design mode lets you annotate UI elements directly in the browser and point the agent at exactly what you want changed.

23
00:03:07.520 --> 00:03:17.940
There's also a new best of in slash command that runs the same task across multiple models in isolated worktrees and compares results. Cursor also updated Bugbot with learned rules.

24
00:03:17.960 --> 00:03:26.040
The code review bot now watches how developers react to its comments and creates rules that improve future reviews. Rules that get positive signal get promoted automatically.

25
00:03:26.420 --> 00:03:37.850
It also supports MCP servers for additional review context. Next.js 16.2.3 is a security release you need to install now. It's a high severity denial of service vulnerability in React server components.

26
00:03:37.990 --> 00:03:48.400
A specially crafted HTTP request sent to any app router server function endpoint can trigger excessive CPU usage during deserialization, potentially taking down your application.

27
00:03:48.620 --> 00:04:00.079
This affects every version of Next.js from 13 through 16 using the app router. Vercel deployed firewall protections for hosted customers, but if you're self hosting, you have no protection until you manually upgrade.

28
00:04:00.120 --> 00:04:10.080
Now, I think this is a little funny. Back in February, Vercel's CEO mentioned that his team publicly disclosed seven vulnerabilities in Cloudflare's Vnext, Vnext framework.

29
00:04:10.380 --> 00:04:18.800
He called it vibe coded and published a migrate to Vercel from Cloudflare guide on the same day. Vulnerabilities are a fact of life in software development.

30
00:04:19.160 --> 00:04:28.469
Every code base has them, but when you turn someone else's security issues into a marketing moment, the boomerang does eventually come back around. Moving on. TanStack AI introduced code mode.

31
00:04:28.760 --> 00:04:40.100
Instead of having the model call tools one at a time, fetch a list, make an unknown number of individual requests, then try to do math on the results, code mode gives the LLM a single execute TypeScript tool.

32
00:04:40.260 --> 00:04:50.480
The model writes a short TypeScript program that composes your tools with loops, promise all, and actual arithmetic, then executes it in a sandbox. One call in, one result out.

33
00:04:50.580 --> 00:04:57.540
There's also a skills system where the LLM can save working code as reusable tools that earn trust through successful executions.

34
00:04:57.640 --> 00:05:06.660
Cloudflare pioneered this concept and TanStack turning it into a composable model agnostic library is exactly the kind of infrastructure work that matters in modern development.

35
00:05:07.080 --> 00:05:14.440
If you're building anything that connects an LLM to an API, this should be on your radar. Payload version 382 landed with a solid set of features.

36
00:05:14.620 --> 00:05:26.620
There's a new TypeScript post-process hook for type generation, media file disambiguation via query parameters, exported drag and drop UI components, and a before sync hook in the search plugin that now receives the collection slug.

37
00:05:27.000 --> 00:05:36.800
Bug fixes cover localized required field validation during unpublish, relationship filter duplicates, and redundant re-uploads in the S3 and Vercel blob storage adapters.

38
00:05:37.120 --> 00:05:52.990
The minimum required Next.js 16 version is now 16.2.2. Also, a heads up, 382 introduced an HMR regression, but 382.1 is already out with the fix. If you're upgrading, go straight to 382.1. A few rapid fire things.

39
00:05:53.000 --> 00:06:00.700
Shadcn had a productive stretch. The new Luma style brings softer geometry inspired by macOS Tahoe, just without the glass.

40
00:06:00.860 --> 00:06:08.370
Component composition sections across the docs now show correct nesting structures, which significantly helps LLMs compose elements correctly.

41
00:06:08.900 --> 00:06:17.160
And Shadcn Apply lets you switch presets in existing projects without starting over. Figma added on-canvas video playback in Figma Design and Draw.

42
00:06:17.540 --> 00:06:30.400
You can now play, pause, and adjust speed directly on video files on the canvas. They also launched Make Kits for bringing design system code into Figma Make prototypes. Claude Code pushed versions 2190 through 2197.

43
00:06:30.740 --> 00:06:40.740
Highlights include power up interactive lessons, flicker-free alt screen rendering, shorter edit anchors to reduce output tokens, and a fix for MCP connections leaking.

44
00:06:41.160 --> 00:06:48.260
Railway can now skip rebuilds entirely when identical source code has already been built. The most useful scenario is PR environments.

45
00:06:48.600 --> 00:06:59.260
Build on PR, iterate, merge, and if the merged commit matches, your changes deploy in seconds with no rebuild. They also launched guardrails for enterprise workspace level policy enforcement. What did I miss?

46
00:06:59.560 --> 00:07:09.700
Let me know by leaving a comment wherever you're listening or by joining my Discord server and subscribing to the Next In Dev newsletter at nlvcodes.com. Thanks for listening, and I'll see you in the next one.

47
00:07:10.580 --> 00:07:15.440
[outro music]