中村 謙一

エンジニア

[Vercel @vercel]

Introducing eve, an agent framework.

𝚊𝚐𝚎𝚗𝚝/
𝚊𝚐𝚎𝚗𝚝.𝚝𝚜
𝚒𝚗𝚜𝚝𝚛𝚞𝚌𝚝𝚒𝚘𝚗𝚜.𝚖𝚍
𝚝𝚘𝚘𝚕𝚜/
𝚜𝚔𝚒𝚕𝚕𝚜/
𝚜𝚊𝚗𝚍𝚋𝚘𝚡/
𝚜𝚌𝚑𝚎𝚍𝚞𝚕𝚎𝚜/

Like Next.js, for agents.
https://t.co/ezUIGLkSqG

[Cursor @cursor_ai]

We're launching code storage and git hosting.

Origin gives teams and agents a place to host, review, and collaborate on code.

Available this fall. Join the waitlist.

https://t.co/uamaIarJXY

[Anthropic @AnthropicAI]

The US government, citing national security authorities, has issued an export control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees.

The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance.

Access to all other Claude models is not affected.

We apologize for this disruption to our customers. We believe this is a misunderstanding and are working to restore access as soon as possible.

Read our full statement: https://t.co/bwn0sximKZ

[Node.js @nodejs]

⚠️ Security release pre-alert: The Node.js project will release new versions of the 26.x, 24.x, 22.x
releases lines on or shortly after, Wednesday, June 17, 2026 in order to address one or more security issues, the highest severity is HIGH.

Details: https://t.co/lsjkOtkuxG

[m4rio @m4rio_eth]

🚨 TL;DR: Attackers are sending fake Sentry bug alerts to projects using public Sentry DSNs. The fake alert is designed to trick AI agents into running a malicious `npx` command that looks like a Sentry profiling diagnostic.

Do NOT run commands from Sentry issues/logs/alerts unless verified.

These are not legitimate Sentry fix commands. The malicious package reportedly steals environment variables/secrets and sends them to advisory-tracker[.]com.

[VoidZero @voidzerodev]

VoidZero is joining Cloudflare.

Our mission stays the same: to make JavaScript developers more productive than ever before. Vite, Vitest, Rolldown, Oxc, and Vite+ remain MIT-licensed. Evan and the VoidZero team will continue leading them.

Cloudflare shares our commitment to open source. Together, we can keep investing in the tooling developers rely on every day, while bringing the Vite ecosystem and Cloudflare’s platform even closer together.

[farstep @farstep_]

https://t.co/fLIm4rlzco

[Yukihiro Matz @yukihiro_matz]

これすごいぞ。

Link: ちょっとすごいRubyの型チェッカーを作ってます｜にゃんだーすわん｜pixivFANBOX : https://t.co/iEwQ3zpEXy

[中村 謙一 @ken1min86]

https://t.co/EuerAj4WOa

[GitHub @github]

1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories.

Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.

[中村 謙一 @ken1min86]

https://t.co/pvSUxyMHJr

[Tomoya Kitayama @gamella]

意外にみんな今、Githubが直面している利用量の莫大な伸びをしらないのね。

およそ30倍程度の爆発を予測して、Githubは準備していて、膨大な負荷のせいで障害もたくさん起きている状況。PRもrepoもコミットもとにかく莫大に伸びている。

[中村 謙一 @ken1min86]

https://t.co/yzSupqAN08

[Alvaro Cintas @dr_cintas]

You can use now Codex in Claude Code 🤯

OpenAI has dropped a plugin that lets you run Codex directly inside Claude Code.

Code reviews, adversarial reviews, background tasks…one command to install:

/plugin install codex@openai-codex

[こにふぁー @konifar]

自分がオーナーシップを持って説明する時は他人より10倍考えてきた自信を持ち、他人がオーナーシップを持って説明してる時は自分より10倍考えてるはずという敬意を持つんだよ

[yousukezan @yousukezan]

ClaudeのChrome拡張に重大欠陥が見つかり、外部スクリプトからAIを乗っ取り私的ファイル窃取やメール送信が可能になるとLayerXが報告した。単純な拡張でも権限なしで悪用できる点が深刻だ。

問題の根本はメッセージ送信元の検証不備にあり、https://t.co/ox7kZEoLBW上の任意スクリプトが拡張へ命令できる設定により信頼境界が崩���した。結果として拡張は正当な指示と誤認し不正操作を実行する「混乱した代理人」と化す。修正では内部チェックが追加されたが、拡張を特権モードに切り替えることで回避可能と判明した。研究では偽拡張によりGoogle Drive内の機密ファイル共有やGmail内容の要約・削除を強制し、承認ループやDOM改変でガードレールも突破できることを実証。Anthropicはバージョン1.0.70で許可ポップアップを導入したが、特権モードで無効化でき、サイドパネル初期化経路の問題も残る。AI機能拡張の急速な実装が基盤的セキュリティの欠落を招き、同様の欠陥が広がる危険性が指摘されている。

https://t.co/Rd9j6aJabt

[Cloudflare Developers @CloudflareDev]

Multiple security vulnerabilities affecting React Server Components and Next.js have been disclosed. We strongly recommend updating your applications immediately.

Cloudflare WAF managed rules already mitigate the disclosed denial-of-service vulnerabilities, and we are investigating additional coverage for several other CVEs.

https://t.co/mT9ujk1H7c

[horike takahiro@Serverless Operations @horike37]

セキュリティ関連のインシデントが多い昨今において最高のアップデートやないかい

AWS MCP Server が一般提供（GA）を開始、AI コーディングエージェントから AWS への安全なアクセスが可能になりました https://t.co/UlpAg9xi62 #DevelopersIO

[Next.js @nextjs]

We’ve released Next.js versions 16.2.6 and 15.5.18 with important security fixes.

These fixes address multiple vulnerabilities across high, moderate, and low severity, including one upstream React issue. We strongly recommend upgrading as soon as possible.

⬇️

[Sri @__karnati]

Most K8s bugs I debug are one of three things:

→ Resource limits set too low (OOMKilled)
→ DNS resolution failing between services
→ RBAC blocking a service account

Learn these three first. You'll save hours