話題 / Topic
Right after a run of critical RCEs in PHP, Node, and GitLab, Cognition open-sourced Devin's "vulnerability-fixing Skill" for free. It runs on 70+ agents including Claude Code and Cursor, proceeding through read-only scan → approval → one PR. But it also comes with a warning against taking the agent'
PHP・Node・GitLabの重大RCEが相次いだ直後、CognitionがDevinの「脆弱性を直すSkill」を無料・オープンソースで公開。Claude CodeやCursorなど70種以上のエージェントで動き、読み取り走査→承認→1PRで進む。だが「直しの鵜呑み」への警告も。
Claude Code has started refusing to enter credentials even when the user grants permission. The safety rule baked into its system prompt can't be disabled in settings, and it's colliding with legitimate testing and SSH automation. We lay out the defensive rationale and the escape hatches that remain
Claude Code が、利用者が許可しても認証情報の入力を拒むようになりました。システムプロンプトに焼き付けられた安全規則は設定で外せず、正規のテストやSSH自動化とぶつかっています。守りの理屈と、残された逃げ道を整理します。
Codex CLI 0.164.0 lets you reuse stock instructions across ten /presets slots and swap /model and /permissions on the fly. It also adds credential masking and enterprise MCP authentication. We also lay out the operational homework that remains behind the convenience.
Codex CLI 0.164.0 が10個の /presets スロットで定型指示を使い回せるようにし、/model・/permissions をその場で差し替え可能に。認証情報のマスクとエンタープライズMCP認証も追加。便利さの裏に残る運用の宿題まで整理します。
Claude Code v2.1.309 closes sandbox and permission-check bypasses in a single batch. Two days earlier, v2.1.307 added an audit event that records the moves a guardrail blocked. Here's a rundown of the defensive measures that pay off in unattended operation, and what to do now.
Claude Code v2.1.309 は、サンドボックスと権限チェックのすり抜けを一塊で修正。前々日の v2.1.307 はガードレールが止めた一手を記録する監査イベントを追加。無人運用で効く守りの手当てと、今すべき対応を整理します。
Anthropic has donated the name, logo, GitHub, and domain of "Agent Skills" to the neutral AAIF foundation. It's the second donation after MCP, and on the same day OpenAI, Hugging Face, and Alibaba each contributed components of their own. The implementation and pricing, however, stay in each company
Anthropicが「Agent Skills」の名称・ロゴ・GitHub・ドメインを中立財団AAIFへ寄贈。MCPに続く二度目の寄贈で、同日にOpenAI・Hugging Face・Alibabaも部品を持ち寄った。ただし実装と価格は各社の手元に残る。
Anthropic adds “2026-10-21,” its first new API version since 2023. It removes temperature/top_p/top_k and ships major updates to eight SDKs at once. The old version remains, but some warn the change hurts workloads that depend on reproducibility.
Anthropicが2023年以来はじめての新APIバージョン「2026-10-21」を追加。temperature/top_p/top_kを廃止し、8つのSDKを一斉にメジャー更新。旧版は残るが、再現性重視の運用には痛手との指摘も。
