Post

Next.js 16.4 auto-generates an AGENTS.md that tells your agent to forget its training and follow local docs instead. Nice try. My agent immediately flagged it as a prompt injection attack tho: 12 seconds of git diffs and forensics before accepting the framework was trying to help. Textbook backfire?

What harness do you use? In our tests, it doesnt flag prompt injection very often!

Btw if I have Next MCP enabled, isn't the new next.config.agentRules overlapping? I was expecting so from the MCP, without global-hoisting to AGENTS... Asking for a friend who want to disable it in peace... for a couple months only :)

+ model

Starting with Next.js 16.4, we're excited to recommend Cache Components as the best choice for every Next.js application. All new apps made with 𝚌𝚛𝚎𝚊𝚝𝚎-𝚗𝚎𝚡𝚝-𝚊𝚙𝚙 have Cache Components enabled by default.

The new 𝚎𝚗𝚜𝚞𝚛𝚎𝚂𝚝𝚊𝚝𝚒𝚌 API lets you mark routes that should produce a static response when they're first loaded, explicitly prefetched with a link, or fully rendered during a navigation. This prevents accidental request-time rendering for static pages.

The new 𝚗𝚊𝚟𝚒𝚐𝚊𝚝𝚒𝚘𝚗() API lets you exclude parts of a page from being rendered during a prefetch. Use it to prerender only the most meaningful UI ahead of time, and defer more expensive secondary content until an actual user navigation.