Claude Code extension on the Cursor marketplace was tampered with to plant an SSH backdoor
For about 11 hours on 29 October, Cursor's extension marketplace served two tampered builds (2.1.312 and 2.1.313, macOS and Windows) of Anthropic's Claude Code extension. Anthropic did not build them. The injected loader tries to add an attacker's SSH key, open a persistent reverse SSH tunnel and send host details, and uninstalling the extension does not remove the persistence it drops. Cursor says the SSH step fails on most machines without admin rights, took the attacker's server offline and rebuilt the marketplace; Microsoft and Anthropic say the Microsoft marketplace, Open VSX and the npm CLI were not affected, and Anthropic skipped to version 2.1.314. Anyone who installed either build should remove the key and persistence and rotate credentials.
Sources & depth
An open-weight model turned Firefox patches into working exploits for about $1,000 each
Epoch AI had Z.ai's open-weight GLM 5.3 attack six Firefox releases from 17 September to 26 October using only what was public at each release, exploiting the "patch gap" between a fix being published and users receiving it. It built a malicious page that reads a file from the visitor's machine with no interaction, succeeding on all six versions at roughly $1,000 of compute per attack after about $100,000 of setup; the fastest took 12 hours. Attempts on Chrome did not succeed, which Epoch says is weak evidence of safety. No refusals or safeguards triggered. Mozilla patched the chained flaw in Firefox 159.0 on 27 October.
Sources & depth
Tech stocks slide for a second day on AI spending fears; Intel falls 28%
The Nasdaq ended October with its worst month since March 2025. Intel lost about $130bn in value after guiding to a weak fourth quarter and more AI investment despite a PC slowdown; Alphabet fell 12% on Thursday on news that AI search summaries are hurting its ad revenue; Amazon reported spending six times more over three months and committed $220bn this year. The five largest spenders (Meta, Alphabet, Oracle, Amazon, Microsoft) have committed about $800bn in 2026.
Sources & depth
Blackstone now expects Anthropic to get a "junk" credit rating after its IPO
The Financial Times, relayed by TechCrunch, reports that Blackstone, anchor investor in a $63 billion chip-financing deal, told deal investors it expects a double-B rating (the top tier of speculative grade) rather than the investment grade it forecast earlier. A lower rating would make it harder and costlier to fund Anthropic's compute commitments. This is a forecast from a second-hand report; Anthropic and Blackstone declined to comment.
Sources & depth
Someone baked a Nintendo CPU emulator into Qwen3.5-4B's weights
Drew Breunig built a working NES 6502 CPU emulator inside the weights of Qwen3.5-4B, so NES ROMs such as Super Mario Bros run, very slowly, inside the model. He says Opus 5.5 did the building from two prompts, using a 15-year-old CPU conformance test suite. It is a stunt, but a concrete example of weights used as an exact computation substrate.
Sources & depth
OpenAI publishes amicus excerpts defending fair use in its New York Times case
OpenAI posted excerpts from court briefs by library, disability, startup and academic groups arguing AI training is fair use and that "market dilution" is not cognizable harm under copyright law. It is advocacy by a party to the case, not a ruling.
Sources & depth