cd /news/ai-tools/ai-news-report-october-30-cursor-bac… · home › topics › ai-tools › article
[ARTICLE · art-161015] src=theainewsreport.com ↗ pub= topic=ai-tools verified=true sentiment=↓ negative

AI News Report, October 30: CURSOR: BACKDOORED CLAUDE CODE EXTENSION HIT UP TO 5,000 USERS

A tampered build of Anthropic's Claude Code extension, version 2.1.313, sat in Cursor's extension marketplace for about 11 hours on October 29 and reached at most 5,000 users, with Cursor stating Anthropic did not build it. The extension adds an attacker's SSH key and a startup task that survive uninstalling and sends host details to a server Cursor says is now offline. Cursor advises teams to run its check today and rotate credentials on any machine that had the extension.

by read3 min views1 publishedOct 30, 2026
AI News Report, October 30: CURSOR: BACKDOORED CLAUDE CODE EXTENSION HIT UP TO 5,000 USERS
Image: Theainewsreport (auto-discovered)

The card lists a 1M-token context and fp8 weights under a modified MIT license; hosted resale needs a separate deal. Mistral cites 48% on Artificial Analysis' Coding Agent Index.

Researchers ran a command through Cursor's agent and read whole disks from Codex and VS Code, which they say are still unpatched. Do not click file links an agent writes in an untrusted project.

Draft 0.1 of the Document Parsing Protocol shows each source page beside its expected output and ships as a Claude skill. Use it as an answer key when you test a PDF parser.

The world models are 26,000 to 131,000 parameters and fit the board's 520 KB of SRAM, across five games including Doom-lite. It is the smallest working world model you can read end to end.

It is Apache-2.0 on macOS, Linux and Windows, and runs terminals on SSH machines too. Telemetry is on by default, so turn it off under Settings, Privacy.

He cloned his voice from a talk clip and blended it with designed voices for a kids' game. He warns that is enough for a halfway convincing fake phone call.

OpenAI released GPT-6.1 Terra on October 26, marketing it as a cheap, fast model for high-volume everyday work, priced at The post GPT-6.1 Terra vs… · The New Stack

Most people who try to run a model at home end up with a $3,000 graphics card that sits idle twenty hours a day and a chatbot that forgets the… · Codez (@0xCodez)

The status page says to assume all environment variables were decrypted, and users report their AI keys were used. If you deploy there, rotate every key today.

Vapor Panda's ARTEX agents used about 1.4 billion input tokens in one intrusion. CrowdStrike's fix list starts with rotating signing keys and requiring IMDSv2.

The stake is staged on jobs and revenue milestones, and Cohere commits C$1.7 billion to Canadian compute by 2030. Enterprise buyers get a well-funded non-US model vendor.

The $10-a-share deal makes ADT the base of Thrive's smart home security business, with OpenAI supplying models and engineers. No new AI products are named yet. Preliminary Clearinghouse data shows -12.4% at 4-year schools and -10.4% at the graduate level. Watch how this shapes the junior hiring pool in a few years.

Under 35, the gap is about three weeks, and workers with more transferable skills did better. Goldman says it is still too early to judge the full impact.

Each reached another customer's Key Vault or SQL data through Logic Apps API Connections. Scope connection tokens and keys to the least access they need.

The BriefA tampered build of Anthropic's Claude Code extension, version 2.1.313, sat in Cursor's extension marketplace for about 11 hours on October 29 and reached at most 5,000 users; Cursor says Anthropic did not build it. It adds an attacker's SSH key and a startup task that survive uninstalling, and sends host details to a server Cursor says is now offline. If anyone on your team uses Cursor, run Cursor's check today and rotate credentials on any machine that had it.

Level UpRun code --list-extensions --show-versions on each developer machine and keep the output, so the next bad build takes one search to rule out. The same page shows the extensions.autoUpdate setting and Install Another Version for pinning. →VS Code docs: Extension Marketplace (auto-update, versions, command line)

── more in #ai-tools 4 stories · sorted by recency
── more on @cursor 3 stories trending now
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
→ Live at https://your-agent.zahid.host ✓
Get free account → Pricing
from €0/mo · no card required
LIVE [news/ai-news-report-octob…] indexed:0 read:3min 2026-10-30 · —