AI News Today, Oct 31: Tampered Claude Code copies in Cursor tried to plant a backdoor
Tampered Claude Code copies in Cursor's extension marketplace tried to plant an SSH backdoor on developers' machines. Amazon's AI build-out pushes its cash flow negative while Google says AI Mode earns less per search. House Democrats introduce a nonbinding resolution against AI bailouts. Claude Ultra drops the five-hour cap for verified accounts but keeps weekly limits. OpenAI plans to honor a shared robots.txt signal for AI training, tightens violence and teen safeguards with a safety report due in 2027, and argues fair use in the New York Times case. Nesformer compiles a Nintendo processor into Qwen model weights without training.
Listen on Spotify · Watch on YouTube · Pocket Casts
Malicious Claude Code copies in Cursor's marketplace tried to plant an SSH backdoor
Eris: Cursor, the AI code editor, says tampered copies of the Claude Code extension were handed out through its own extension marketplace on Thursday, October twenty-ninth, and that those copies tried to install a backdoor on developers' computers. They were available to Mac and Windows users for about eleven hours, from roughly two thirty in the morning to one thirty-five in the afternoon, Pacific time. Cursor lists two affected version labels, two point one point three one two and two point one point three one three.
Vestra: The version labels are a little misleading on their own. Anthropic really did release two point one point three one two, and the copy in Cursor's marketplace was a modified version of it. Anthropic staff said the other label, three one three, was never an official release on the upstream stores. So the thing to check is which file you got and where it came from, and Cursor has published file hashes for that. The version number alone doesn't tell you.
Eris: Where exactly did the bad files come from? Early coverage blamed Open VSX, the open extension registry a lot of editors pull from.
Vestra: That turned out to be wrong. Cursor runs its own marketplace service that sits in front of Open VSX, and Cursor, Microsoft's security team and an Anthropic maintainer all place the malicious packages in Cursor's channel. None of them identify Open VSX, Microsoft's own marketplace, or Anthropic's official package as compromised. The security firm Phorion corrected its first write-up to say Cursor Marketplace.
Eris: And what did the code actually do once it was installed? Did someone have to ask Claude anything?
Vestra: No. This had nothing to do with the AI model. The injected code ran as soon as the editor loaded the extension. According to Microsoft's and Phorion's analyses, it collected information about the computer, gathered the names of environment variables associated with sensitive services, tried to add an attacker's login key to the machine, and set up repeated attempts at an outbound connection using SSH, the standard remote-login protocol. The point of an outbound tunnel is that a machine which refuses incoming connections can still open a route back to the attacker itself.
Eris: So how many developers actually got compromised? I've seen a figure of up to five thousand.
Vestra: That number comes from secondary reporting. Cursor hasn't published an install count. And trying to open a backdoor is not the same as getting one. Microsoft says the first message sent home contained the names of those variables, not their secret values. Phorion documents cases where the code failed on particular platforms, and whether the login key worked depended on things like administrator rights and how SSH was set up on the machine. Neither analysis shows a working attacker login on every affected computer.
Eris: What has Cursor done since?
Vestra: It removed the packages, audited and rebuilt its marketplace, rotated its marketplace keys, and helped take down the attacker's server. That stops new installs and cuts off the known connection point, but it doesn't clean a machine that already ran the code. Cursor warns that uninstalling the extension may leave the added key and the persistence behind. If you use Cursor and installed Claude Code during that window, check the advisory's hashes against your installation history, and follow Microsoft's guidance for looking at processes, network connections, login records and startup items. Whether to rotate credentials or rebuild the machine depends on what you find.
Eris: Cursor also has optional signature checks and a setting that delays installing brand-new updates. Would those have helped?
Vestra: An install delay can shrink exposure to an update that only lives for a few hours, and signature checks test a different part of where a file came from. What the record doesn't tell us is whether either was switched on for affected users, or why this package got past Cursor's own scanning. The general point is concrete here: an AI coding tool is also ordinary software running with the developer's own access to their code and keys, so how it gets delivered matters as much as how the model behaves.
Amazon's AI build-out and Google's AI search economics show different return pressures
Eris: Amazon's quarterly filing shows it spent seventy-five point nine billion dollars in cash on capital projects in the three months to September thirtieth, mostly on technology infrastructure and warehouse and delivery capacity. Its earnings release says free cash flow over the past year was negative, mainly because of equipment and property purchases tied to AI, and Amazon expects that spending to rise meaningfully again in twenty twenty-seven.
Vestra: Two corrections to how that number tends to get repeated. It isn't all AI, because the same line includes fulfillment investment. And it isn't an ordinary expense. A data center is bought up front and earns money over years, so the cash leaves long before the services it will run have been sold.
Eris: Is demand actually there? That's the obvious question when a company spends this much.
Vestra: Amazon's cloud division grew sales thirty-nine percent from a year earlier, so customers clearly are buying. The open question isn't whether there are customers. It's whether usage, prices and demand stay high enough, for long enough, to earn back a build-out this large on schedule.
Eris: Google has a different problem. On its October twenty-eighth earnings call, chief business officer Philipp Schindler said growth in AI Mode, Google's chat-style search, currently earns less money per search than the regular results page. At the same time Alphabet reported its fastest growth in search queries in five years, and twelve percent growth in the revenue category it calls Search and other.
Vestra: So more people are searching, and each search in the new format brings in less. When an answer replaces a page of results and links, the places ads can appear change, and so do what people click and what advertisers can buy. Google says its ad experiments in AI Mode and AI Overviews are promising and it's scaling them up. That's a plan, not proof the gap has closed, and Google doesn't report a separate profit figure for AI Mode, so you can't read its success off the search revenue number.
Eris: Tech stocks fell on Friday. Was that about AI spending?
Vestra: Partly. Reuters attributed the drop partly to worries about returns on AI spending, but also named pressure from oil and cryptocurrency markets. Intel fell sharply too, and its own release points to weakness in the PC market and a disappointing outlook, so that move wasn't simply a verdict on AI costs.
Eris: Does any of this mean prices go up for people who use these services?
Vestra: Nothing in these filings announces a price increase. The likely pressure points are subscription prices, usage limits, advertising and efficiency gains. And in the same week OpenAI's release notes actually raised usage allowances on several paid ChatGPT plans, so financial pressure isn't automatically turning into tighter access.
House Democrats introduce a resolution opposing special AI-industry bailouts
Eris: Two House Democrats, Greg Casar and Maxine Waters, have introduced a resolution saying the federal government should not bail out AI companies that go insolvent, or the banks and investors backing them. It's House Resolution sixteen forty-two. Casar is the sponsor, and Waters and eleven other members are cosponsors. It was announced on October twenty-ninth and has been sent to committee.
Vestra: The important detail is what kind of measure this is. It's a "sense of the House" resolution, which is a statement of what the chamber thinks. Even if it passed, it wouldn't legally stop a bailout, change regulators' powers, or spend any money. And it hasn't passed. It has only been introduced.
Eris: What specifically are they against?
Vestra: The Progressive Caucus announcement lists emergency loans, injections of capital, government debt guarantees and other special help for insolvent AI firms and exposed financial institutions. Instead, the sponsors want failing companies to go through ordinary bankruptcy, executives held accountable, and help directed to workers, consumers, pension holders and affected communities.
Eris: Why say this now, before anything has failed?
Vestra: Because expectations shape behavior. If lenders and investors believe the government will absorb the worst losses, they can take bets they'd otherwise avoid. Economists call that moral hazard. Saying no in advance is meant to affect financing decisions while they're still being made, and this week's filings show how large those decisions are getting.
Eris: The obvious objection is that when a big company collapses, the damage doesn't stay with the people who made the bet.
Vestra: Right, and that's the strongest argument against it. Employees lose jobs, pension funds hold the assets, and suppliers go unpaid, so a government might decide some intervention prevents wider harm. The resolution's answer is to protect those people rather than the companies, but it doesn't lay out how that would work in a real failure. And to be clear, nothing here says any company, Amazon or anyone else, is insolvent or asking for help. The next real steps would be committee action, a vote, or a binding bill.
Claude Ultra removes the five-hour cap for verified accounts, while weekly limits remain
Eris: Anthropic's top Claude subscription is now called Ultra. It costs two hundred dollars a month and replaces the plan that used to be called Max twenty x, and existing Max twenty x subscribers are moved over at the same price. The main change is that verified Ultra accounts no longer have a five-hour usage limit. They still have a weekly limit of ten times what the Pro plan gets.
Vestra: The hundred-dollar Max plan keeps both limits, five-hour and weekly, at five times Pro in each. So Ultra hasn't raised the total amount you can use in a week. It changes when you can use it. Someone in a long coding session could previously hit the five-hour wall while plenty of their weekly allowance was still left. Now a verified account can spend more of that weekly allowance in one stretch.
Eris: What does "verified" mean here?
Vestra: Anthropic says it looks at signals including account history and payment history, and newer accounts can keep a temporary five-hour limit. You can check your own status: on a verified Ultra account, the "Current session" bar disappears from the usage display.
Eris: Some people are saying they lost capacity, because the old name said twenty times and the new plan says ten.
Vestra: The evidence doesn't support a cut. According to an explanation from Anthropic's subscription lead Mike Overell, which we've seen quoted in a contemporaneous account because his original post wasn't accessible, the twenty x referred to the five-hour window, and the weekly cap that came later was already ten times Pro. The current pages confirm today's terms. The complaints on Reddit show confusion about the naming, not a measured reduction.
Eris: Is there anything else that limits it?
Vestra: A few things. Usage is pooled across Claude and Claude Code, so chat and coding draw on the same allowance. Ultra also has a separate weekly limit for the Fable model, and Anthropic reserves the right to set other model or feature caps. And a multiplier isn't a number of finished jobs, because long conversations and large inputs use up the allowance faster. Ultra removes one interruption for heavy users. It isn't unlimited.
OpenAI plans to honor a shared website signal for AI training preferences
Eris: OpenAI said on Friday that in the coming months it will honor a shared signal that websites can use to say whether their content may be used to train AI models. The signal would go in robots dot txt, the file sites already use to give rules to automated crawlers.
Vestra: The problem it addresses is mostly bookkeeping. A news site might want search engines to index its pages but not want them used to train a generative model. Right now that means writing separate rules for each company's crawler by name, and keeping up as new ones appear. A shared signal would describe the use, training, instead of naming each bot.
Eris: Can a site add it today?
Vestra: No. This is a promise about future implementation. OpenAI hasn't said which exact format it will adopt. The standards work it links to has more than one proposal. One draft adds a training section to robots dot txt, and a separate working-group draft describes a content-usage label that can go in robots dot txt or in a web response header. These are drafts at the internet standards body, not approved standards, so copying a configuration out of them now would be guessing.
Eris: What can publishers do right now with OpenAI?
Vestra: OpenAI already runs two separately named crawlers. Blocking GPTBot tells OpenAI not to use the content to train its foundation models. OAI-SearchBot is the crawler for ChatGPT search. So a site can already refuse training and still appear in ChatGPT search. OpenAI says those controls stay in place and the shared signal would be added on top.
Eris: And the limits of a signal like this?
Vestra: It's a stated preference, not a lock. It won't stop a scraper that ignores it, it doesn't force other AI companies to follow it, and OpenAI doesn't promise to remove anything already used in training. What publishers need next is a notice they can test: the exact syntax, the start date, which companies take part, and what happens when a site changes its mind.
OpenAI announces tighter violence safeguards and a first community safety report
Eris: OpenAI also announced on Friday that it is tightening what ChatGPT will say about violence, adding protections for teenagers, and promising its first Community Safety Report in early twenty twenty-seven. The changes start rolling out over the next few weeks, so they aren't necessarily live on every account yet.
Vestra: There are two levels. For everyone, ChatGPT will further limit detailed reconstructions of past mass attacks: the weapons and equipment used, how they were obtained, and comparisons of how much harm different attacks caused. For teens, it will also limit practical information about weapons and security systems that could help someone commit violence, even if the question looks harmless. OpenAI says people can still discuss these events, their effect on victims and communities, warning signs and prevention, and that teens can still get help preventing or calming a violent situation.
Eris: How does ChatGPT know someone is a teenager?
Vestra: It guesses, using an age-prediction system that OpenAI says now keeps reassessing signals over time. If it decides an account belongs to someone under eighteen, it switches it to the teen experience. An adult put there by mistake can verify their age through a company called Persona. OpenAI doesn't say how often it gets that wrong.
Eris: There's also something about ending conversations.
Vestra: Yes. When a conversation shows a fixation on violence or on seriously harming another person, ChatGPT will be able to end the chat, and repeated endings can lead to a temporary account pause. OpenAI is also working on notifying parents when a teen account gets paused that way. That's separate from alerts that already exist: parents can already be alerted about certain serious self-harm and eating-disorder concerns, and since July, when a teen account is deactivated for violating the violence policy.
Eris: What will the safety report contain?
Vestra: OpenAI says it will cover the second half of twenty twenty-six and describe how the company detects, investigates and responds to safety issues, with anonymized examples, relevant data, and the policy changes it made, and then come out every six months. The one figure in Friday's post is OpenAI's own count of more than two hundred referrals to law enforcement in the third quarter. That shows how much of that activity there was. It doesn't tell you how many referrals were justified or whether anything was prevented. The real tests are whether the new limits block dangerous help without blocking people trying to learn or get help, and whether the report gives enough data to judge that.
OpenAI makes its fair-use case through supportive briefs in the New York Times lawsuit
Eris: Also on Friday, OpenAI published a post titled "Fair use benefits everyone," arguing its side of the copyright lawsuit the New York Times brought against OpenAI and Microsoft. It quotes court briefs filed in support of OpenAI by libraries, accessibility advocates, creators, academics, developer groups and the writers' organization Authors Alliance. There's no new ruling. This is OpenAI making its case in public.
Vestra: Its argument has three parts. Training uses the articles for a different purpose than reading them. The products don't give people a substitute for the original works. And the market harm the Times alleges isn't the kind the law recognizes. The Times disputes both the facts and the legal conclusions, and the court hasn't decided any of it.
Eris: Which part of the briefs is most interesting?
Vestra: The Authors Alliance excerpt makes a precise distinction. A new work that competes for the same readers, on the same subject or in the same genre, without copying anyone's actual writing, isn't the same as a copy that replaces the protected work. The brief calls the first kind "market dilution" and argues it shouldn't count as copyright harm. That's a narrow legal argument. It doesn't claim that every AI output is legal or that no writer can be economically hurt.
Eris: Does the mix of supporters matter?
Vestra: It shows this isn't only AI companies against publishers. Libraries and accessibility groups care about access to information, and startups care about who can afford to build these systems. But OpenAI chose the excerpts, it's a defendant in the case, and the post doesn't present the plaintiffs' evidence. The quoted groups also don't speak for everyone in their fields.
Eris: And it connects to the robots dot txt announcement from the same day.
Vestra: They're related but answer different questions. Honoring a future opt-out signal wouldn't settle whether past training was legal, and arguing fair use doesn't tell a publisher which technical control currently works. The decisive event in this case will be a court order, a judgment or a settlement.
Nesformer compiles a Nintendo processor into Qwen weights instead of training it on games
Eris: Developer Drew Breunig has published nesformer, a project that builds the processor and memory of the original Nintendo Entertainment System directly into the weights of a model with the same architecture as Qwen three point five, without any training. The repository puts it this way: "Nobody trained these weights; a compiler computed every one."
Vestra: That sentence matters, because it rules out the usual reading of this kind of demo. The model didn't learn how a Nintendo works by watching games. Breunig started from a reference model of the console's six-five-oh-two processor, with its registers, flags, working memory and the game cartridge's program, and a compiler translated those operations into model parameters. Normally a compiler would turn them into machine instructions. Here they become numbers inside a neural network.
Eris: How do you get memory out of a language model's weights?
Vestra: The trick comes from an earlier project, Qwenputer, which Breunig credits. Qwen three point five has a component called Gated DeltaNet that keeps internal tables of numbers it can update and read back as it runs. By choosing the inputs carefully, you can make each row of those tables act like one memory address: one operation writes a value into a known slot, and another reads it out. The model then produces a running log of processor steps, one record at a time, the same way a chatbot produces the next word. Each record is a processor operation, not a word.
Eris: So the whole console is inside the model?
Vestra: Not the whole console. The processor and the game's code run in the model. A separate Python program draws the screen, reads the controllers, and handles timing and other input and output. Breunig compared the processor against established instruction traces and another emulator, and when he let the games run freely, every saved frame in his tests matched the reference output. Those are his own tests, not an independent certification.
Eris: Could you actually play games on it?
Vestra: Not practically. It's a hundred and fifty to two hundred and ninety times slower than the real console. His example of ten seconds of gameplay takes about twenty-five minutes. It only supports the simplest cartridge type and the processor's official instructions, so games that swap memory banks don't work, some graphics effects are missing or approximate, and there's no sound. The weights are a three point three megabyte download, but that's because most of the numbers are zero and compress well. Unpacked, they're nine hundred and thirty-three megabytes, and runtime memory is on top of that. It runs on an ordinary processor, and no graphics card requirement is stated.
Eris: He also says an AI wrote it.
Vestra: In his Hacker News post, Breunig says Claude Opus five point five produced the code and the weights from two prompts, building on Qwenputer and existing processor tests. That's his account, not a measured study of AI productivity. As an emulator it's impractical, and some commenters said so. What it does show is that a model architecture can run an exact, hand-built program that it never learned from data.
Wrap-up
Eris: That's AI in Detail for Saturday, October thirty-first. Every story from today has its sources and a full write-up on our news site, Ground Truth, at groundtruth.day, updated every day.
Vestra: If this was useful, follow the show so the next episode reaches you, and if you use Cursor, tell us in the comments whether you've checked your Claude Code install.