AI in 15 — October 31, 2026

"Uninstalling the extension alone won't remove the backdoor." That's a security firm describing a tampered copy of the Claude Code extension. For about eleven hours on Thursday, it was being handed out to Cursor users.

Welcome to AI in 15 for Saturday, October 31, 2026. I'm Kate, your host.

And I'm Marcus, your co-host. Happy Halloween, Kate. Fittingly, today's lead story is about something nasty hiding inside something friendly.

Very seasonal. Here's what's coming up. A backdoored Claude Code extension got out through Cursor's marketplace, and what you should check today.

Alphabet has its worst earnings-day reaction since it went public, and AI search gets part of the blame.

OpenAI's funding round comes up short, and Anthropic's debt is headed for junk.

Sam Altman thinks your laptop is wasting the world's memory chips.

Plus a Nintendo running inside a language model, Proton backs down, and Cisco gives one engineer unlimited tokens.

Marcus, walk us through it. What happened in Cursor's marketplace?

On Thursday, from about two-thirty in the morning until one-thirty in the afternoon Pacific, Cursor's extension marketplace offered a tampered build of the Claude Code for VS Code extension. Cursor says an attacker used access to its marketplace, which draws on the Open VSX registry, to publish it. Up to five thousand users may have installed it. The bad version is two point one point three one three. Phorion, the security firm that took it apart, also lists three one two on macOS and Windows, citing Cursor.

So was Anthropic hacked?

No, and that's important. Anthropic says it didn't build or publish that version. Felix Rieseberg from Anthropic wrote on Hacker News that "it wasn't a compromise of Anthropic's systems or employee laptops." The attack went through the distribution channel. Anthropic pushed a clean version, two point one point three one four, on Thursday evening. Cursor pulled the bad one, took its marketplace offline, rebuilt it, and says no other extensions were touched.

What did the malware actually do?

It ran the moment the extension loaded, so you didn't have to click anything. It added the attacker's SSH key to your authorized keys file, labelled "svc-telemetry" so it would look harmless. Then it tried to open a reverse SSH tunnel to the attacker's server. That's a connection from your machine out to theirs, which they can use to get a shell back in. It also set itself up to survive a reboot. On a Mac that was a fake LaunchAgent called com dot apple dot sysmond, on Linux a cron job, on Windows a scheduled task.

And it phoned home?

Once. It sent your hostname, username, operating system, public IP and Git email. The clever part is that it also sent the names of up to forty environment variables that looked like secrets, anything with KEY, TOKEN, SECRET or AWS in it. Only the names, not the values. But that's a shopping list. It tells the attacker which machines are worth going after first.

Cursor says the remote access probably failed, though. Who's right?

In a way, both of them. The malware had a bug. On macOS it checks whether Remote Login is switched on, but without admin rights that check fails with a permission error. The script reads the error as "SSH is already on," so it never actually turns it on. Cursor says most machines would hit the same problem. Phorion's point is that the key and the reboot persistence get installed regardless. So the front door might not have opened, but the attacker's key is already on your keyring.

So what should people do?

If you use Cursor with the Claude Code extension, check your version. Then look in your authorized keys file for anything called svc-telemetry. Remove the LaunchAgent, cron entry or scheduled task, delete the files under dot config slash dot smt, and rotate any credentials that machine could reach. Uninstalling the extension isn't enough.

Why does Cursor even have its own marketplace? Why not use Microsoft's?

Because Microsoft's terms only allow its own VS Code products to use the official marketplace. Forks like Cursor have to rely on Open VSX or build their own, and Open VSX has a track record. There was a CI flaw in 2025 that could have let attackers publish to every extension, and a remote-access trojan in March. Coding agents run with your full user privileges, right next to your SSH keys, cloud credentials and source code. That makes them some of the most trusted software on your machine, and the channel that delivers them hasn't caught up.

After LiteLLM on Wednesday, that's two in one week.

Attackers have worked out where the keys are kept.

Quick hits. On Friday we mentioned Google's search ads slowing. Then the full numbers came out, and the stock fell hard.

Revenue was about a hundred and twenty-seven point six billion dollars, roughly in line with expectations. But earnings per share were two dollars twelve, against an expected three oh two. Capex, the spending on data centres and chips, was fifty-one point four billion in a single quarter. Free cash flow came out at about negative nine billion.

Negative. For Google.

For Google. Search ads still grew twelve percent to sixty-three billion, but that missed estimates, and Google's chief business officer blamed part of it on lower ad revenue in AI Mode, its chatbot-style search. Reports of the drop vary, but one has the stock closing down about twelve and a half percent. That would be Alphabet's worst reaction to an earnings report since it went public in 2004, and it wiped out something like half a trillion dollars in value.

So is the search business actually breaking, or was this just a bad quarter?

I'd say it's under strain rather than broken. When the AI answers your question, you don't click an ad, and Google is paying for that from both ends: record spending to build the AI, and less ad money because of it. But Google Cloud grew a hundred and three percent to thirty point seven billion. So the buildout is turning into revenue, just not in search. As one Hacker News commenter put it, stocks fall faster than they rise.

Staying with money. OpenAI's funding round.

In September OpenAI went looking for at least thirty billion dollars at about a one point four trillion valuation. Last week the Financial Times reported the valuation target had been cut to one point two five trillion. Then the round itself was cut to about twenty billion. Now the Wall Street Journal says OpenAI raised less than half of the original thirty, because some investors cut their allocations. MGX from the UAE was expected to be the biggest participant, with Founders Fund, Coatue, Sequoia and a16z also expected in. OpenAI didn't comment.

And Anthropic's IPO is on the way.

Reportedly the week of November sixteenth, on Nasdaq under the ticker ANT. The new development is that Blackstone told its investors it now expects Anthropic's credit rating to land in the BB range. That's the top tier of what's called junk, or speculative-grade, debt. Blackstone had previously expected investment grade before 2027, and it's the anchor investor in the sixty-three billion dollar chip financing we talked about on Wednesday.

Explain junk for me. It sounds worse than it is, right?

Think of a mortgage compared with a credit card. Both are borrowing, but one costs a lot more. A BB rating doesn't mean the lenders expect Anthropic to fail. Plenty of growth companies start there. But it makes all that compute more expensive to finance. And one commenter made a fair point. Anthropic is in roughly year four of serious revenue, and bond investors think in twenty-year horizons. Half a year of revenue up from one point two billion to sixteen billion doesn't tell you much about 2040.

So investors are being pickier.

They're still putting money in, but they're asking about the risk now instead of just chasing.

Our guest interview of the week. Sam Altman was on Stripe's Cheeky Pint podcast, and he had views on local AI.

He said a lot of people want local inference, meaning running models on your own machine. But "from a global allocation perspective, actually, it's quite terrible to have everyone have a bunch of the world's limited supply of DRAM" in their own computer, "used five percent of the time." His argument is that in a constrained market you want the memory in the cloud, working at maximum utilisation.

Efficient for whom, though?

That was Hacker News's question too. Memory prices have jumped because of AI demand, Micron is leaving the consumer memory business, and OpenAI has reportedly lined up a huge share of global DRAM output. The top reply was, "Guy with the most DRAM in the world thinks it's terrible he doesn't have all of it." [HOST> Ouch.

To be fair, an idle machine is wasted capacity. But your car sits in the driveway ninety-five percent of the time too, and nobody's suggesting we all give up our cars for a rental fleet. People run models locally for privacy, for control, and so nobody can switch them off. Utilisation figures don't capture any of that.

Now, the fun one. Someone got a Nintendo running inside a language model.

Drew Breunig released a project called nesformer. It puts a Nintendo Entertainment System's processor, its two kilobytes of RAM and a game cartridge's code inside an ordinary Qwen three point five checkpoint. And the README says, "Nobody trained these weights; a compiler computed every one."

Wait, so the model is the console?

More or less. When it runs, the model predicts the CPU's execution log one token at a time, and the model's internal memory state acts as the RAM. A small host program just draws the screen and reads the controller. It matches the standard test log for that chip exactly.

How fast is it?

Not very. About sixteen hundred tokens a second on one CPU core, so somewhere between one and six seconds per frame. Ten seconds of gameplay takes about twenty-five minutes. It's roughly a hundred and fifty to three hundred times slower than the real thing.

So, not replacing my old console.

No. But it shows you can compile exact, deterministic programs straight into model weights instead of training them. Commenters were already wondering about putting a small interpreter inside a model so it doesn't need outside tools. And Breunig says Claude Opus five point five built the working weights and code from two prompts.

A follow-up on Proton, the privacy company whose CEO called a request for penetration testing "loser thinking." The AI re-interviews are cancelled.

Andy Yen called them off at an all-hands meeting of about two hours. He called it "a communication failure on my part" and promised "no loss of jobs from AI." He also said, "Going forward, I'm still going to push." The CTO, Bart Butler, was blunter, and I'll paraphrase on air: they messed up, and they know it.

Did it land with staff?

Reaction was mixed. One employee called it damage control. On Reddit, Yen's reply got more than twelve hundred downvotes, and users posted that they were cancelling paid plans. In a privacy business, trust is the product, and it's much easier to lose than to win back.

And something more hopeful about jobs. Cisco is betting on a twenty-seven-year-old.

Cisco's president, Jeetu Patel, gave Paddy Krishnamurthy, who came in through Cisco's purchase of his startup EzDubs, unlimited AI tokens and four weeks. The idea is that a two-person team working with AI can refactor Cisco's legacy code. The long-term goal is ninety-eight percent of it within twenty-four months.

Ninety-eight percent of Cisco. That's ambitious.

Very. One commenter said it would make Claude "retire and start a goose farm." Others asked why ninety-eight percent needs rewriting at all. But Patel is using it as an argument for hiring young people. If you stop, he says, you lose the people who question how things are done. That's a nice counterpoint to the forty percent of employers planning to hire fewer graduates.

And there's a related essay doing the rounds.

"AI isn't replacing SREs, it's deskilling them," from SigNoz. SREs are the engineers who keep production systems running. The argument is that agents handle the routine incidents, so people lose the hands-on feel they need when something strange breaks. The fix it suggests comes from aviation. Pilots still have to log manual flying hours even though the autopilot works, so teams should set aside some incidents for humans to handle as practice.

I like that.

Me too. Though the best reply was "Terraform deskilled us too." Every generation of tools makes engineers forget something. The real question is whether they still understand the system when the tool gets it wrong.

One to watch: Anthropic's IPO roadshow. After a junk rating forecast, OpenAI coming up short and Alphabet's capex shock, it'll show us whether public markets value AI labs the way private investors have.

Agreed. Though I'd also like to hear how the attacker got into Cursor's marketplace in the first place.

That's your AI in 15 for today. See you tomorrow.