The Claude Code extension on Cursor was backdoored
For eleven hours on Thursday, version 2.1.313 of anthropic.claude-code on the Cursor Marketplace planted an attacker SSH key, opened a reverse tunnel, persisted via cron and LaunchAgent, and exfiltrated host recon. At most 5,000 installs were hit; Open VSX and Microsoft’s marketplace were clean, 2.1.314 is the fix. If your team runs Cursor, check authorized_keys. The Hacker News
This week in AI
Two open-weight giants in one week. Mistral shipped the 1T-parameter Mistral Large 4 under a modified MIT license; Kimi K3.1 Pro (1M context) gets weights by November 4. Both will shape the distillations that fit your box. Moonshot
Someone put an NES inside Qwen. Drew Breunig’s nesformer embeds a 6502 emulator in the weights of Qwen3.5-4B, so the model itself runs Super Mario Bros. Pointless in the best way. Simon Willison
Build this weekend
Run a 177B model with a million-token context on the Strix Halo. Qwen3.8-Flash-Next is a 125B MoE with ~6B active per token, the shape 128GB of unified memory was made for. Unsloth’s UD-IQ4_XS GGUF is 93.7GB: llama serve -hf unsloth/Qwen3.8-Flash-Next-GGUF:UD-IQ4_XS, then apply vahpetr’s tuned-fork notes (35 tok/s at 1M) and point Home Assistant at it. llama.cpp
Rabbit hole
The October inflection point for vibe game development. Willison argues this month did for games what last November did for coding agents: models now make games that are fun, not just games that look like games. Simon Willison
Off the clock
Yema Spacegraf Heure Sidérale. A $16,000 titanium flying tourbillon from a brand known for $1,000 divers, tracking sidereal time, the sky rather than the sun. Gear Patrol
Kali Malone, Burning Song. Pipe-organ drones with cello, out yesterday, for a grey Saturday. Paste
Good news
A personalised cancer vaccine worked in phase 3. Moderna and Merck’s intismeran, built from each patient’s own tumour mutations, cut melanoma recurrence or death by 42%. Medical Xpress
Spark
Happy Halloween: this week’s scariest thing arrived by auto-update. Patch, then build.