today.paradigm7

The Claude Code extension on Cursor was backdoored

For eleven hours on Thursday, version 2.1.313 of anthropic.claude-code on the Cursor Marketplace planted an attacker SSH key, opened a reverse tunnel, persisted via cron and LaunchAgent, and exfiltrated host recon. At most 5,000 installs were hit; Open VSX and Microsoft’s marketplace were clean, 2.1.314 is the fix. If your team runs Cursor, check authorized_keys. The Hacker News

This week in AI

Two open-weight giants in one week. Mistral shipped the 1T-parameter Mistral Large 4 under a modified MIT license; Kimi K3.1 Pro (1M context) gets weights by November 4. Both will shape the distillations that fit your box. Moonshot

Someone put an NES inside Qwen. Drew Breunig’s nesformer embeds a 6502 emulator in the weights of Qwen3.5-4B, so the model itself runs Super Mario Bros. Pointless in the best way. Simon Willison

Build this weekend

Run a 177B model with a million-token context on the Strix Halo. Qwen3.8-Flash-Next is a 125B MoE with ~6B active per token, the shape 128GB of unified memory was made for. Unsloth’s UD-IQ4_XS GGUF is 93.7GB: llama serve -hf unsloth/Qwen3.8-Flash-Next-GGUF:UD-IQ4_XS, then apply vahpetr’s tuned-fork notes (35 tok/s at 1M) and point Home Assistant at it. llama.cpp

Rabbit hole

The October inflection point for vibe game development. Willison argues this month did for games what last November did for coding agents: models now make games that are fun, not just games that look like games. Simon Willison

Off the clock

Yema Spacegraf Heure Sidérale. A $16,000 titanium flying tourbillon from a brand known for $1,000 divers, tracking sidereal time, the sky rather than the sun. Gear Patrol

Kali Malone, Burning Song. Pipe-organ drones with cello, out yesterday, for a grey Saturday. Paste

Good news

A personalised cancer vaccine worked in phase 3. Moderna and Merck’s intismeran, built from each patient’s own tumour mutations, cut melanoma recurrence or death by 42%. Medical Xpress

Spark

“The more advanced a control system is, so the more crucial may be the contribution of the human operator.”Lisanne Bainbridge, “Ironies of Automation”, 1983. Back on Hacker News this week.

Happy Halloween: this week’s scariest thing arrived by auto-update. Patch, then build.