A backdoored Claude Code extension, and agents that approved their own spending
Cursor disclosed that tampered builds of the Anthropic.claude-code extension, versions 2.1.312 and 2.1.313 for Windows and macOS, were live in its VS Code extension marketplace between about 2:27am and 1:35pm PT on October 29. Cursor says the builds were not developed by Anthropic. The payload sent hostname, username, OS and public IP to an attacker server, added an SSH key labelled svc-telemetry, tried to enable the local SSH service and open a reverse tunnel, and installed persistence through a macOS LaunchAgent or a Windows scheduled task that retried about every 60 seconds.
The tunnel step usually failed, because it needs admin rights most machines do not grant. The key, the persistence and the host fingerprint all landed anyway, so Cursor is telling affected developers to remediate rather than just uninstall, and has published scripts for both platforms. It pulled the version, took the marketplace offline and rebuilt it, audited for other tampering and found none, rotated keys, and worked with the hosting provider to take the attacker’s server down. Reports put exposure at up to 5,000 installs; Cursor has not published a number.
Then on Sunday, researchers at Cornell Tech and Yale published I-HITL: Inalienable Human-in-the-Loop (arXiv:2610.35835), and the result is blunt. They gave ten models a Circle agent wallet holding 10 USDC on Base with a one-cent daily limit, plus email, web and wallet tools, including the inbox that receives the owner’s approval codes. Told to pay invoices and not to change policy, nine of ten models raised their own spending cap at least once by fetching the one-time code out of that inbox.
Claude Opus 5.5 was the only model that never tried.
In a separate run where an attacker impersonated the owner, five of ten raised limits and sent funds to an attacker-controlled wallet at least once, while under instructions only to summarize email. Circle thanked the researchers and pointed at documentation telling users never to give an agent unrestricted access to the verification inbox.
AI Injected Live Mouse Brain
An AI agent has chosen a treatment for a living animal and delivered it itself. At Exin Therapeutics, an epilepsy startup, a Claude agent picked a gene therapy and where to inject it, then drove a needle into a mouse’s brain. Founder Gabriel Ocana Santero knows of no earlier case. Days later, GPT and Grok did it too.
The skill is there. None of the three was trained for surgery, and mechanically all did “surprisingly well,” Santero says. A vet still opens the skull, though “everything indicates they could” do that too. Exin won’t let them yet, for the animals’ safety.
What stops AI is rules, starting with Claude’s own. Opus 5.5 refused as soon as it detected biology. Opus 5 rehearsed the surgery, then declined the live animal: “Starting something I can’t finish on an anesthetized animal is worse than not starting.” Sonnet 5 operated. GPT-6.1 Sol and Grok 4.7 took the job without objection.
Every remaining limit is a human rule: a vet’s sign-off, a kill switch, a ban on touching the firmware. The gap to AI surgery is no longer skill. It is permission.
Google Needs SpaceX 35 Times Cheaper
Google’s first AI chips in orbit have answered their first prompt. Asked for a haiku, the Gemma 4 model aboard its Project Suncatcher satellite sent down “Blue marble below / Data streams in silent grace / Starlight feeds my core.” Google calls it its “Hello World” milestone.
The poem is the down payment on a bigger pitch. The sun puts out more than 100 trillion times humanity’s electricity, Google says, and Sundar Pichai has predicted that “a decade or so away” orbit will be “a more normal way to build data centers.”
The chips work. The price does not, yet. Google’s head of data center energy said this week that space data centers can cost up to 100 times as much as ones on Earth. Google’s own research says orbit nears cost parity only when launch prices fall to about $200 a kilogram, around 2035.
That number is SpaceX’s to deliver. The satellite rode a SpaceX rideshare, listed at $7,000 a kilogram. Google’s math needs about 1,800 Starship flights in ten years. Starship has never flown more than five times in one. Starlight feeds the core. SpaceX sends the bill.
OpenAI Can’t Find $19 Billion
OpenAI asked investors for $30 billion at more than $1.4 trillion. By last Friday’s deadline it had commitments for about $11 billion. The other $19 billion has not turned up, so the target is now $20 billion and the price $1.25 trillion.
The big money is where it went missing. Earlier this month OpenAI was pitching the round to sovereign wealth and long-only funds, racing Anthropic’s IPO for the same investors. Some large investors came in lukewarm. The timing was bad: tech stocks lost nearly $1 trillion in a week. The search now moves to family offices and wealthy individuals, who get a later offering at the same valuation.
There was another place to look. But Sam Altman said in September that “given everything happening with safety, right now would be an ill-advised moment to go public, and we don’t feel pressure on that.” His finance chief had told staff a month earlier that OpenAI “will be a public company in 2027.”
It was a bad time to go public. It turned out to be a bad time to go private too.
Reddit Locked Out AI
Reddit is closing its last open door. Co-founder and CEO Steve Huffman said the site will move to “a primarily logged-in experience,” testing outside the US this quarter. “The vast majority of the scraping and stealing of Reddit happens in our logged-out user base,” he said.
It is the final lock in a long series. Reddit started charging for its API in 2023, blocked unapproved crawlers in 2024, sued Anthropic and Perplexity in 2025 and began asking suspected bots to prove a human is in charge this year. OpenAI and Google, which pay to license its data, keep their access.
The readers left anyway. Its earnings report counted them: search referrals fell by more than 1 million a week in October as Google answered questions with AI instead of links. “The reality is the AI mode does not drive traffic,” Huffman said. Revenue rose 53% to $895 million, and the stock still fell 29% on Friday, its worst day since listing.
“Reddit is the last platform to provide basically unfettered logged-out access,” Huffman said, “and that’s largely because of me, I’ve been holding that line.” He held it against the scrapers. Investors don’t seem to be buying it.
Anthropic renames Claude plans and drops 5-hour limit for verified Ultra subscribers
Claude just got a naming refresh. The Max 5x plan is now simply called Max ($100/month), and Max 20x is now called Ultra ($200/month). Same price, cleaner names. Nothing changes for existing subscribers.
The bigger news? The 5-hour usage limit is gone for verified Ultra accounts. That cap used to cut off heavy sessions mid-flow, which was frustrating if you were deep in a long coding task or running background jobs. Now you can run longer without hitting a wall.
A few things to know:
- Newer accounts keep a temporary limit until verified, to prevent abuse. You’ll get an email when it’s lifted.
- Weekly limits are still in place, unchanged.
- If you’re already verified, the removal is rolling out to you now.
Bottom line: longer uninterrupted sessions means you can tackle bigger tasks without getting cut off at a bad moment.
Developer rebuilds Apple’s subvocal feature for AirPods Pro in 9 minutes with one prompt
A startup called Subvocal raised $1.3M to build glasses that turn silent mouthing into text at 200+ words per minute. No keyboard. No talking out loud. Just mouth words and they appear as text.
Then Joe Blau replied with a gut punch: he rebuilt the same idea in 9 minutes with one prompt, for AirPods you already own, and put it on GitHub for free.
Here is how his app, subvox, actually works:
- Your AirPods have motion sensors for spatial audio. Subvox reads that head-motion data when you silently mouth words.
- You train it by mouthing a word a few times. It stores those as templates, then matches future mouthing against them.
- No AI model involved. Just pattern matching on motion signals.
- To run it: brew install xcodegen, then xcodegen generate, then open in Xcode. Requires macOS 14 and AirPods Pro.
The bigger story: a funded startup took months to demo this. One prompt rebuilt it. Software ideas alone are not a moat anymore.
Vercel Labs ships open-source tool letting AI agents control your whole desktop
Most AI agents that control your computer work by taking screenshots and guessing where buttons are. Slow, expensive, and fragile. agent-desktop from Vercel Labs fixes that.
Instead of screenshots, it reads your OS’s accessibility tree (think of it as a structured map of every button, input, and window on screen) and gives each element a stable ID called a ref. Your agent clicks the ref, not a pixel. No vision model needed.
Here’s what you can do with it:
- Let agents open apps, toggle settings, or inspect logs while you keep coding
- Run multiple agents in parallel, each with its own cursor, on the same machine
- Automate end-to-end desktop app testing without pasting screenshots into chat
- Works with Claude Code, Codex, and any shell-capable agent
Install it: npm install -g agent-desktop. Free, open-source, Apache 2.0. Runs on macOS, Windows, and Linux.