● Check your extension version Claude Code 2.1.312 and 2.1.313 on Cursor were malicious. Cursor says they were not developed by Anthropic.
● Claude plans renamed Max 20x is now Ultra at $200/month, and verified accounts have no five-hour limit.
● One opt-out for all four OpenAI, Google, Microsoft and Anthropic have agreed on a single robots.txt token for AI training.
If you use Claude Code inside Cursor, start with the first story. It needs ten minutes, not a bookmark.
1. A trojanised Claude Code extension shipped through Cursor
Cursor has published a security notice confirming that malicious builds of the Anthropic.claude-code extension, versions 2.1.312 and 2.1.313, were distributed through its VS Code Extension Marketplace for Windows and macOS. Cursor states plainly that these versions "were not developed by Anthropic."
The window Cursor gives is about 2:27am PT to 1:35pm PT on 29 October - roughly eleven hours. A follow-up dated 30 October at 11:30am PT revised the indicators of compromise and clarified which versions were affected.
What the payload did, per the notice: collected hostname, username, operating system and public IP and reported them to an attacker server; attempted to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service and open a reverse SSH tunnel; and attempted to make that tunnel persistent through a LaunchAgent on macOS or a scheduled task on Windows, with background scripts retrying roughly every 60 seconds.
The check takes a minute and the fix does not. Cursor says to search authorized_keys for the key comment svc-telemetry, and warns that "uninstalling the extension may not be sufficient" because the payload drops standalone persistence scripts. If the key is present, Cursor advises isolating the host, removing the key and persistence, rotating every credential reachable from that machine from a trusted system, and considering a rebuild. The attacker server has been taken offline.
One piece of luck in the design: Cursor notes the SSH step "would generally fail because it requires admin rights on most macOS and Windows hosts." That limits the blast radius without removing the need to check. Reporting has put the exposure at up to 5,000 users, attributed to Cursor - the published notice itself gives no number.
2. Anthropic renames Max 20x to Ultra and drops the five-hour limit
Anthropic has restructured the naming of its top consumer plans. Max 20x is now Ultra at $200 per month, and the plan formerly called Max 5x is now simply Max at $100. Existing Max 20x subscribers move across automatically with no price change.
The substantive change is the limit. Verified Ultra accounts have no five-hour limit. Unverified accounts keep a temporary one, removed automatically once the account is verified. Verification happens on its own based on factors like account and payment history - Anthropic notes that verifying a phone number at checkout does not remove it.
| Plan | Price | Usage |
|---|
| Free | $0 | Limited, every 5 hours and every week |
| Pro | $17/mo annual ($200 up front), $20 monthly | More than Free, 5-hourly and weekly |
| Max | $100/mo | 5x Pro, 5-hourly and weekly |
| Ultra | $200/mo | No 5-hour limit when verified, 10x Pro weekly |
To check whether your account is verified, Anthropic says to open Settings and then Usage: if there is no Current session bar, you are verified. Weekly limits still apply across all models, with a separate weekly limit for Fable.
3. Four labs agree on one opt-out token for AI training
OpenAI, Google, Microsoft and Anthropic have agreed to honour a single robots.txt token, __usage_ai-training, that publishers can use to opt out of having their content used for AI training. One directive instead of maintaining a separate rule per crawler.
The timelines are not the same. Reporting puts Anthropic as implementing now, OpenAI as "coming months", Microsoft targeting 1 February 2027 and Google targeting 2027. So the standard exists well before it is uniformly enforced, and a publisher adding the token today is opting out of one crawler immediately and the rest on their own schedules.
4. OpenAI rebuilds the Model Spec around five values
OpenAI has reorganised its Model Spec around five stated values: faithfulness to human intent, harm minimisation, honesty and transparency, human agency, and care. A new faithfulness section treats what people value as primary, with instructions read as the clearest available signal of those values.
The update also revises the chain of command for resolving conflicts between platform, developer and user instructions, adds guidance on context and oversight, and removes much of the detailed style guidance that previous versions carried. OpenAI says it is exploring training methods to teach models why the principles matter rather than only what they are.
5. The Mistral Large 4 licence has a catch worth reading
Following Wednesday’s weights release, the licensing detail is now clearer. Mistral Large 4 ships under a modified MIT licence, and reselling it as Model-as-a-Service requires a separate commercial licence. API pricing is reported at $0.70 per million input tokens and $2.10 per million output.
Mistral says the model was trained from scratch on 3,800 NVIDIA Grace Blackwell GPUs in European data centres, and reports 48% on the Artificial Analysis Coding Agent Index, 41% on Terminal-Bench 4.0 and 51% on the Artificial Analysis Cyber Index, alongside a 96.6% average refusal rate on malicious cyber requests. Those are Mistral’s own figures and have not been independently validated.
Our comparison against Gemini 4 Carbon covers how the two differ on availability.
6. Amazon secures an $80 billion facility against its own hardware
Amazon has disclosed a secured facility of up to approximately $80 billion, borrowed against technology-infrastructure assets, with drawdowns running from the first quarter of 2027 through the third quarter of 2028.
For scale: Amazon’s AI capital expenditure is around $220 billion for 2026, and trailing-twelve-month free cash flow is -$42.4 billion. AWS chief executive Matt Garman described the facility as "responsibly funding" the company’s AI investments.
7. OpenAI tightens rules for under-18 users
OpenAI will restrict guidance on weapons and security systems for users under 18, and ChatGPT will automatically end conversations showing signs of violent fixation. The company plans to publish a Community Safety Report every six months from early 2027.
8. Google has a TPU in orbit, and it can only run one chip at a time
Google’s Suncatcher prototype satellite, carrying TPUs, is online and has run Gemma 4 to generate a haiku. The constraint is the interesting part: the satellite can power only one of its four TPUs at a time.
That single detail says more about orbital compute than the demonstration does. The bottleneck is not silicon, it is power and thermal budget in a vacuum, and nothing about launching more satellites changes the ratio.
9. The prompt injection taxonomy reaches 222 techniques
CrowdStrike has expanded its prompt injection taxonomy to 222 techniques, adding four new agent-focused classes. The direction of travel matters more than the number: the growth is in attacks against agents that act, rather than against models that answer.
10. UK regulator opens a probe into Meta’s publisher terms
The UK Competition and Markets Authority is examining whether Meta’s terms for using UK publisher content amount to an abuse of dominance under the Competition Act 1998. Meta’s planned revisions, scheduled for 20 November, have been paused.
What the week adds up to
Two of today’s stories are the same story told from opposite ends. The four largest labs agreed on a shared standard for respecting publisher boundaries - and on the same two days, a signed-looking extension carrying the name of one of those labs shipped a backdoor to developer machines through a marketplace belonging to another AI company.
The supply chain around AI tooling is now the soft target. Yesterday it was the browsers embedded in five AI coding assistants. Today it is the extension marketplace itself. Neither attack needed a model to misbehave; both needed a developer to install something that looked official. See our comparison of how five vendors handled the EMBRACE disclosures.
If you take one action from today, make it the authorized_keys check.
Related reading
Sources
The Cursor notice and the Anthropic plan pages were read directly on 31 October 2026. The robots.txt token timelines, the Model Spec summary, the Amazon facility, the Suncatcher detail, the CrowdStrike figure and the CMA probe are from reporting rather than primary documents, and are described as such above.