A maliciously modified Claude Code VS Code extension

A maliciously modified Claude Code VS Code extension, published under Anthropic's own legitimate `anthropic.claude-code` identifier, was distributed through Cursor's marketplace for roughly 11 hours on 2026-10-29 and attempted to plant a persistent SSH backdoor on up to 5,000 developer machines. Cursor shut down its entire marketplace to audit and rotate keys.

`thedotmack/claude-mem`, a persistent cross-session agent-memory tool this research has tracked since October 4, spikes to GitHub Trending #1 with +1,140 stars in a single day — nearly as much growth as its entire prior month combined, after sitting at #8 just yesterday.

GitHub Trending's agent/harness/skill concentration lands its eighth tracked data point on the longest board yet (15 items), reading 70% on the top 10 and 73% on the full board — inside the 57-93% range the metric has held across eight days, with board length itself increasingly correlating with a lower top-10 reading.

Google Play Store's four-way frontier-lab volatility continues: Gemini returns to the top 30 for a second, non-consecutive day (#10, 4.6★) while Claude, ChatGPT and Grok extend their absence to a second day — the first asymmetry among the four apps after four days where each showed exactly one day of presence.

Blackstone reverses its own prior forecast, now telling investors it expects Anthropic to receive a high "junk"/double-B-range credit rating after its IPO rather than the investment-grade rating it previously projected — a reversal that would make Anthropic's continued compute-spending debt costlier to raise.

Proton's CEO Andy Yen cancels planned company-wide AI-usage "re-interviews" after a 404 Media investigation reports him dismissing a request to pentest newly AI-written code as "bullshit and loser thinking"; the AI-usage measures will instead fold into standard performance reviews.

Consumers use Claude Code and DeepSeek V4.1 Flash as coding agents to strip ads, telemetry and bloatware from their own smart TVs, via open-source projects CleanYourTV (~41,000 GitHub stars) and DumbTV — AI agents turned against a manufacturer's own cloud-connected ad layer via reversible, no-root ADB scripts.

Nathan Lambert partially revisits his own prediction that an open-weight frontier-capability model leak would cause no catastrophic cyber harm, weighing it against October's cyber-incident cluster (PHP2Shell, the GitLab CVE, the suspected Binance hack) — concluding "a forced industry update" is the better frame, short of a full reversal.