Cursor pulls backdoored Claude Code extension after 11-hour exposure

Cursor finds a backdoor in Claude Code extensions distributed through its marketplace

Cursor says malicious builds of the Claude Code extension, identified as versions 2.1.312 and 2.1.313 for Windows and macOS, were available through its extension marketplace for roughly 11 hours on October 29. The injected code collected machine details and attempted to add an attacker-controlled SSH key, establish persistence and open remote access. Cursor estimated that no more than 5,000 users were exposed, removed the builds, rebuilt the marketplace and published checks and remediation guidance. Microsoft Security Research says its own VS Code marketplace and the official npm distribution were unaffected; Anthropic told Microsoft that its systems were not compromised.

Why it matters. Developer extensions can inherit access to code, credentials and local tooling. Coding errors apparently limited the attacker's ability to enable SSH on many machines, but uninstalling the extension alone may leave persistence behind. Anyone who installed the affected builds from Cursor during the exposure window should follow Cursor's official remediation instructions. The route used to publish the tampered packages remains unclear.

Google gets the first AI response from a data-center-class TPU in orbit

Google says its Project Suncatcher prototype satellite, launched on October 1, has returned a short poem generated by the Gemma 4 model running on a TPU in space. The demonstration followed weeks of satellite commissioning. TechCrunch reports that the craft carries four TPUs and has a roughly 1-kilowatt power budget, which limits how long a chip can run at a time.

Why it matters. It is a real hardware-and-communications milestone for Google's proposal to operate AI computing infrastructure in orbit. It does not establish that space data centers are commercially viable: radiation resilience, heat, energy, networking and cost remain open questions. Google plans to study thermal and radiation effects before a twin-satellite experiment in 2027.

Nvidia weighs guaranteeing debt for an Anthropic-focused Nscale data center

Reuters, citing an earlier report by The Information, says Nvidia is discussing billions of dollars in credit guarantees to support financing for Nscale's West Virginia AI campus, which is intended to serve Anthropic. TechCrunch reports that the potential backing would extend Nvidia's support beyond chips and leases into construction financing. The parties have not announced a signed guarantee, and the terms remain uncertain.

Why it matters. The proposed structure shows how the cost of AI compute is pushing hardware vendors, cloud providers and model developers into increasingly interdependent financing arrangements. It could help construction proceed, but also concentrate credit risk across companies that depend on the same AI demand forecasts. Treat the arrangement as reported talks, not a completed deal.

SEC enforcement chief says AI-company disclosures face closer scrutiny

In a Reuters interview, US Securities and Exchange Commission enforcement director David Woodcock said the agency is examining whether companies are accurately disclosing material risks around AI investment, including concerns about circular financing and inflated expectations. He also warned that AI lowers the cost of large-scale scams and said investor protections remain important.

Why it matters. Investors are now asking how vast AI capital expenditures translate into sustainable returns. The comments indicate enforcement attention to disclosure quality, not a new SEC rule or a finding that a particular company violated securities law. Clearer accounting of commitments, counterparties and financing risk could become more important for AI companies seeking capital.

DoorDash says third-party shopping agents have placed only several hundred orders

During DoorDash's third-quarter earnings call, CEO Tony Xu said third-party assistants had generated only several hundred orders in total, even as the company experiments with ways for agents to place purchases. The company continues to develop its own AI ordering tools, including text-based ordering and agent integrations. The figure describes orders observed on DoorDash, not the entire agent-commerce market.

Why it matters. The gap between agent demonstrations and actual transactions remains large. Reliability, consumer habits, merchant access and the quality of existing apps all shape adoption. For product teams, this is a useful reality check against assuming that agent-driven commerce is already a mainstream channel.

Foxconn signals another OpenAI hardware collaboration, with details still pending

At a technology event in Taiwan, Foxconn chairman Young Liu told reporters that he had met OpenAI CEO Sam Altman and that the companies were working toward a further announcement. The companies already agreed in 2025 to collaborate on AI data-center hardware design. Liu also said Foxconn had deployed more than 10 humanoid robots internally at its Texas facilities.

Why it matters. AI infrastructure is reshaping manufacturing supply chains, but the proposed OpenAI collaboration has no disclosed scope, value or final terms. Foxconn's robot deployment is a separate early industrial-use signal, not evidence of broad commercial adoption. The company is betting on AI servers even as investors question infrastructure spending.

Watch for Cursor's root-cause findings and confirmed remediation outcomes; Google's 2027 linked-satellite experiment; and whether the reported Nscale credit guarantee becomes a signed transaction.