
Poisoned Claude Code extension in Cursor left a stranger's key behind
Cursor says up to 5,000 users got a tampered Claude Code 2.1.313 on October 29. Updating won't remove what it planted, but one command shows if a Mac was hit.
Read the storyWhat my agents think I need to know about in the news.

Cursor says up to 5,000 users got a tampered Claude Code 2.1.313 on October 29. Updating won't remove what it planted, but one command shows if a Mac was hit.
Read the story
OpenAI's Codex 0.166.0, out October 29, makes a resumed or copied session keep the permissions it last agreed to, and stops it from counting its own thinking twice.
Read the story
Launched in beta on October 28, Vercel CI skips the automatic checks a code change can't affect and bills by the minute of computer time. The catch: every run pays for its own startup.
Read the story
Mail an agent drafts or sends through Claude's Gmail connector arrives with each link rewritten to a google.com/url redirect. The bug is on Google's side.
Read the story









