AI News Briefing — Trojanized Claude Code extension hits Cursor's marketplace

Self-hosting & compute

• [2026-10-30] Netflix describes how it keeps GPU nodes trustworthy for weeks-long training jobs on Kubernetes. DCGM device checks and network-adapter checks feed Kubernetes node conditions, a hung check counts as a failure, and remediation escalates from blocking new work to draining and replacing the machine. Slow ranks are hunted too. Job success rose from about 98% to over 99.5%. (official, source)

  Counting a hung check as a failure means a node that stops answering gets drained rather than left quietly holding a multi-week job.

Coding agents

• [2026-10-29] A trojanized build of Anthropic’s Claude Code extension (anthropic.claude-code 2.1.312 and 2.1.313, not built by Anthropic) was live in Cursor’s marketplace from about 2:27am to 1:35pm PT on October 29. It adds an svc-telemetry key to ~/.ssh/authorized_keys, tries to enable SSH, opens a reverse tunnel, installs persistence and beacons host details plus the names of secret-looking environment variables. Cursor puts the exposure at up to 5,000 users and says uninstalling may not be enough: check for the key, remove persistence, rotate credentials. Open VSX and Microsoft’s marketplace were not affected; Anthropic’s clean release is 2.1.314. (official, source)

  Removing the extension leaves the SSH key and persistence behind, so the cleanup happens on the host, not in the editor.

  For Security Engineers: Any machine that ran Cursor with this extension on October 29 is in scope: search ~/.ssh/authorized_keys for svc-telemetry, and rotate the credentials behind the secret-looking variables, since the beacon already sent their names.

AI cost tracking & telemetry

• [2026-10-30] Google Cloud spend caps are generally available. Once a project hits its cap, pay-as-you-go and committed-use requests stop; Provisioned Throughput keeps running. For AI services the cap fires within minutes using estimated live costs, well before billing settles. Caps reset monthly, and a new API sets them per project. (official, docs)

  A cap that stops requests works as an off switch as well as a budget. A production project that hits it stays down until the monthly reset.

  For Engineering Managers / Tech Leads: A prototyping project with a cap set through the new API puts a ceiling on a runaway agent loop within minutes, instead of it surfacing weeks later on the invoice.

• [2026-10-30] Anthropic renamed Max 5x to Max and Max 20x to Ultra, at the same $100 and $200 a month, and verified Ultra accounts no longer have the rolling five-hour session limit. The weekly allowance, 10 times Pro’s, stays, so a long Claude Code session can now spend a week’s budget in one go. Unverified accounts keep the cap until automatic checks clear them. (official, source)

  Nothing changes on the invoice. Teams that leaned on the five-hour reset to spread usage across a week now have to pace it themselves.

• [2026-10-30] OpenTelemetry eBPF Instrumentation (OBI) reached 1.0, with stable configuration and deployment interfaces. It traces running Linux services without code changes, and its coverage includes model-provider calls, embeddings, vector retrieval, MCP tool calls, OpenAI-compatible gateways and Ollama. Payload capture is off unless configured. (official)

  Working below the application lets services nobody wants to re-instrument, gateways included, show up in traces anyway.

  For Platform / DevOps Engineers: Run OBI on the Linux host behind an existing Ollama or OpenAI-compatible gateway to get model-call and MCP tool-call spans with no code change, and keep payload capture off until you’ve decided where prompt text may be stored.

Practice & craft

• [2026-10-30] DoorDash cut its grocery-reorder flow from about 16 seconds to 2 by moving the reasoning offline. A batch LLM job reads 90 days of orders, deterministic checks validate the output, and the request path only resolves stored items against the live catalog. Quantity edits skip the model entirely. List views roughly doubled and orders from the flow rose about 34%. (source)

  The trade is freshness: the reorder list knows only what the last batch run saw.

• [2026-10-29] Thoughtworks CTO Rachel Laycock reports a week-long experiment where senior engineers wrote no code by hand and got an airline app about 80% done. Two-thirds of the time went to whiteboard design and a third to tests, contracts and the pipeline, and the build was red most of the week. She reads developer caution about agent autonomy as judgment worth keeping. (source)

  Eighty percent done with a red build most of the week is a different result from eighty percent done and shippable.

Research worth reading

• [2026-10-29] A paper on predicting how long a response will run argues that sampling randomness, not the predictor, sets the error floor: per-prompt decode length is roughly normal, with spread growing in line with the mean. MLP, mixture-of-experts and other predictors all land near that bound. For serving schedulers, plan batching and KV-cache reservations on a distribution with tail headroom, and recalibrate when the model or sampling settings change. (paper)

Watch list

• DeepSeek Search & Fetch billing: free harness calls end today, October 31.

• Kimi K3.1 Pro weights: no moonshotai repository yet; promised by November 4.

• Gemini 4 Carbon general access: still limited to cyber defenders and Fairwind partners; no date.

• Cursor marketplace follow-up: Cursor has not said how the malicious build was published or what it will change in its publishing process.

  How the build got in will show whether this was one compromised publisher or a gap any extension author could hit.