Afternoon edition — Friday 30 October 2026

Cursor, the AI coding editor owned by SpaceX, published a security notice dated 29 October. It says a maliciously modified Anthropic.claude-code version 2.1.313 was available in its own VS Code extension marketplace from about 2:27am to 1:35pm Pacific time that day. Cursor says the version was not developed by Anthropic and that at most 5,000 users were affected; it will contact them directly.

According to Cursor, the code collects host and user details, adds an attacker's SSH key labelled svc-telemetry to the user's authorized keys, installs persistence and tries to open a reverse SSH tunnel. Cursor says turning on the SSH service fails on most macOS and Windows machines because it needs administrator rights, but the key, the persistence and the host report still go through. Uninstalling the extension may not be enough, it says, and it publishes a check and removal scripts.

Cursor says it removed the version, shut down and rebuilt the marketplace, rotated its keys, audited access and found no other tampered extensions, and had the attacker's server taken offline. The Hacker News reports that the package was shipped under the extension's legitimate ID, that there is no evidence it reached Open VSX or Microsoft's marketplace, and that Anthropic has published version 2.1.314 to both.

Epoch AI published a report on 29 October on the patch gap, the time between a security fix appearing in public code and reaching users. Its researchers say Z.ai's open-weight model GLM 5.3 built webpages that read a file from a visitor's computer and sent it to an attacker, against all six Firefox releases from 17 September to 26 October.

The researchers say they ran the model offline with basic tools and public information from each release date, and that it worked without human input after basic instructions. Once their setup was built, each version cost about $1,000 in API fees; the fastest attempt took 12 hours. They say no provider, including Z.ai, refused the requests. Each attack also used an unpublished sandbox flaw that the model rediscovered; Firefox 159.0, released on 27 October, patches it.

The same approach did not produce a Chrome exploit. In a post on 29 October, Mozilla said it now ships builds every week, keeps regression tests confidential until fixes ship, scans new commits, and will time fixes so that the pieces an attacker must chain are never in the patch gap at the same time.

US technology stocks fell sharply on Friday morning. Reuters reported that Intel fell more than 30%, on course for its biggest one-day loss on record, after warning that it would burn cash this year because of a weak PC market, manufacturing problems and heavy spending on production. Amazon slipped 2% after reporting its cash outflow the day before.

The selloff spread to chipmakers: Reuters reported Nvidia down 3%, AMD down 9.3% and the chips index down 5.7%, with Dell and HP down about 9%. At 09:53 New York time the Nasdaq Composite was down 2.21% and the S&P 500 down 1.22%. Reuters said the Nasdaq-100 was on track to erase just over $1 trillion in market value if losses held. Reddit fell 26% after warning that daily visitors could drop.

Intel's chief executive, Lip-Bu Tan, told investors he was disappointed not to meet strong customer demand, citing manufacturing, supply shortages and an unprecedented memory crunch, NBC News reported.

The Wikimedia Foundation, which runs Wikipedia, said on 30 October that it had filed an amicus brief in In re: OpenAI, Inc. Copyright Infringement Litigation, the 12 combined lawsuits against OpenAI that include The New York Times' case against Microsoft and OpenAI, in the Southern District of New York. It says it supports neither side.

The foundation argues that using copyrighted works to train models that are new and different from their sources should count as fair use, without licensing terms. It argues that retrieval-augmented generation, where a chatbot copies web content to answer a question, should not count as fair use and must respect each publisher's licence; for Wikipedia that means CC BY-SA 4.0 attribution. It also says scraping of its sites must respect its rate limits or go through its paid Enterprise API.

Foxconn chairman Young Liu told reporters at the company's annual technology event in Taipei on Friday that he had met OpenAI chief executive Sam Altman earlier that day, and that a new collaboration with OpenAI was in the works, Reuters reported. He said there would be an announcement once details were confirmed and gave no further details.

Reuters notes that any deal would build on last year's agreement for the two companies to design and engineer data-centre racks and other AI hardware. Liu also said the AI industry was not in a bubble and that Foxconn, Nvidia's biggest AI server maker, expects double-digit growth next year.

An update to the European Commission's list of acquisitions under the Digital Markets Act shows a deal between Apple and Ascension Labs, better known as Ascend.io, a company that sells AI agents for data engineering, 9to5Mac and MacRumors reported on 30 October.

According to the reports, Apple gets the right to make employment offers to certain employees, a non-exclusive licence to Ascend's intellectual property and some of its patents. Ascend's website says it is winding down operations.