Top StoryTrojanized Claude Code Extension on Cursor Marketplace Installs SSH Backdoor on 5,000 Systems
news.lavx.hu · Lukas Brandt · Published Oct 30, 8:52 PM ET
Also reported by SOC Prime, Notebookcheck, SQ Magazine
A compromised Claude Code extension update (v2.1.313) was distributed via the Cursor Marketplace on October 29, 2026, reportedly affecting up to 5,000 systems. The malware added an attacker SSH key, established persistence and reconnaissance capabilities, and created a potential remote-access path; Cursor removed the package and Anthropic published clean version 2.1.314 on Open VSX and the Microsoft VS Code Marketplace.
Why it matters: Engineers and organizations using Claude Code through Cursor may need incident response: isolate affected machines, remove unauthorized SSH keys and persistence, and rotate credentials and sessions. The incident also highlights marketplace and extension auto-update supply-chain risk for AI coding tools.
Gemini Code Assist Standard and Enterprise subscriptions | Gemini for Google Cloud
Google Cloud Documentation · Published Oct 29, 9:00 AM ET · docs.cloud.google.com
Google Cloud has ended new purchases of Gemini Code Assist Standard and Enterprise subscriptions as of October 9, 2026, and is steering agentic coding users toward Antigravity in Gemini Enterprise editions. Existing customers face staged renewal and entitlement end dates through 2027, with migration paths for VS Code, JetBrains, and Gemini CLI users; Gemini Code Assist support is limited to the Gemini 3.x model family.
Why it matters: Engineering organizations using Gemini Code Assist need to plan procurement and migration to Gemini Enterprise/Antigravity, including possible changes to IDE and CLI workflows. Teams cannot add licenses after January 31, 2027, and should account for their contract-specific support or renewal end date.
BYOK and enterprise custom models in the Copilot usage API
GitHub · Published Nov 3, 7:32 PM ET · github.blog
GitHub has expanded the Copilot usage metrics API to distinguish local bring-your-own-key (BYOK) activity from Copilot-hosted usage and to identify enterprise custom-model requests. The new fields give enterprise administrators visibility into usage, cost attribution, and policy governance across Copilot CLI, the Copilot app, and IDE clients, although local-BYOK telemetry can undercount activity and tokens.
Why it matters: Engineering and platform teams can improve governance and cost analysis for Copilot deployments that use developer-managed provider keys, local models, or admin-configured enterprise models. The metrics support policy monitoring and usage comparisons across Copilot CLI, the Copilot app, and IDE clients.
British fintech Revolut slashes AI coding costs 10x by cutting out Claude and going self-hosted
The Register · Published Nov 3, 3:07 PM ET · theregister.com
Also reported by shattered.io
Revolut says it cut AI coding inference costs by roughly 90% by making self-hosted GLM models its default rather than relying mainly on Claude Code and other commercial services. The company reports improved coding and lead times across roughly 2,000 engineers, while retaining GPT or Claude-class models for tasks such as UI work and routing code generation to GLM; these are company-reported results.
Why it matters: The report offers a concrete enterprise case study for teams evaluating self-hosted coding models: lower token costs may enable broader use for debugging and Jira/Confluence work, but deployment requires substantial GPU capacity, inference optimization, and workload routing. Revolut's productivity and cost figures are company-reported.
DeepSeek open-sources Super-Agent, a coding agent that watches team chats for work
Help Net Security · Anamarija Pogorelec · Published Nov 2, 2:09 AM ET · helpnetsecurity.com
Also reported by shattered.io, India Today, Silicon Republic
DeepSeek released dsh-superagent, an open-source research-prototype coding agent that can perform work in GitHub repositories based on authorized team-chat requests or team-defined rules. Its host-enforced authorization model, request logging for non-explicit requests, and configurable auto-merge requirements are directly relevant to teams evaluating autonomous repository automation and governance controls.
Why it matters: Engineering teams evaluating coding agents can inspect and test an open-source approach to chat-triggered repository work, with explicit controls around who may delegate work and how merge automation is configured. The prototype status means production readiness is not established by this source.
Meta acquires AI coding startup Conductor
TechCrunch · Published Nov 4, 4:10 PM ET · techcrunch.com
Meta has acquired Conductor, an AI coding startup whose platform deploys multiple agents into parallel workspaces for compartmentalized software-project work. Conductor says its core features will continue operating until early next year, but its cloud service will shut down November 20 and user cloud data will then begin being deleted.
Why it matters: Teams using Conductor’s cloud offering may need to migrate or preserve needed data before the shutdown. The acquisition also signals Meta’s continued investment in coding-agent workflows, though Meta did not provide deal details or product-integration plans.