AI Weekly: Claude Code Backdoor Incident and AI Giants' Capital Game

This week in AI saw a serious security incident: the extension marketplace of AI code editor Cursor was seeded with malicious versions of the Claude Code extension, while tech giants also made new moves on capital expenditure, product strategy, and copyright issues. This article summarizes and analyzes these key developments.

Claude Code Backdoor Appears in Cursor Marketplace, Supply Chain Security Alarm Sounded Again

Cursor officially confirmed that its extension marketplace distributed tampered copies of the Claude Code extension on Thursday, October 29, which attempted to install backdoors on developers' computers. The malicious versions were available to Mac and Windows users from about 2:30 AM to 1:35 PM Pacific Time, lasting approximately 11 hours. Cursor listed two affected version tags: 2.1.312 and 2.1.313. But the version numbers themselves are misleading—Anthropic did release 2.1.312, and the copy in the Cursor marketplace was a modified version of it; the other tag, 3.1.3, was never officially released in the upstream store. Therefore, developers need to verify file hashes rather than just version numbers.

Early reports pointed the finger at the OpenVSX open-source extension registry, but this claim has been corrected. Cursor operates its own marketplace service, located in front of OpenVSX. Cursor, Microsoft's security team, and Anthropic maintainers all located the malicious package in Cursor's channel, with no evidence that OpenVSX, the Microsoft marketplace, or Anthropic's official packages were compromised. Security firm Forian also revised its initial report, confirming the problem was in the Cursor Marketplace.

Malicious Code Behavior and Scope of Impact

The injected code has nothing to do with AI models; it executes as soon as the editor loads the extension, without the user needing to ask Claude anything. According to analysis by Microsoft and Forian, the code collects computer information, collects the names of environment variables associated with sensitive services, attempts to add the attacker's login key to the machine, and establishes repeated outbound SSH connection attempts. The purpose of the outbound tunnel is to proactively open a path to the attacker even if the machine rejects inbound connections.

Regarding the number of affected developers, the circulating "up to 5,000 people" comes from secondary software; Cursor has not disclosed installation counts. Microsoft noted that the first callback messages contained only environment variable names, not secret values; Forian documented cases where the code failed on specific platforms, and whether the login key took effect depended on administrator privileges and SSH configuration. Neither analysis showed that successful attacker logins occurred on every affected computer.

SSH Outbound Tunnels and Persistence Mechanisms: SSH (Secure Shell) is the standard encrypted protocol for developers to log in remotely and transfer files, typically listening on port 22 and accepting inbound connections. In this incident, attackers exploited the protocol in reverse: malicious code proactively initiated outbound SSH connections from victim machines to attacker-controlled servers, thereby bypassing firewall and NAT interception of inbound traffic. The so-called "adding the attacker's login key" refers to writing the attacker's public key into the ~/.ssh/authorized_keys file, enabling the attacker to later log in directly as that user. Persistence may be achieved through startup items, scheduled tasks, or shell configuration files, which is why Cursor warned that "uninstalling the extension may leave residual artifacts"—cleaning up the extension does not equal removing implanted keys and autostart entries.

Remediation Measures and Developer Self-Check Recommendations

Cursor has removed the relevant packages, audited and rebuilt the marketplace, rotated marketplace keys, and assisted in taking down the attacker's server. But this only prevents new installations and cuts off known connection points; it cannot clean machines that have already run the code. Cursor warned that uninstalling the extension may leave added keys and persistence mechanisms. If you installed Claude Code during that time window, check your installation history against the hashes in the announcement and follow Microsoft's guidance on checking processes, network connections, login records, and startup items. Whether to rotate credentials or rebuild the machine depends on the inspection results. Cursor also offers optional signature verification and delayed installation of new updates—installation delays shorten exposure to short-lived malicious updates, while signature verification adds another layer of file origin validation. However, the records do not state whether these features were enabled among affected users, nor explain why the package bypassed Cursor's own scanning. The core lesson is clear: AI coding tools are also ordinary software, running with the same permissions developers have over code and keys; how they are delivered matters as much as model behavior.

On the Relationship Between OpenVSX and the Cursor Marketplace: OpenVSX is an open-source extension registry maintained by the Eclipse Foundation, designed to provide a vendor-neutral alternative marketplace for the VS Code ecosystem; many VS Code-derived editors (such as VSCodium and Gitpod) pull extensions from it by default. Cursor does not directly use OpenVSX packages but operates its own marketplace service in front of OpenVSX—meaning the extension metadata interface may reuse open-source components, but actual distribution and signing are controlled by Cursor's own channel. This architectural difference is the root of early misreporting: the malicious package appeared at Cursor's channel layer, not OpenVSX's storage layer. Understanding this is crucial for assessing supply chain responsibility—the problem is not that the open-source registry itself was breached, but whether integrity verification at the downstream distribution stage was adequate.

Amazon Capital Expenditure Surges, Demand Authenticity in Focus

Amazon's quarterly filing shows that cash outflows for capital projects reached $75.9 billion in the three months ended September 30, mainly for technology infrastructure and warehousing and delivery capabilities. The earnings report stated that free cash flow over the past year was negative, mainly due to AI-related equipment and property purchases, and Amazon expects this spending to rise significantly again in 2027.

Two points need clarification: Amazon's cloud division is often repeatedly mentioned, but not all of this spending is for AI; the same line item also includes fulfillment investments; and this is not an ordinary expense—data centers are purchased upfront and generate revenue over years, with cash outflows occurring far earlier than services are sold. Does demand really exist? Amazon's cloud division sales grew 39% year-over-year, and customers are clearly buying. The unresolved question is not whether there are customers, but whether usage, prices, and demand can remain high long enough to recoup such massive construction costs on schedule.

The Relationship Between Capital Expenditure and Free Cash Flow: Capital expenditure (CapEx) is the cash outflow from a company's purchase or construction of long-term assets; it is not directly reflected as a current expense on the income statement but is amortized through depreciation over future years. Free cash flow is the balance of operating cash flow minus capital expenditure, reflecting cash available for discretionary use. Amazon reports negative free cash flow precisely because upfront investment in AI data centers is huge while revenue has not yet materialized in sync. Data centers typically take years from groundbreaking to full-capacity revenue generation, while cash outflows are concentrated during construction; this mismatch of "cash flow front-loaded, revenue back-loaded" is a typical feature of capital-intensive industries and the core logic behind market concerns about return cycles.

Google AI Search Monetization Challenge: More Searches, Less Revenue

On the October 28 earnings call, Google Chief Business Officer Philip Schindler said that AI Mode (Google's chat-style search) currently generates less revenue per search than conventional results pages. Meanwhile, Alphabet reported the fastest growth in search query volume in five years and a 12% increase in the "Search & other" revenue category. More people are searching, but each search brings in less revenue under the new format.

When answers replace a page of results and links, where ads appear, what users click, and what advertisers can buy all change. Google says its ad experiments in AI Mode and AI Overviews are promising and it is scaling them up—this is a plan, not proof that the gap has narrowed. Google does not separately report profit data for AI Mode, so its success cannot be read from search revenue figures.

The Intersection of Technology, Capital, and Policy

Tech stocks fell this week; Reuters attributed part of the decline to concerns about returns on AI spending but also mentioned pressure in oil and cryptocurrency markets. Intel's sharp drop stemmed from its own announcement of weak PC market conditions and disappointing guidance. These fluctuations are not a simple verdict on AI costs.

No document announced service price increases. Possible pressure points lie in subscription prices, usage limits, advertising, and efficiency gains. In the same week, OpenAI's release notes actually increased usage quotas for several paid ChatGPT plans. Financial pressure does not automatically translate into tighter access restrictions.

House Democrats Kassar and Maxine Waters introduced a resolution stating that the federal government should not bail out bankrupt AI companies and the banks and investors behind them. This is House Resolution 1642, with Kassar as sponsor and Waters and 11 others as co-sponsors; it was announced on October 29 and has been referred to committee. The key point is that this is a "sense of the House" resolution; even if passed, it is not legally binding and would not prevent bailouts, change regulatory authority, or spend funds. It has not passed; it has only been introduced. The Progressive Caucus announcement lists opposition to emergency loans, capital injections, government debt guarantees, and other special assistance, advocating that failed companies go through ordinary bankruptcy proceedings, hold executives accountable, and direct assistance to workers, consumers, pension holders, and affected communities. Why speak out when no company has yet failed? Because expectations shape behavior—if lenders and investors believe the government will absorb the worst losses, they will take bets they would otherwise avoid, i.e., moral hazard. Saying "no" in advance aims to influence ongoing financing decisions. The strongest counterargument is that when large companies collapse, the harm extends beyond gamblers—employees lose jobs, pension funds hold assets, suppliers are owed money, and the government may decide to intervene to prevent broader harm. The resolution's answer is to protect these people rather than the company, but it does not explain how to do so in a real failure. It should be clear that there is no indication that Amazon or any company has gone bankrupt or sought help.

Anthropic Subscription Plan Renamed Ultra: 5-Hour Limit Removed but Weekly Cap Retained

Anthropic's top Cloud subscription is now renamed Ultra, priced at $200 per month, replacing the former Max 20X plan; existing Max 20X subscribers migrate at the same price. The main change: verified Ultra accounts no longer have a 5-hour usage limit but still retain a weekly cap, which is 10 times that of the Pro plan. The $100 Max plan retains both 5-hour and weekly limits, each 5 times that of Pro. Ultra does not increase total weekly usage but changes when usage can occur—users with long coding sessions could previously hit the 5-hour wall while their weekly quota was still ample; now verified accounts can spend more of their weekly quota at once.

"Verified" means Anthropic examines signals such as account history and payment history; newer accounts may retain a temporary 5-hour limit. On verified Ultra accounts, the current session progress bar disappears from usage display. Some claim capacity has decreased because the old name was "20x" and the new plan is "10x," but evidence does not support this. According to Anthropic subscription lead Mike Ovarel's explanation (the original post is inaccessible but was cited in contemporaneous reports), 20X referred to the 5-hour window, and the weekly cap introduced later was already 10 times that of Pro. The current page confirms today's terms. Complaints on Reddit reflect naming confusion rather than measured cuts.

Other limits include: usage is shared between Claude and Claude Code; chat and coding consume the same quota; Ultra has a separate weekly limit for Fable models; Anthropic reserves the right to set caps on other models or features. Multipliers are not task counts; customization and large inputs consume quota faster. Ultra eliminates one type of interruption for heavy users but is not unlimited.

OpenAI Commits to Supporting robots.txt Training Signals, but Details Pending

On Friday, OpenAI said it will in the coming months honor a shared signal that websites can use to declare whether their content may be used to train AI models. The signal will be placed in robots.txt. It primarily addresses an accounting problem: news sites may want search engines to index pages but not use them to train generative models; currently they must write separate rules for each company's crawler and track new crawlers. A shared signal would describe the purpose (training) rather than naming each bot.

Can websites add it now? No. This is a commitment to future implementation. OpenAI did not specify which concrete format it will adopt; the linked standards work has multiple proposals: one draft adds a training section to robots.txt, and another working group draft describes a content usage tag that can be placed in robots.txt or web response headers. These are drafts from internet standards bodies, not approved standards; copying configurations now amounts to guessing.

What publishers can use now are OpenAI's two separately named crawlers: blocking GPTBot tells OpenAI not to use content to train its foundation models; OAI SearchBot is the crawler for ChatGPT search. Websites can already refuse training while appearing in ChatGPT search. OpenAI says these controls remain and the shared signal will be layered on top. The limitation of such signals: they are declared preferences, not locks; they do not stop crawlers that ignore them, do not compel other AI companies to comply, and OpenAI does not commit to removing content already used for training. What publishers need next is testable notification: exact syntax, start date, participating companies, and what happens if a website changes its mind.

On the same day, OpenAI also announced tightening ChatGPT's descriptions of violence, adding teen protections, and committing to publish its first community safety report in early 2027. The changes will roll out over the coming weeks and may not take effect on all accounts. Two levels: for everyone, further restrictions on detailed reconstructions of past mass attacks (weapons used, how they were obtained, comparisons of harm across attacks); for teens, even seemingly harmless questions are restricted regarding practical information on weapons and security systems that could facilitate violence. People can still discuss events, impacts on victims and communities, warning signs, and prevention; teens can still get help preventing or de-escalating violent threats. ChatGPT determines teens through an age prediction system, which OpenAI says continuously reassesses signals; if an account is judged to belong to someone under 18, it switches to the teen experience, and adults misclassified can verify age through Persona. OpenAI did not disclose the frequency of misclassification. When conversations show fixation on violence or seriously harming others, ChatGPT will be able to end the chat, and repeated endings can lead to temporary account suspension. OpenAI is also studying notifying parents when teen accounts are suspended for this reason, which is distinct from existing alerts for certain serious self-harm and eating disorder concerns.

Technical Background on robots.txt and Training Signals: robots.txt is a plain text file in a website's root directory, widely followed by crawlers since 1994 to declare which paths are allowed or disallowed for crawling. But it is essentially a "gentlemen's agreement" with no legal force; malicious crawlers can ignore it entirely. In recent years, controversies over AI training data have prompted proposals to extend robots.txt with "training use" declarations, such as the IETF AI Preferences Working Group draft, attempting to let websites use unified syntax to distinguish "allowed for search indexing" from "allowed for model training." The difficulty is that different AI companies name their crawlers differently (GPTBot, ClaudeBot, Google-Extended, etc.), making configuration and maintenance costly; and signals only bind voluntary compliers, with no retroactive force on already-crawled historical data. This is why OpenAI's commitment is seen by publishers as "directionally correct but lacking in detail."

OpenAI Publicly Defends Fair Use, Copyright Battle Continues

On Friday, OpenAI published an article titled "Fair Use Benefits Everyone," defending itself in the copyright case brought by The New York Times against OpenAI and Microsoft. The article cites court briefs supporting OpenAI, including libraries, accessibility advocates, creators, scholars, developer groups, and authors' alliances. There is no new ruling; this is OpenAI stating its position publicly. Its arguments are threefold: training uses articles for purposes different from reading; the products do not provide substitutes for the original works; and the market harm alleged by the Times is not a legally recognized type. The Times disputes both the facts and legal conclusions, and the court has not ruled on any part.

The authors' alliance brief makes a precise distinction: new works that compete for the same readers, same topic, or genre but do not copy the actual writing are different from copying that substitutes for the protected work. The brief calls the former "market dilution" and argues it should not count as copyright harm. This is a narrow legal argument; it does not claim all AI output is legal, nor that no authors suffer economic harm. The mix of supporters shows this is not just AI companies versus publishers—libraries and accessibility groups care about information access, and startups care about who can afford to build these systems. But OpenAI chose the excerpts; it is the defendant, the article does not present the plaintiff's evidence, and the cited groups do not represent everyone in their fields. This relates to the same-day robots.txt announcement but answers a different question: honoring future opt-out signals will not resolve whether past training was legal, and arguing fair use does not tell publishers which technical controls work today. The decisive event will be a court order, judgment, or settlement.

Developer "Compiles" NES Processor into Model Weights

Developer Drew Brunig released the Nieceformer project, building the original NES processor and memory directly into the weights of a model with the same architecture as Qwen. The model did not learn how the NES works by watching games. Brunig started from a 6502 processor reference model (including registers, flags, working memory, and game cartridge programs) and used a compiler to translate these operations into model parameters—normally a compiler would produce machine instructions, but here they become numbers in a neural network.

How does memory emerge from weights? The trick comes from an earlier project, Qwenputer (acknowledged by Brunig). Qwen 3.5 has a component called Gated Delta Net that maintains an internal table of numbers that can be updated and read back at runtime. By carefully choosing inputs, each row of the table can act like a memory address: one operation writes to a known slot, another reads it. The model then produces a running log of processor steps, one record at a time, just as a chatbot produces the next word—each record is a processor operation, not a word.

Not the entire console is inside the model: the processor and game code run in the model, while screen drawing, controller reading, timing, and other input/output are handled by a separate Python program. Brunig compared the processor against established instruction traces and another emulator; when free-running games, every saved frame in his tests matched the reference output—his own tests, not independent certification. Practical gameplay is unrealistic: 150 to 290 times slower than a real console; 10 seconds of gameplay takes about 25 minutes. Only the simplest cartridge types and official processor instructions are supported; memory switching is not supported, some graphics effects are missing or approximated, and there is no sound. The weights download at 3.3 MB (compressing well since most numbers are zero), unpacking to 933 MB, with keys and runtime memory extra. It runs on an ordinary processor and does not require a graphics card. In a Hacker News post, Brunig said Claude Opus 5.5 generated the code and weights from two prompts, building on Qwenputer and existing processor tests—a personal statement, not a measurement study of AI productivity. It is impractical as an emulator, but the fact that the model architecture can run an exact hand-coded program it never learned from data is noteworthy.

This Week's Takeaways

Supply chain security is the cornerstone of AI tool adoption. The Cursor incident shows that even if the model itself is safe, vulnerabilities in the delivery channel can put developers at risk. Enterprises should enable signature verification and delayed updates and regularly audit extension sources. Meanwhile, AI giants' capital expenditure and revenue models are still being reconciled: Amazon is betting on long-term demand, Google needs to solve AI search monetization efficiency, and OpenAI is proactively shaping expectations on copyright and safety norms. Technical breakthroughs like Nieceformer demonstrate unconventional uses of model weights but remain far from practical. For developers, following official security announcements, verifying file hashes, and understanding changes to subscription terms are the most practical action items right now.

One-line Summary

Cursor marketplace hit by Claude Code backdoor attack as AI giants' capital expenditure, monetization, and copyright battles advance in parallel.

Paragraph Summary

This week in AI, security and business developments intertwined. The Cursor extension marketplace distributed tampered Claude Code for about 11 hours; malicious code attempted to implant SSH backdoors and establish outbound tunnels, and officials have removed it and advised developers to verify hashes. On the capital front, Amazon's quarterly capital expenditure reached $75.9 billion, with cloud division growth of 39% but negative free cash flow, raising market concerns about AI investment return cycles; Google's AI Mode generates less revenue per search than traditional results pages, making monetization efficiency a new challenge. Anthropic renamed its top subscription to Ultra, removing the 5-hour limit but retaining a weekly cap—effectively a timing adjustment. OpenAI committed to supporting robots.txt training signals in the future and published a fair use defense article. Additionally, a developer compiled the NES processor into model weights, demonstrating unconventional uses of model architecture.