Daily AI Fresh News · Nov 2 Evening Edition: Coding Tool Security and Hands-On Tutorials

Lots of new moves in the AI world today, especially on the coding tool side — news and tutorials are piling up.

Today we're mainly covering these: first, Cursor getting poisoned for 11 hours; second, a DQN intro note; third, Vibe Coding vulnerabilities; fourth, a Claude Code hook for reading web pages; fifth, a Claude Code hands-on tutorial.

Plus a full guide to Codex App, and an open-source project where a catgirl helps you learn programming.

Yeah, all solid stuff.

Alright, let's go one by one. Starting with the most explosive one.

Just saw something on YouTube with a pretty scary title. Cursor had a backdoored Claude extension floating around for 11 hours.

Right, and the key isn't the 11 hours — it's how it got in. A third-party extension got to run in front of that huge a user base.

Isn't that a textbook supply chain attack? Users aren't gonna go check the extension's source code.

Exactly. And coding tools have way too much permission — they can read code and execute commands. Once a backdoor is in, the possibilities are scary.

So is 11 hours to take it down fast? I saw comments saying it was slow.

Not fast, but not a disaster either. The point is these tools need to build in extension review and runtime isolation, or it'll happen again.

Okay, let's keep that in mind. Next, something lighter — there's a DQN intro note on Reddit.

I saw that one — one page, tying concepts, code, and math together. It compares table methods with neural network approximation, and explains it pretty clearly.

Experience replay and target networks — aren't those the two spots where beginners get stuck most?

Yeah, without those two, training is unstable. The note puts pseudocode and the Bellman equation side by side, so it hits all the pitfalls.

Okay, next. There's also a short video on YouTube that tallies up security vulnerabilities in AI-written apps.

Over two thousand — sounds exaggerated, but that's just how Vibe Coding works. Fast generation, little review.

So it's fun to write, and blows up when you ship.

Pretty much. These tools will eventually have to make static scanning and dependency checks default actions — can't rely on people doing it themselves.

Then there's another one — someone on Reddit broke down how Claude Code reads web pages.

That's interesting. What it gets isn't the main content — it's a text snapshot of the whole page, nav, ads, comments section, all of it.

So it's wasting tokens and interfering with judgment?

Right. So the original post suggests using a hook to trim it before it hits the model. But the trimming order and rules need tuning — it's not that simple.

Alright, that's it for the news. Next, let's dig into this wave of coding tool tutorials on Bilibili.

First is a Claude Code hands-on tutorial — the title literally says 'for real engineers,' with over a thousand engagement points.

There's a reason these tutorials blow up. Docs explain features; engineers want to know how to use it in real projects.

The second one's even bigger — a step-by-step Codex App guide, from install to use, over twelve hundred engagement points, higher than the Claude Code one.

What does that tell you? People aren't picking a tool — they're learning several at once. That itself is a signal.

Wait, doesn't that seem a bit contradictory? The news just said AI-written code has over two thousand vulnerabilities.

Not contradictory — two sides of the same thing. The more these tools spread, the hotter the tutorials, and the faster the security debt piles up.

So do you think these tutorials should cover security practices too?

Absolutely. Otherwise you're teaching people to drive fast without teaching brakes. That Reddit hook idea should really be in the tutorials.

Makes sense. Then the third one's even more interesting — a sophomore built a catgirl companion programming app, fully open source, over five thousand engagement points.

Five thousand plus — more than the first two tutorials combined. See, technical content can't beat emotional value.

You know what, this kind of companion learning might actually solve some of the boredom problem.

It's the right direction, but companionship is just the shell — the core still has to be real skill. Since it's open source, we can check out how it's built.

So why are these topics blowing up right now, of all times?

Because coding tools have hit an inflection point. People aren't asking whether to use them anymore — they're asking how to use them well, and how not to screw up.

To sum up: tool adoption brings tutorial hype and security debt, and security and hands-on practice need to be taught together.

Right — whoever nails both security and experience keeps the users.

Alright, that's it for today. See you tomorrow.