Practical coverage for AI-native builders
What matters when you build and ship software with AI.
BuilderWithin covers AI coding agents, AI app builders, and the workflows behind real products. Follow what changed, what can break, and what to do next, from first prompt to deployment.
What mattered this week for people building software with AI
Read in full Issue 17 / BuilderWithin Weekly · October 31
Issue 17: Cursor finds malicious Claude Code extensions, and Cloudflare reports a customer-data leak
Cursor identifies two malicious Claude Code extension versions. Cloudflare reports a data leak, and Vercel changes how it bills cached data.
Inside this issue
01
Coding Agents Two malicious extension versions, Copilot's model routing, and when to keep approvals manual.
02
Infra & Deployment Cloudflare's leaked responses and when Vercel's cache charges start applying.
03
Product Lower model prices, Mistral's license conditions, and Carbon's limited initial access.
04
Workflow Copilot Projects enters preview, with lessons from prototypes and game playtesting.
Latest coverage: AI coding agents, app builders, and workflows
All articles November 12
Cursor Projects now lets a whole team share one set of agents and context
Cursor Projects now supports teams in beta, with a shared task board, shared specs and docs, and coordinator agents that sync across teammates.
Coding Agents
3 min
November 11
Netlify Server adds a long-running backend for WebSockets and in-memory state, free during Early Access
Netlify Server runs one persistent Node.js backend next to your frontend. It is free in Early Access, with billing and rates still to come.
Infra & Deployment
3 min
November 11
Write the first paragraph of an agent's pull request yourself and fold the rest away
Simon Willison opens agent-written pull requests with a short human summary and folds the full text away. The risk is what that summary leaves out.
Signal Watch
3 min
November 10
Claude Fable 5.2 reaches Copilot and AI Gateway, but Anthropic retains your prompts
Claude Fable 5.2 is in GitHub Copilot and Vercel AI Gateway. It needs data retention, so zero-retention setups are blocked or need an exemption.
Briefings
3 min
November 09
Claude Code's "Don't ask again" can save your password into a file that ends up on GitHub
Apiiro found real secrets in 1,122 public copies of Claude Code's settings.local.json. Check your repos and rotate anything exposed.
Coding Agents
4 min
November 09
Fable 5.2 does expert-level work but misses its own weak output, Ethan Mollick finds
Wharton's Ethan Mollick calls Claude Fable 5.2 "almost AGI" after early access. His tests show its gap is judging its own work, not doing tasks.
Signal Watch
4 min