Issue 17: Cursor finds malicious Claude Code extensions, and Cloudflare reports a customer-data leak

Cursor’s malicious Claude Code packages call for checking affected machines and removing the files they installed. Cloudflare’s data leak calls for reviewing sensitive prompts sent to its GLM-5.3 model during the incident. Vercel’s cache migration changes costs and allowances even when existing app code keeps working.

Coding Agents: Check extensions and model permissions

Cursor identifies two malicious extension versions

Cursor’s updated security notice identifies Claude Code extensions 2.1.312 and 2.1.313 for macOS and Windows in its marketplace. Anthropic did not develop these malicious packages, available from about 2:27am to 1:35pm Pacific time on October 29.

The code collected machine details and added an attacker-controlled key that permits remote sign-in to your computer. It installed scripts to keep a connection running. Cursor says enabling remote sign-in needed administrator rights unavailable on most affected machines, preventing that login route. The installed files still require cleanup.

If you installed or updated either version from Cursor during that window, use its Mac or Windows checks for the key labeled svc-telemetry. For an affected machine, disconnect from the network and follow Cursor’s scripts to remove the key, persistent scripts and running connections. From a trusted computer, replace passwords and service-access keys the affected machine could reach, and revoke its active sign-ins. Assess whether to reinstall its operating system from a clean copy. Uninstalling the extension alone may leave malicious scripts running.

Copilot Fusion changes model selection and billing

GitHub’s Copilot Fusion is generally available. It chooses models for a task and can have one review another’s work. You choose an effort level instead of a particular model. Existing auto and HydraFusion selections transition to corresponding Fusion levels.

GitHub bills each model used at its standard rate, with a temporary 30% model-cost discount for paid plans. A task can involve several models, so compare the completed task’s cost rather than assuming the selected effort level has one fixed price.

Assisted permissions still use model judgment. Copilot’s assisted mode automatically approves requests a model classifies as clearly safe in its command-line tool, desktop app and Visual Studio Code. Other requests wait for you; keep manual approval where production credentials or customer data are accessible.

Shared automations bill the repository owner. Copilot Automations pair prompts with triggers, such as new issues, and charge the owner of the code repository. Anyone with repository read access can see them; write access allows edits, so review permissions and monitor charges from frequent triggers.

Sandboxed tools can still read secrets. Anthropic’s srt research preview restricts network access and file writes, but generally permits reads unless you exclude paths. Windows alpha setup blocks listed credential stores, though configuration files can still expose tokens, the secret values services accept to grant access.

Codex fixes a marketplace check. Codex 0.165.0 closes a URL-checking gap that could let marketplace operations connect to a different host from the approved one. Update to 0.165.0 or later before using marketplace integrations.

Infra & Deployment: Review exposed data and new charges

Cloudflare’s prompt threshold does not rule out exposure

Cloudflare reported on October 26 that 155 GLM-5.3 responses on Workers AI contained other customers’ request data. The incident ran from August 27 to September 9. All affected responses followed prompts longer than 681,280 tokens, the small text units models process.

Cloudflare configured the model to accept more text than its available working memory could hold. A serving-software bug let oversized requests read data left by earlier requests. Cloudflare says it patched the engine, restored service September 9 and found no evidence of deliberate exploitation or impact on other Workers AI models.

The threshold identifies requests that received leaked data. It does not establish that shorter requests could not supply the exposed material. If your app used this model during those dates, review the sensitive material you sent regardless of prompt length.

Vercel’s cache bill depends on your team’s migration

Vercel is moving Data Cache to Runtime Cache. A cache saves data, such as a product catalog, so your app can reuse it instead of fetching it again. Existing Next.js caching code keeps working, but migration changes usage allowances and introduces charges on paid plans.

A read or write unit represents 8 KB of data retrieved or stored, so larger cached items consume more units. Vercel’s announcement distinguishes these cases:

• New teams: Teams created on or after October 30 use Runtime Cache by default.
• Existing Hobby teams: Migration is November 29, with 1 million read units and 200,000 write units free monthly across all projects.
• Existing Pro teams: Vercel will notify you of your migration date; usage draws from your $20 monthly infrastructure credit.
• Early migration: Existing Hobby and Pro teams can opt in now, and Runtime Cache pricing applies immediately.

Rates start at $0.40 per million read units and $4 per million write units, varying by region. Check your project’s usage dashboard before migrating early. On Hobby, exceeding the allowance pauses the cache for the rest of the period rather than adding charges. Enterprise teams receive migration details from their account team.

One model setting can affect several features. Vercel’s Virtual Models let you change the model behind a task without republishing your app. Give separate features separate virtual models, and review provider settings so a change for your coding agent does not also alter a customer-facing feature.

GitHub resolved two disruptions. Its October 29 cloud-agent incident included 1 to 2 percent session failures and lasted about two and a half hours. October 30 Actions, Pages and webhook delays lasted roughly an hour and a half, affecting automated jobs, deployments and event notifications.

Product: Model prices and access have different limits

Terra reduces usage prices. OpenAI says GPT-6.1 Terra’s standard API prices, the charges for sending requests from software, are 50% below GPT-5.6 Terra’s. Terra handles images, writing and computer use, meaning operating software through its screens.

Kimi’s model files remain a promise. Kimi K3.1 Pro costs $2 per million input tokens and $10 per million output tokens through Moonshot’s API. Moonshot promises downloadable model files by November 4; their license will determine the terms for running the model yourself commercially.

Mistral’s model files have commercial conditions. Mistral Large 4 is available at $0.70 per million input tokens and $2.10 per million output tokens through Mistral’s API. Its license requires a separate commercial agreement before commercial use if you or an affiliate operates a Model-as-a-Service business, subject to exceptions.

That means providing others access to run or train the model with meaningful control over inputs, settings or training data. The definition excludes embedded end-user features and merely relaying requests to others’ hosted models. Internal use and access through Mistral’s official products are exempt from that separate-license requirement.

Carbon is not a general rollout. Google’s Gemini 4 Carbon announcement limits initial access to selected cyber defenders and trusted partners. Broader developer access is planned, so most builders have no model setting to change yet.

A lower per-token rate does not guarantee a cheaper finished task. Retries and longer reasoning consume more tokens, so compare costs including corrections.

Workflow: Shared context and evidence of judgment

Copilot Projects is available to try. Projects in the Copilot app are in public preview, an early release combining project code, notes and designs for agents pursuing a goal. They return proposed code changes for review, bringing planning material and implementation into the same workspace.

A prototype needs an explanation. Anthropic engineering manager Felix Rieseberg has stopped giving traditional coding interviews and looks for prototypes demonstrating judgment, while acknowledging his replacement interview process remains unfinished. If you are building a portfolio, explain the user problem, your choices and what changed after the first version failed.

Playtesting gives the agent useful direction. Simon Willison built four browser games without reading their code, using prompts including “Make it a LOT more fun.” One person’s enjoyment does not establish general game-design ability, but you can try the feedback loop: play the result, describe what feels dull, and ask for changes.

End of article