1. Backdoored Claude Code Extension Hits Cursor Users
A tampered copy of Anthropic’s Claude Code extension was served through Cursor’s extension marketplace for about 11 hours on October 29, reaching up to 5,000 developers. The build planted an attacker SSH key, tried to open a reverse tunnel, and set up persistence that survives uninstalling the extension. Cursor pulled it, shut its marketplace, and rotated keys; how attackers gained publishing access remains unknown.
Source: DJC Roman — https://djcroman.com/posts/cursor-claude-code-extension-backdoor
2. SEC Scrutinizes AI Disclosures Amid Bubble Fears
The SEC is examining AI companies’ corporate disclosures as investor worries grow over a potential AI bubble fueled by circular deals, enforcement director David Woodcock told Reuters on October 30. Big Tech stocks sold off this week as firms disclosed heavy cash burn for AI expansion. Woodcock said enforcement will follow where material risks are not disclosed, and warned AI has made scams cheaper to run at scale.
Source: Reuters — https://www.reuters.com/legal/government/us-secs-top-cop-says-agency-is-monitoring-ai-corporate-disclosures-2026-10-30/
3. AI Labs Back Shared Training Opt-Out Signal
OpenAI, Google, Microsoft and Anthropic said October 30 they will honor a single robots.txt policy token, __usage_ai-training, letting websites opt out of AI training across all four companies at once. The move replaces separate per-crawler rules with one declaration, though timelines differ — Microsoft starts February 1, 2027, Google aims for 2027, and OpenAI says “coming months.” The signal is voluntary and covers training only, not crawling or search.
Source: PPC Land — https://ppc.land/google-microsoft-openai-and-anthropic-back-one-ai-training-opt-out/