Poisoned dev tools, AI-run hacks and a cold week for AI spending
8 stories~3 min read
- Top storySecurity
Tampered Claude Code extension in Cursor's marketplace planted SSH backdoors (opens in a new tab)
Cursor's marketplace served a tampered Claude Code extension from 09:27 to 20:35 UTC on 29 October, reaching at most 5,000 users. Anthropic's Felix Rieseberg says an attacker used access to Cursor's marketplace, so update to 2.1.314, check for an "svc-telemetry" key and rotate credentials.
- Security
CrowdStrike: China-linked group used AI agents to target 200+ organisations in 11 days (opens in a new tab)
CrowdStrike says a group it calls Vapor Panda ran the ARTEX agent framework, mostly on DeepSeek, against more than 200 organisations, with at least nine confirmed breaches. AI is making mass attacks cheap, so patching speed and detection matter more than ever.
- AI
OpenAI, Google, Microsoft and Anthropic back one robots.txt opt-out for AI training (opens in a new tab)
The four labs will honour one robots.txt token, "__usage_ai-training", from an IETF draft by Anthropic's Kevin Kelley, so site owners get one opt-out switch. Anthropic supports it now, OpenAI follows in the coming months, and Google and Microsoft plan support in 2027.
- Business
Intel has worst day since the 1970s as AI spending worries hit tech stocks (opens in a new tab)
Intel fell 28.58% to $65.76, its worst day since 1974, after weak guidance, while Amazon missed on earnings and posted a $42.4 billion free cash outflow over 12 months. Investors now question AI payback, which can mean tighter software budgets and slower hiring.
- Security
Binance loses about $6.36 billion in hack that analysts tie to North Korea (opens in a new tab)
TRM Labs says about $6.36 billion left Binance wallets on 10 blockchains, mostly in about 20 minutes, and blames North Korea's TraderTraitor; about $3 billion is now frozen. Binance suspects a hacked DevOps laptop, a hard lesson in protecting signing keys and engineer machines.
- Regulation
UK CMA opens competition probe into Meta's terms on using business content for AI (opens in a new tab)
Britain's competition regulator is investigating whether Meta's commercial terms let it take publishers' and advertisers' content for AI and other products without real consent. Meta has paused the new terms. The case could shape how platforms reuse customer data for AI.
- Cloud
Microsoft retires Azure Deployment Environments in February 2027 with no successor (opens in a new tab)
Azure Deployment Environments shuts down on 22 February 2027, and Microsoft Dev Box follows in September 2028. Microsoft tells teams to move to Bicep or ARM templates and CI/CD pipelines, so platform teams should take stock of their environments now.
- Regulation
Meta, TikTok and X lose UK court challenge to Ofcom's online safety data demands (opens in a new tab)
London's High Court rejected the platforms' claim that Ofcom's information requests under the Online Safety Act were too much. Teams that build moderation and trust-and-safety systems for the UK should expect detailed data requests to become routine.