The compromised packages, listed as versions 2.1.312 and 2.1.313, exfiltrated system metadata like usernames and established reboot persistence during an 11-hour exposure window. Researchers at OpenSourceMalware confirmed that official distributions of the assistant on Microsoft's store, npm, and Open VSX remained entirely safe. Platform maintainers have since disabled the adversary's command server and provided dedicated scripts to sanitize infected environments.
Key points
Enabling SSH requires administrator privileges, which caused the backdoor installation to…: Enabling SSH requires administrator privileges, which caused the backdoor installation to fail on most targeted machines.
Standard uninstallation is insufficient, requiring impacted developers to execute provide…: Standard uninstallation is insufficient, requiring impacted developers to execute provided cleanup scripts to fully sanitize systems.
Affected individuals should manually verify their SSH configurations and promptly delete…: Affected individuals should manually verify their SSH configurations and promptly delete any keys labeled svc-telemetry.
Sources checked by our analysis pipeline: 1
Real Python AI News · Weekly edition · The week of October 31–November 6, 2026
Stop Falling Behind on AI. Catch Up in Five Minutes.
New models, new prices, new agent tools, all the time. Our new AI newsletter gives you the handful of stories you actually need as a developer. Free, straight from the Real Python team.
This week’s news is about trust in AI tools: a coding add-on that hides a trap, a model built to find security holes, and new ways to tell where AI-written text comes from. Here’s each story in plain language.
A Booby-Trapped Claude Code Extension Slips a Backdoor Onto Programmers’ Computers
A trusted name in an app store for programmers turns out to hide a backdoor. The store belongs to Cursor, an app for writing code.
Cursor’s security notice says two versions of the extension for Claude Code, Anthropic’s AI coding assistant, are tampered copies Anthropic didn’t build: 2.1.312 and 2.1.313. They were up for about 11 hours on October 29 and target Windows PCs and Macs.
Prime Minister Sanae Takaichi initiated the response after widespread unauthorized system intrusions compromised domestic businesses and threatened client data. The strategy mobilizes public and private resources to counter advanced threats that are increasingly accelerated by artificial intelligence tools. Initial funding will draw directly from state reserves to immediately fortify national network defenses and support compromised entities.
Budget-conscious virtual reality enthusiasts can secure an entry-level standalone device at a significant discount by purchasing manufacturer-inspected stock through an official online storefront. The promotion lowers the financial barrier for players seeking modern hardware capabilities like full-color passthrough and current-generation processing power without requiring an external computer. Buyers must act quickly, however, as the specialized coupon markdown is scheduled to end on November 8.
The semiconductor manufacturer is strategically positioning itself to address the massive infrastructure demands generated by the artificial intelligence sector. By venturing into silicon photonics, the company aims to establish a foothold in advanced hardware architecture critical for processing next-generation workloads. This initiative reflects a broader industry movement to adapt chip fabrication capabilities for emerging high-performance computing requirements.