AI Brief, 31 October 2026: eleven hours in the marketplace, and twelve to a working exploit

Two separate attacks on the working developer's toolchain landed inside a day, and they arrived from opposite directions. One was a person using a marketplace. The other was a model, running unattended, turning published security fixes into working browser exploits.

Cursor disclosed on 29 October that a maliciously modified build of Anthropic's Claude Code extension had been served from its own extension marketplace "between about 2:27am PT and 1:35pm PT" — roughly eleven hours. The affected versions are anthropic.claude-code 2.1.312 and 2.1.313 for macOS and Windows, and Cursor says plainly that they "were not developed by Anthropic". Microsoft Security published a code-level analysis on the 30th confirming Anthropic's "systems were not compromised", and that the package was "never published nor distributed from Microsoft Visual Studio Marketplace" or the npm package. Secondary reporting puts the reach at up to 5,000 users. The independent write-up that carried the story took 839 points and 505 comments on Hacker News, the loudest item of the window by a wide margin. What nobody has published — not Cursor, not Microsoft, not Anthropic — is how the package got into the marketplace in the first place.

The second item is a measurement rather than an incident. Epoch AI published work on 29 October showing that GLM 5.3, Z.ai's open-weight model, built working exploits against six of six Firefox releases by reading the security fixes that were already public in Firefox's source but had not yet shipped to users. Given a target version, public information available at that version's release, and no internet access, the model picked the vulnerabilities and chained the exploit itself. The fastest run took 12 hours; the marginal cost was about $1,000 per Firefox version. The researchers note they "did not trigger any safeguards or refusals from any provider, including Z.ai".

Those two stories bracket the same week that Wiz has started calling "Black October", and they prompted a public change of position worth reading. Nathan Lambert, who argued in September that an open-weight frontier release would be "fine" on cyber risk and that safety-community warnings were overstated, published a partial retraction on the 30th, conceding that "fine" was not the right word and that the shift amounts to a costly, turbulent "forced industry update" to how software is maintained. He still holds that closed models have featured more heavily in the actual breaches, and that the trend tracks capability and diffusion rather than the open-versus-closed question.

• A tampered Claude Code extension build was live in Cursor's marketplace for about eleven hours on 29 October; versions 2.1.312 and 2.1.313, up to 5,000 users, and no disclosed root cause.
• The implant runs at module load, before the extension activates, and installs an SSH key plus platform persistence. Cursor warns that "uninstalling the extension may not be sufficient."
• Epoch AI measured GLM 5.3 building file-reading exploits against six of six Firefox releases from 17 September to 26 October, fastest in 12 hours at about $1,000 per version.
• The same harness on Chrome spent about $100,000 and produced no equivalent exploit, which the authors explicitly decline to call evidence that Chrome is safe.
• Microsoft published Apache-2.0 weights for a 4B computer-use agent scoring 66.0% on OSWorld-Verified, its own measurement, with no independent number yet.
• Someone finally built on Qwenputer, flagged here on the 29th as unreproduced: a working NES emulator compiled into 466.6M Qwen-architecture weights.

The code that ran before the extension did #

The mechanism is the part worth understanding, because it defeats the mental model most people have of an editor extension. The malicious build prepended an immediately-invoked function expression to the top of the minified extension.js. That runs when Node loads the file — before the extension's activate entry point, which is the hook a user's action would normally trigger. Installing the extension was sufficient. Opening a project, approving a prompt, running the agent: none of it was required.

What it then did, per Microsoft's analysis and an independent teardown, was append an attacker's Ed25519 public key to ~/.ssh/authorized_keys under the comment svc-telemetry, attempt to enable the local SSH service, open an outbound reverse tunnel so the inbound path works from behind NAT, and write platform persistence — a LaunchAgent on macOS, a @reboot crontab entry on Linux, a scheduled task or Startup-folder batch file on Windows. A delayed beacon then sent host details and up to 40 environment-variable names matching KEY|TOKEN|SECRET|PASS|AWS|GCP. Names, not values: this was reconnaissance for a later visit, not a smash-and-grab.

The consequence is the line in Cursor's notice that matters most operationally. Removing the extension removes the extension. It does not remove an authorized key, a LaunchAgent or a crontab entry. Anyone who ran either version on macOS or Windows during that window should check the artifacts directly:

# The appended key, by comment and then by published fingerprint
grep -F 'svc-telemetry' ~/.ssh/authorized_keys
ssh-keygen -lf ~/.ssh/authorized_keys | grep -F '0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk'

# macOS persistence pair
ls -l ~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt

Cursor says it "audited access and confirmed no other extensions were tampered with", rebuilt its marketplace, and published remediation scripts. The gap in the public account is provenance. An extension marketplace serving a package its stated publisher did not build has either an authentication failure or an ingestion failure, and those have very different blast radii. Until someone says which, the only safe assumption is the wider one.

The patch gap, measured #

Epoch AI's report targets a window that has always existed and has always been assumed too expensive to exploit at scale. When a browser fixes a memory-safety bug, the fix becomes visible in public source before the stable build carrying it reaches users. Firefox deliberately describes such commits as routine improvements. The gap is the interval in which a fix is readable and users are still unprotected.

The setup was deliberately unglamorous. Ubuntu 26.04 with default settings, official Firefox builds, no network access, and only the public information available when each version shipped — designed, the authors write, to approximate "a relatively unsophisticated actor with limited resources". The six releases were 156.0, 156.0.1, 157.0, 157.0.1, 158.0 and 158.0.1. The outcome in each case was a web page that reads a local file and sends it to a server, with no interaction beyond visiting it.

Two numbers carry the argument, and they are the ones to hold onto. Total research spend "exceeded $100,000", covering the offline environment and preliminary work. The marginal cost of the next Firefox version was about $1,000. Six releases across 17 September to 26 October is a release roughly every 6.5 days, so a 12-hour build leaves about six days in which the exploit works against the browser people are actually running — on Epoch's figures, on the order of $170 per day of live exposure, once the one-time cost of learning how is already paid. The research cost amortises. The per-target cost does not.

Three caveats belong with it, and Epoch states all three itself. The chain needed two vulnerabilities, not one: the patch-gap bug gave code execution inside the web content process, and a previously unpublished bug, which the model rediscovered on each attempt, bypassed the sandbox to reach the filesystem. That second bug was reported to Mozilla and is patched in Firefox 159.0 (27 October, advisory mfsa2026-118), and the authors have not confirmed whether 159.0 still falls, suspecting only that it is "at least substantially more difficult". The only achieved outcome was file reads; there were no code-execution successes on recent releases. And Kimi K3.1 Pro was not tested, though the authors cite benchmark data suggesting it may be stronger at offensive work.

This connects to something this brief has been chasing. The 22 October edition covered the PHP emergency release and asked whether any exploit, transcript or timing measurement would ever be published for the model-assisted work attached to it. That specific measurement still has not appeared — but Epoch's report is the first thing in this corpus to put an independent, reproducible number on model-built exploitation of any kind, and Lambert's reversal cites both it and PHP2Shell as what moved him.

A 4B agent that decides when to stop clicking #

Away from the security story, Microsoft published Mage-VL-Cowork at 2026-10-30T12:13:24Z under Apache 2.0: a 4B computer-use agent, 9.50 GB across two shards, built on a Mage-ViT encoder and a Qwen3-4B-Instruct-2507 backbone. At 36 likes and no recorded downloads some seventeen hours after the commit, with no press coverage found, it is the quiet end of the day — and the only novel first-party model release in the window.

The design idea is channel choice. Most computer-use agents live entirely in pixels, which means re-deriving a structured file edit through dozens of clicks and paying thousands of tokens per screenshot. Mage-VL-Cowork carries two action channels in one policy, with no external router: a computer_use channel of 11 GUI primitives in normalised [0, 999] coordinates, and a bash channel with a persistent shell. Each turn is a three-part structure, and the routing decision is the model's:

This is 50 rows of formulas. Clicking each cell is the wrong channel.
Action: Write the SUM formulas into D2:D51 with openpyxl, then screenshot to confirm.
{"name": "bash", "arguments": {"command": "python3 - <<'PY' ... PY"}}

It also throws away most of its own history on purpose. The context window in use is 32,768 tokens, against an architecture that supports 262,144, and the model keeps an asymmetric sliding window: the 3 most recent screenshots and 4 most recent full responses in full, with everything earlier folded into single-line Action: summaries. That is a deliberate bet that an agent needs to see only the last few UI transitions while needing to remember the whole task.

The headline figure is 66.0% on OSWorld-Verified — reported as a two-run average, 65.33% and 66.75%, over 361 held-out tasks excluding Google Drive, under a 50-step budget. Across the five-stage curriculum the score moves 45.56% → 55.84% → 66.04%, and the final online RL stage is the interesting one: it adds +10.16 points while reducing mean model calls from 21.57 to 18.77 and output tokens from 7,374 to 5,499, a 25.4% cut. Against GPT-5.4-mini's 69.57% it uses comparable turns (18.77 against 18.24) and 55.6% fewer output tokens.

The honest reading of that chart is narrower than "best open computer-use agent", and Microsoft's own table says so: ScaleCUA-Qwen3.5-9B scores 68.7%, higher, and the card bolds it. The claim being made is best at the 4B scale, where the relevant comparison is Fara1.5-4B at 13.9%. That is a large gap at equal size, and the chart's real lesson is that parameter count does not order this benchmark: a 4B model sits above a 27B and a 72B one.

Everything here is self-reported. There is no arXiv entry — the technical report is a PDF committed to the Mage repository at 2026-10-30T07:54:49Z — and with no downloads recorded yet, no third party has run the benchmark. One ablation deserves independent attention if anyone does: holding the teacher model fixed, pruning the teacher's harness rather than enriching it (dropping xdotool and accessibility-tree dumps, pre-installing openpyxl and python-pptx) lifted the 4B student from 25.1% to 37.6%. If that holds up, the cheapest available gain in agent distillation is removing tools rather than adding them.

Also notable #

• Qwenputer has a successor, two days after this brief said nobody had tried. The 29 October edition flagged that a week had passed with no reproduction. On the 30th at 16:40 UTC, Drew Breunig published nesformer — a 6502 CPU, 2 KB of work RAM and a cartridge ROM compiled into 466.6M Qwen3.5-architecture weights, using the Gated DeltaNet state as addressable memory. 215 points on Hacker News, and Simon Willison linked it the same evening. Of 466.6M parameters only 9.3M are nonzero, so the checkpoint zips to 3.3 MB. A full-game run matched all 210 saved frames across 2,645,885 tokens. It runs 150–290× slower than the console, 1 to 6 seconds per frame. Two honest qualifications: it is MIT-licensed but reuses Qwenputer's compiler and credits Divyansh Agrawal, so it extends the method rather than independently checking the original's numbers; and it is NROM-only with no sound.
• An IETF draft is now the vehicle for AI training opt-outs. OpenAI said on 30 October at 09:30 UTC that it will honour a common robots.txt signal, pointing at draft-kelley-aipref-training-preference-signal in the IETF's AI Preferences working group and drawing on draft-ietf-aipref-vocab. Worth reading precisely: the post names only OpenAI, describes "this voluntary effort", and commits to implementing "in the coming months" with no date. Reporting that Google, Microsoft and Anthropic have committed is secondhand; OpenAI's own document says only that it joins "other participants in the working group".
• trl 1.17.0 shipped at 2026-10-30T05:42:15Z with single-node eight-GPU fine-tuning for Mistral Large 4, whose weights this brief covered yesterday — about fifteen hours from a 1,060 GB checkpoint landing to a trainer that fits it on one node. It also flips an AsyncGRPO default to centre scores, and now requires top_k to be set when top_p or min_p is used with vLLM importance sampling, so existing GRPO configs can change behaviour silently on upgrade. A patch, 1.17.1, followed nine hours later.
• Google says its first data-centre satellite is operating, running Gemma 4 inference in orbit under Project Suncatcher after an October launch. The capability claims are Google's own and there is no published throughput or power figure, which is the whole engineering question.
• The financing picture tightened. Reporting in the window puts OpenAI's round at roughly $20 billion at a $1.25 trillion valuation, down from a target near $30 billion at $1.4 trillion, with only part committed; Intel fell 28.58%; and Baseten is reported raising about $2 billion at $26–30 billion against $13 billion in June. All secondhand sourced reporting, no primary filings. Against it, DoorDash said it has received only "several hundred" orders from AI agents.
• Unconfirmed, and flagged as such: a claim that a Claude model autonomously selected a gene therapy and directed a mouse-brain procedure is circulating from a single researcher's social post, with a technical report promised and no preprint. One line is all it earns until there is a document.

What to watch #

• Whether anyone states how the tampered extension reached Cursor's marketplace. Cursor has published the window, the versions, the indicators and remediation scripts, and has said no other extension was affected — but not the provenance. A compromised publisher credential and a flawed ingestion path imply different risks for every other extension anyone installs, and only Cursor can say which it was.
• Whether Firefox 159.0 resists the Epoch chain, and whether anyone tests Kimi K3.1 Pro. The sandbox-bypass bug is patched, the authors have not re-run against 159.0, and the model they flagged as possibly stronger at this work went untested. The report is CC BY 4.0 with the method described, so both are checkable by a third party.
• The first independent OSWorld-Verified number on Mage-VL-Cowork. Apache-2.0 weights, a named harness and a stated 50-step protocol make 66.0% cheap to falsify, and the 361-task denominator excluding Google Drive needs stating by whoever tries. The figure worth more is the teacher-harness pruning ablation, which is a claim about method rather than about one checkpoint.
• Still open: Kimi K3.1 Pro weights remain absent with four days to the promised 4 November, and no repository is reserved under moonshotai — flagged here on the 24th. Voxtral 3 weights are still missing, flagged every day since the 21st; MiniMax has published no unquantised M3.1 Flash reference, flagged since the 23rd; Nanbeige4.3-33B still has no independent score, flagged on the 26th; and no decision-model vendor has published a fail-open rate, asked here daily since 10 October and now twenty-one days.