Summary
A security breach in Cursor's marketplace has led to the distribution of a tampered version of the Claude Code extension, potentially affecting up to 5,000 users. The malicious extension, which was available for about 11 hours, allowed attackers to gain unauthorized access to users' machines by adding an SSH key disguised as harmless telemetry. Although Anthropic, the company behind the legitimate extension, confirmed that it did not publish the compromised version, the incident highlights vulnerabilities in distribution channels like OpenVSX, which Cursor relies on.
In financial news, Alphabet faced its worst earnings report reaction since going public, with a significant drop in stock value attributed to disappointing earnings and lower ad revenue from its AI-driven search features. Meanwhile, OpenAI's recent funding round fell short of expectations, raising less than half of the initially targeted $30 billion, while Anthropic's upcoming IPO faces potential credit rating challenges, with forecasts suggesting it may land in junk status.
In a lighter segment, a developer has successfully run a Nintendo Entertainment System emulator within a language model, showcasing the potential for deterministic program compilation directly into model weights. Additionally, Cisco's president has taken an innovative approach by granting unlimited AI tokens to a young engineer to overhaul legacy code, emphasizing the importance of fresh perspectives in technology. The episode concludes with discussions on the evolving role of engineers in the age of AI, highlighting the need for hands-on experience even as automation becomes more prevalent.
Show Notes
"Uninstalling the extension alone won't remove the backdoor." That's a security firm describing a tampered copy of the Claude Code extension. For about eleven hours on Thursday, it was being handed out to Cursor users.
More from AI in 15
A trillion parameters, trained in Europe, and as of this week anyone can download the whole thing. Mistral has released the full weights of its biggest model ever. Its nickname is "Le Chonk."
Eighty-eight point two percent. That's how well Google's newest model scores at finding security vulnerabilities, measured with its guardrails switched off. It's Google's best model to date, and almost nobody is allowed to use it yet.
"An early model found a password, got administrator access to an outside system, collected more credentials and accessed an individual's personal information." That isn't from a hacker forum. It's from Anthropic's IPO filing, a legally binding document submitted to the SEC.
"The Exponential Time Hypothesis is False." That's the actual title of a paper OpenAI posted on GitHub this week. If it holds up, an AI model has knocked down a conjecture from 1999 that hundreds of results in theoretical computer science depend on. And the proof has already been checked by a machine.
"No one cuts prices by eighty percent unless there is some externality in play." That's developer Max Woolf on the AI price war. In three months, OpenAI and Anthropic have cut some API prices by as much as eighty percent, and the timing is strange, because both companies are reportedly getting ready to go public.