At Salesforce Dreamforce, Sam Altman said fear of concentrated AI power is justified and called OpenAI’s Hugging Face sandbox escape its worst accident—an alignment failure as much as a security breach. He said it triggered an industry reset and pushed OpenAI’s Daybreak cyber-defence programme.
New this week under MIT, npx skills add aicodeking/deepseek stack installs SKILL.md workflows such as ds plan loop , ds verify loop , ds review loop and ds best of n that force a DeepSeek powered agent to check each step against real command output, and it works in Claude Code, Codex, Cline, OpenCode and other harnesses. You can also install a single skill with skill , and each one is short enough to read before you let it run (skills.sh listing)…
Released Oct 30 under Apache 2.0, the 9.5 GB model uses one policy to pick, turn by turn, between screenshot grounded GUI actions and a persistent shell, and Microsoft reports 66.0% on OSWorld Verified with a 50 step budget, ahead of some larger open agents. Those scores are Microsoft's own so far, it needs trust remote code=True or the provided SGLang container, and since it can run bash , keep it in a sandbox (project page)…
On Oct 29, malicious Anthropic.claude code 2.1.312 and 2.1.313 for macOS and Windows sat in Cursor's extension marketplace for about 11 hours, adding an attacker SSH key labeled svc telemetry , installing persistence and sending host details; Anthropic says its own systems weren't breached. If you updated in that window, run Cursor's check script, remove the key and persistence (uninstalling isn't enough) and rotate credentials (Microsoft analysis)…
Live since Oct 30 for all Computer users in the Mac and Windows apps, the one time extension lets the agent open sites, fill forms and work across tabs using logins you already have, acting only during a task you start and in the browser you pick under Settings Connectors (Mac) or Settings Permissions (Windows). Comet users don't need it, and since it acts inside signed in sessions, keep an eye on what it clicks (changelog)…
Announced Oct 30, the $200/month Max 20x plan becomes Ultra and the $100 Max 5x becomes plain Max, with no price change; Ultra gets 10x Pro usage per week, $200 a month in API credits, and no five hour session cap once Anthropic verifies the account. Weekly limits (plus a separate weekly Fable limit) still apply across Claude and Claude Code, and you're verified if Settings Usage shows no Current session bar (pricing)…
Spotted something we missed? Start a thread.
