vibehacker
News
Cursor Blog ·

Tampered Claude Code extension in Cursor's marketplace planted an SSH backdoor key for up to 5,000 users

On Oct 29, malicious Anthropic.claude-code 2.1.312 and 2.1.313 for macOS and Windows sat in Cursor's extension marketplace for about 11 hours, adding an attacker SSH key labeled svc-telemetry, installing persistence and sending host details; Anthropic says its own systems weren't breached. If you updated in that window, run Cursor's check script, remove the key and persistence (uninstalling isn't enough) and rotate credentials (Microsoft analysis).

Read at cursor.com
Cursor
AI coding agent for building software

More news

View all

Microsoft open-sources Mage-VL-Cowork, a 4B computer-use agent that switches between clicking and bash

Released Oct 30 under Apache 2.0, the 9.5 GB model uses one policy to pick, turn by turn, between screenshot grounded GUI actions and a persistent shell, and Microsoft reports 66.0% on OSWorld Verified with a 50 step budget, ahead of some larger open agents. Those scores are Microsoft's own so far, it needs trust remote code=True or the provided SGLang container, and since it can run bash , keep it in a sandbox (project page)…

Hugging Face (microsoft/Mage-VL-Cowork)

Perplexity Computer can now drive your own Chrome, Edge or Brave through a new extension

Live since Oct 30 for all Computer users in the Mac and Windows apps, the one time extension lets the agent open sites, fill forms and work across tabs using logins you already have, acting only during a task you start and in the browser you pick under Settings Connectors (Mac) or Settings Permissions (Windows). Comet users don't need it, and since it acts inside signed in sessions, keep an eye on what it clicks (changelog)…

Chrome Web Store (Perplexity)

Claude Max 20x is now Ultra, and verified Ultra accounts lose the 5-hour usage limit

Announced Oct 30, the $200/month Max 20x plan becomes Ultra and the $100 Max 5x becomes plain Max, with no price change; Ultra gets 10x Pro usage per week, $200 a month in API credits, and no five hour session cap once Anthropic verifies the account. Weekly limits (plus a separate weekly Fable limit) still apply across Claude and Claude Code, and you're verified if Settings Usage shows no Current session bar (pricing)…

Claude Help Center

LM Studio adds the open-source oMLX engine, so Apple Silicon Macs can run MLX models you already have

Shipped Oct 29 in Bionic 1.1.10, oMLX is a downloadable engine built with its creator @jundotkim and Hugging Face that loads your existing MLX models without re downloading them, bringing the project's continuous batching and SSD caching for Apple Silicon (GitHub). The same release adds speculative decoding for MLX models and makes the in app terminal available in public builds…

LM Studio Changelog

Spotted something we missed? Start a thread.