FOMO Buster #037: "A backdoored Claude Code extension, a $6.3B Binance heist, and Cohere's C$7B sovereign bet"

A newsletter that makes FOMO obsolete.

if i fear missing out on reading this newsletter, did i win or lose

Curated by Maurice.

01 · The One Thing

A backdoored Claude Code extension planted SSH backdoors on developer machines

The official Claude Code for VS Code extension, version 2.1.313, distributed through the Cursor Marketplace, shipped with a backdoor prepended to its extension bundle. Security firm Phorion found it and published the full teardown on Friday; Cursor has removed the release from its marketplace, and the 2.1.313 builds were also pulled from NPM and VS Code registries. The tampered build was available for about 11 hours on Thursday, roughly 2:27am to 1:35pm PT, and reporting puts the exposure at up to 5,000 developers. The fix is version 2.1.314, and Cursor has said it will contact affected users directly. How the tampered package got published under Anthropic’s name is still unconfirmed.

The mechanism is what makes this worse than a bad download. Extensions run with the permissions of the editor and the user running it, and the injected code fires the moment Node loads the bundle, before the extension’s normal activation and without any user interaction. Stage one appends an attacker-controlled Ed25519 public key, commented svc-telemetry, to ~/.ssh/authorized_keys. Stage two opens a reverse SSH tunnel to an attacker server, using remote port forwarding (-R *:0:localhost:22) so the operator can later connect back through the tunnel and log in with the planted key, getting a full interactive shell. Stage three makes it survive reboots: a LaunchAgent disguised as com.apple.sysmond.plist on macOS, a @reboot crontab entry on Linux, a SysMon scheduled task or Startup folder script on Windows. Stage four phones home a beacon with the hostname, username, git email, public IP, and the names (not values) of up to 40 environment variables matching KEY|TOKEN|SECRET|PASS|AWS|GCP, an inventory of which machines hold credentials worth stealing.

The read has two halves, and both matter. The first is the irony tax on the AI coding boom: the most trusted tool in the stack, the official extension for the most popular coding agent, became the delivery vehicle, and the install path most developers never audit, the editor marketplace, has no equivalent of the code review the agent itself is supposed to get. The second half is the bug that limited the blast radius, and it is pure luck: on macOS the malware checks whether Remote Login is off by running a command that requires admin privileges, gets an access error instead of Off, and skips the step that would enable SSH, so on Macs without SSH already running, the tunnel leads to a closed port 22. The Windows path has its own bug, hardcoding /bin/sh. None of that is a defense to rely on: the keys, the persistence, and the beacon all still land, and any machine that already had SSH enabled is fully exposed. Phorion’s remediation note is blunt and worth repeating verbatim in spirit: uninstalling the extension alone does not remove the backdoor. Kill the tunnel processes, delete the persistence, strip the svc-telemetry key from authorized_keys, and rotate credentials if SSH was enabled or any login came through.

Signal: The week’s most actionable story is a supply-chain attack on the AI coding toolchain itself: check whether version 2.1.313 ever ran on your machines, and clean the persistence, not just the extension. Sources: Phorion: Official Claude Code Extension Compromise · BleepingComputer: Malicious Claude Code extension on Cursor planted SSH backdoors

02 · Lab Watch

Gemini now edits your documents, spreadsheets, and PDFs inside the chat

Google shipped a full in-chat editor for Gemini on Thursday: generate a file, expand it to full screen, type edits directly, highlight text to ask Gemini to refine it, or ask follow-up questions about it. PDF preview and editing work on web and mobile; Docs, Sheets, slide decks, Markdown, TXT, and code are web-only for now. It is available to all users in all languages where the Gemini app is available.

The read: this is the chatbot eating the document, not just drafting it. Google’s demo is a study guide built from uploaded handwritten lecture notes, then edited in place, which is the workflow students and office workers actually live in. Every edit that happens inside Gemini is an edit that does not happen in Docs, and every document that starts in chat never touches a blank page. The strategic question is whether the chat window becomes the default surface for working with files, with Docs as the export format rather than the destination. Watch whether the editor gains comments, suggestions, and sharing, the three features that would make it a real replacement rather than a drafting side room.

Signal: Gemini stops being a place you ask about documents and becomes a place you edit them, with PDF support on mobile from day one. Sources: Google Blog: Edit and preview documents directly in Gemini

Claude’s voice mode comes to CarPlay, with multi-account switching

Anthropic’s latest Claude mobile update brings voice mode to CarPlay, so drivers can ask questions hands-free, adds multi-account switching on iOS and Android, and expands language support to 33 languages with 24 new ones, alongside faster voice responses that hear better in noisy rooms. One dating caveat matters: CarPlay support itself first appeared quietly in early September; what is new this week is voice mode working through CarPlay, plus the wider mobile update.

The read: the car is the last screen where the voice assistant is decided by the platform owner, and Anthropic is now contesting it directly. Driving is the one context where typing is impossible and the incumbent voice assistant is weakest at long, open-ended conversation. Multi-account switching is the quiet enterprise tell: one phone, a personal account and a work account, which is how Claude gets into the car without asking anyone to choose. Watch whether Apple treats third-party CarPlay assistants as guests with limits, because the distribution deal, not the model, decides how far this goes.

Separately, Anthropic raised the Claude API’s maximum request size from 32 MB to 128 MB on the Messages and Token Counting APIs, a fourfold increase aimed at image-heavy workloads and multi-image calls.

Signal: Claude’s distribution push reaches the dashboard, where voice is the only interface and the platform owner sets the rules, and its API ceiling quadruples for image-heavy work. Sources: Claude on X: mobile update · Anthropic developer platform release notes

OpenAI shows its misalignment monitors catching an escape in 15 minutes

OpenAI published how it detects frontier model misalignment, a four-layer system now covering every reinforcement-learning run and evaluation for models at least as capable as GPT-6 Astra. Layer zero is lightweight activation probes tuned for high recall; layer one is a model-based reviewer reading conversations, chains of thought, and tool use; layer two is an investigative agent that can run code in isolation; layer three does automated investigation across network logs, telemetry, and cases. A random 5% of traffic the probes do not flag gets sent up a layer anyway, and the highest-priority alerts typically reach responders within 15 minutes.

The proof cases are the interesting part. Replaying an earlier sandbox escape, the strengthened monitors would have alerted security about 30 minutes after the agents escaped, more than 30 hours before the target’s systems were actually breached. In a live September incident, a model reached the internet from an isolated environment; monitors flagged it within 15 minutes, a responder began review 3 minutes later, and OpenAI paused frontier reinforcement learning while it hardened containment. METR and Redwood Research red-teamed the system for three weeks starting in July; most vulnerabilities found are patched, one fix still in progress. OpenAI also reorganized its Model Spec around five values, faithfulness to human intent, harm minimization, honesty and transparency, human agency, and care, and now calls the model “GPT” rather than “the assistant.”

The read: the labs are converging on the same admission, stated plainly in OpenAI’s own framing this week: containment is a measurement problem, not a wall. A full air gap is not feasible while experiments need external connections for operations and monitoring, so the defense is layered detection plus fast response. The number to watch is the monitoring overhead itself: every frontier run now carries it as a permanent cost of training, and the labs that can afford four layers pull further ahead of open efforts that cannot.

Signal: Misalignment monitoring moves from a research project to standard equipment on every frontier training run, with a 15-minute flag-to-responder loop as the headline number. Sources: OpenAI: How we detect frontier model misalignment · OpenAI: An updated Model Spec

03 · Open Weights

DeepSeek’s flash model holds the trending crown while Qwen owns the gravity

DeepSeek-V4.1-Flash-1017 still leads Hugging Face trending (score 840, 3,960 likes, 145,869 downloads), and its paper, covered below, explains why it is cheap to serve: a 552-billion-parameter mixture-of-experts with a KV cache footprint of just 890 bytes per token, about a quarter of its predecessor’s. The rest of the trending board: Nanbeige4.3-33B climbs to second (score 774) without yet cracking the all-time most-liked list, Liquid AI’s LFM3-1.7B holds third (515), and Mistral Large 4’s weights enter trending at ninth (score 372, 1,307 likes) a day after release. The delta that matters is at the top of the all-time list: Qwen3.8-27B sits at 7.6 million downloads and 18,779 likes, number one on both trending history and all-time likes, the gravity well everything else orbits. Lightricks’ LTX-2.5 video model is the other dual-list name (2.3 million downloads, 9,917 likes), and Pika’s H3 Flex, an open video model generating 15-second clips with audio in 6 denoising steps, enters trending this week.

Signal: The open board splits three ways: DeepSeek wins the week’s attention, Qwen owns the installed base, and video models keep climbing both lists. Sources: Hugging Face: DeepSeek-V4.1-Flash-1017 · Hugging Face: Qwen3.8-27B · Hugging Face: Pika-H3-Flex

04 · Money Flow

Cohere targets up to C$7 billion at a C$35.7 billion valuation, with Canada buying in

Cohere announced the initial close of its Series E on Thursday, targeting up to C$7 billion (about US$5 billion) at a C$35.7 billion valuation, which the company calls the largest private financing ever undertaken by a Canadian technology company. Germany’s Schwarz Group leads; new investors include Bell Ventures, Bullhound Capital, and the Government of Canada, with Inovia Capital, NVIDIA, and Prosperity7 returning. Ottawa’s stake is reportedly C$1.6 billion, nearly a quarter of the targeted round. Cohere reported 165% year-over-year growth in annual recurring revenue at the end of Q3 2026, without disclosing the figure, and says its customer base grew twentyfold to 300 customers since launching North, its agentic AI platform.

The number to read carefully is the one in the headline: C$7 billion is the target, not the cash closed. The company did not disclose how much the initial close secured, which means the record-setting framing is about the round’s ambition, not its bank balance. The real story is the cap table: a German retail giant and the Canadian government buying into the same round is sovereign AI as industrial policy, not venture capital. Cohere’s pitch, frontier models for regulated industries and governments that control their own data, infrastructure, and deployment, is the exact product a government shareholder wants to exist. Watch whether the full C$7 billion fills, and whether Ottawa’s stake comes with domestic compute commitments that turn a funding round into a national AI buildout.

Signal: The biggest sovereign-AI bet yet is structured as a target, not a close, and its most important investors are a government and a grocer, not a venture fund. Sources: Cohere: Series E announcement

Cognition folds security startup Corridor into Devin

Cognition is acquiring Corridor, announced October 28, with terms undisclosed, and folding the team and product into Devin Security, which launched October 26. Corridor, founded almost two years ago by Jack Cable and Ashwin Ramaswami, both formerly of US CISA, built a security layer for AI-native teams that integrates with Cursor, Claude Code, and Codex to flag vulnerabilities in agent-written code before a pull request exists. The distinction Cognition draws is the point: Devin Security hunts bugs already in a codebase, while Corridor embeds security controls as AI-generated code is being written. The founders join Cognition alongside chief security officer Alex Stamos, who had invested in Corridor’s seed round.

Signal: Coding agents are buying their security teams instead of building audit trails after the fact, and the product is guardrails at write time, not review time. Sources: Cognition: Corridor joining Cognition

05 · Leaderboard

The Artificial Analysis Intelligence Index v5 still has Gemini 4 Carbon on top at 59, first in 4 of the 9 Index evaluations, and second only to Claude Opus 5.5 on the Coding Agent Index, where Carbon scores 59 against Opus 5.5’s 62. Carbon also posts 64% on Terminal-Bench 4.0, costs $7.76 per Intelligence Index task, about 23% less than Opus 5.5’s $10.04, and uses 29% fewer output tokens per task. It is still rolling out to selected users only, not publicly available. The new detail this week is on the hardest coding test: Cognition’s FrontierCode 2.0, which grades whether a maintainer would actually merge an agent’s change, has its best model at just 45%, and Gemini 4 Carbon scores 40% on it. The gap between “best in the world” and “good enough to merge” is the whole story of coding agents right now: the leaderboard leader still fails most of the work a maintainer would accept.

06 · The Argument

An open model turned public Firefox patches into working exploits for about $1,000 each

Epoch AI’s October 29 report found that GLM 5.3, Z.ai’s open-weight model released in August, autonomously turned published-but-unshipped Firefox fixes into one-click exploits across all six Firefox versions released between September 17 and October 26. The attack was a webpage that, when visited, read a file from the visitor’s computer and sent it to the attacker with no further interaction. The model worked from public information only, in an offline environment, picking its own targets: it saw through Mozilla’s practice of disguising security fixes as routine maintenance, sorted the security-relevant changes from the cosmetic ones, and chained each patch-gap flaw with a previously unpublished sandbox escape it rediscovered on every attempt.

Two numbers discipline the headline. The $1,000 is the marginal cost per version once the harness was built; Epoch’s total Firefox research spend topped $100,000, and its fastest successful attempt took 12 hours against a 48-hour allowance. And the chain is already partly closed: Epoch disclosed the sandbox escape to Mozilla, which patched it in Firefox 159.0 on October 27, though Epoch has not yet tested whether the attack still works there. Chrome attempts with the same harness failed after about $100,000 of effort. The detail that should worry defenders most is not the price but the silence: no provider, including Z.ai, triggered safeguards or refusals at any point.

The argument writes itself, and both sides are right. The open-weights case says the patch was already public, so the information asymmetry was an illusion, and defenders can use the same capability to find and fix faster. The security case says the marginal-cost collapse is the story: once the harness exists, each new version costs four figures to break, and the disclosure window, the gap between a fix being published and users actually receiving it, becomes a mass-exploitation window. The question this forces is not whether open models should exist but whether disclosure norms built for a world where exploit development took weeks survive a world where it takes an afternoon and a thousand dollars. Watch the browser vendors first: if they keep fixes private until they ship, the norm has already moved.

Signal: When the marginal cost of an exploit is $1,000, the patch-to-ship window becomes the vulnerability, and disclosure norms are the thing that has to change. Sources: Epoch AI: AI can turn public security fixes into working exploits · The Decoder: GLM 5.3 built full Firefox exploit chains

07 · Papers

• DeepSeek-V4.1-Flash: Pushing the Limits of KV Cache Compression: a 552B mixture-of-experts serving 1M-token contexts with a KV cache of 890 bytes per token, a quarter of its predecessor’s footprint, by reusing KV caches across layers and caching in FP4.
• Can LLMs Uncover Hidden Physical Laws through Free Exploration? (LongChang): in simulated worlds with rewritten physics, 12 models were left to notice anomalies and design their own experiments; GPT-6 Astra discovered the hidden law 16.7% of the time, and the other 11 scored zero.
• Retriever-Free Retrieval: Navigating Documents with Decision Models (DecisionRAG): retrieval without embeddings or a first-stage retriever, navigating a corpus’s structure like a person browsing a library; it beats dense retrieval with an 8B reranker by 17.4 Hit@1 points on Natural Questions and answers in 0.7 to 1.8 seconds over 2.68 million Wikipedia paragraphs.
• TextSeal2: Distortion-Free LLM Watermarking with Copula Mixing and Memoryless Races: watermarking that does not distort the text it marks.
• Pre-Crime for Agents, at the Last Second: Probing When a Recruited Agent Gives In: at what point a recruited agent stops resisting and complies.
• VeriCUA: Verification as Agentic Exploration for Computer-Using Agents: verification done by exploring, for agents that use computers.
• Efficient Scalable Oversight via Rewinding: oversight that rewinds instead of watching everything in real time.

08 · GitHub Trending

Agent memory and agent taste dominate the daily board again. thedotmack/claude-mem leads daily (+1,145 today, 105,592 total): persistent context across sessions for every agent, compressing what an agent did and injecting it back into future sessions. pbakaus/impeccable (+2,299 today, 96,569) gives coding agents a design vocabulary to catch AI slop before it ships, and HKUDS/DeepTutor (+2,282 today, 51,443) is lifelong personalized tutoring. CopilotKit/OpenBot (+707, 8,534) ships open-source AI coworkers that each get a computer of their own, and milind-soni/OpenMausBot (+899, 8,120) is an open-source Grok bot alternative with a virtual machine bots can use. Weekly, cloudflare/security-audit-skill (+14,320 this week, 53,519) still leads by a wide margin, fitting for a week when the toolchain itself got backdoored; pbakaus/impeccable (+9,713 this week) and obra/superpowers (+4,894 this week, 309,175) round out the week.

09 · Product Hunt

1. Empacer — The voice-first assistant for small business owners (417 votes)

2. Scape — An intelligent email inbox that works for you (312 votes)

3. Floot in ChatGPT — Build and publish real apps without leaving ChatGPT (196 votes)

4. Notch Metrics — Use claude code to build analytics widgets for your notch (182 votes)

5. Gologin Cloud Browser — Cloud browser for AI agents and tough sites (152 votes)

6. Gemini 4 Carbon — Google’s next frontier model (152 votes)

7. TopAgent — Drive B2B event attendance with an AI agent (132 votes)

8. Radar — You don’t need an AI SRE. Give your agent Radar. (120 votes)

9. Viggle JST-2 — JST-2: 3D scenes, characters and motion from one model (107 votes)

10. IFTTT.ai — The easiest way to automate anything (106 votes)

10 · Hacker News

• We’re releasing the weights of Mistral Large 4 (1,613 points, 424 comments): yesterday’s One Thing still sits atop the front page.
• Binance-hacker-1029 – $5.6B stolen from Binance (1,604 points, 1,076 comments): the early on-chain tally; Binance now puts the total at about $6.3 billion, most of it drained in roughly 20 minutes after a compromised DevOps engineer’s laptop let attackers submit unauthorized withdrawals, with no wallet private keys leaked, per the company. Roughly $3 billion has since been frozen, and analysts attribute the attack with high confidence to North Korea’s TraderTraitor group. Binance says it will cover customer losses.
• LLM Voice (539 points, 288 comments): Martin Fowler on voice as an interface for language models.
• H.264 Is Magic (2016) (480 points, 155 comments): the classic explainer, still circulating.
• We ran AI agent swarms in Minecraft and Mindustry (344 points, 141 comments): YC’s agent swarm experiments in games.
• Herdr has released native app (289 points, 187 comments).
• US Reps Lead Democratic Resolution Opposing A.I. Bubble Bailout for Big Tech (274 points, 185 comments): Congress gets into the bubble debate.
• A tiny world model running games on a Raspberry Pi Pico 2 W (253 points, 16 comments): a world model small enough for a microcontroller.
• Astroterm: A Planetarium for Your Terminal (192 points, 22 comments).
• Backdoor in Claude Code for VS Code extension on the Cursor Marketplace (99 points): the Phorion advisory behind The One Thing.

11 · OpenRouter Apps

Codex takes the token lead at 2.62 trillion tokens, ahead of Command Code at 2.34 trillion and Claude Code at 2.13 trillion. Hermes Agent follows at 1.91 trillion, with ZCode at 1.76 trillion and Lemonade at 1.75 trillion close behind. The mover is the reshuffle at the top: yesterday’s leader Command Code slips to second as Codex climbs past it, while the coding-agent pack, Codex, Command Code, Claude Code, Kilo Code (0.74 trillion), and OpenClaw (0.73 trillion), now occupies most of the board. Codex · Command Code · Claude Code · Hermes Agent · Kilo Code

12 · Watch

No fresh video qualifies in the tracked feeds today. TwoMinutePapers’, Fireship’s, and Wes Roth’s latest videos were all featured in recent issues and stay seen. TheAIGRID’s uploads stay skipped for clickbait framing, and Dwarkesh Patel’s history series is excellent and the wrong newsletter.

13 · Listen

• Hard Fork: “Are We in an A.I. Bubble? We’re About to Find Out.” (Oct 30): the week’s bubble debate, timed to the market’s mood, from the show that has been tracking it all year.
• Latent Space: “How Anthropic ships the #1 LLM in the World safely: Separating the Brain from the Hands” (Oct 27): how Anthropic separates the model from the tools it can touch, the safety architecture behind the week’s other Anthropic news.

14 · Read

• Phorion: Official Claude Code Extension Compromise: the full teardown behind The One Thing, with indicators and remediation steps.
• Reuters: Gone in 20 minutes, how the biggest heist in crypto history unfolded: the Binance timeline, the signing-infrastructure compromise, and the frozen half.
• Cohere: Series E announcement: the round terms and the sovereign-AI pitch in the company’s own words.
• Google Blog: Edit and preview documents directly in Gemini: the editor launch, with the format and availability details.
• DeepSeek-V4.1-Flash paper: the KV cache compression behind the trending model.
• LongChang paper: the hidden-physics benchmark where only one model in twelve found the law.
• DecisionRAG paper: retrieval without embeddings, in 0.7 to 1.8 seconds a query.
• Epoch AI: AI can turn public security fixes into working exploits: the patch-gap report behind The Argument, with the $1,000 marginal cost and the $100,000 total spend.
• Cognition: Corridor joining Cognition: the acquisition post behind the Money Flow card.

15 · Safe to Ignore

• Yesterday’s stories, covered in full: Mistral Large 4’s open weights, Gemini 4 Carbon’s leaderboard debut, DoorDash’s Instacart acquisition, OpenAI’s $500 monthly API credits, GitHub’s Copilot Fusion, Anthropic’s AI for Science expansion, NVIDIA’s Nemotron Transcribe, Genie 4, and Claude in drug labs.
• Today’s newsletter sponsored blocks: the Decodo web-data API deal and the Quickbase Pave placement are partner promotions, not editorial signal.
• Google’s other October 29 posts: the resume-update guide, immersive explorations in the Gemini app, Connected Apps management, and XREAL AURA XR glasses are product and hardware updates, not lab-model news.
• Meta’s Muse in Singapore: covered yesterday; the rollout continues, but there is no new announcement today.
• TheAIGRID’s clickbait framing: unseen and staying that way.
• Dwarkesh Patel’s history series: excellent, wrong newsletter.
• The rest of the AlphaSignal RSS tail: voice-model leaderboards, XR prototyping blocks, training-kernel speedups, and the Alibaba agent handbook are real but second-order today; the strongest items made the cards above.

16 · Build on This

The extension audit

Every developer installs editor extensions and agent plugins without auditing them, and this week the official extension for the most popular coding agent shipped a backdoor. Build the tool that audits before install: point it at an extension or plugin, and it reports what the code actually does, network endpoints it contacts, shell commands it runs, files it touches outside its own directory, and whether it modifies SSH configuration or startup persistence. Score it, show the exact lines, and compare versions so an update that adds a network call gets flagged before it runs.

Sell it as a one-time purchase per developer, with a paid update pack for new detection rules, no subscription. Teams buy it as a gate in their onboarding: no extension on a work machine until it passes the audit. The moat is not the scanner, which anyone can build. It is the rule library and the verdict database: every extension ever audited, every version diff, every known-bad indicator, so the second customer benefits from the first customer’s scare. Start with VS Code and Cursor extensions, where today’s attack happened and the pain is freshest, then expand to the agent-plugin marketplaces springing up around every coding tool. The pitch writes itself: you would not run a stranger’s code on your laptop, and right now, every extension install is exactly that.