A fake Claude Code extension hit Cursor, and DoorDash cut agent latency 8x
A tampered Claude Code extension sat on Cursor's marketplace for about 11 hours with an SSH backdoor, OpenAI's cyber model reached AWS GovCloud, and DoorDash moved most of an agent's work offline.
Two of today’s stories are about how much work an agent really has to do live: one attacker borrowed a trusted name, one retailer stopped asking a model for what it already knew.
1 · Top story
A tampered “Claude Code” extension sat on Cursor’s marketplace for about 11 hours
On 29 October Cursor found a modified copy of Anthropic’s Claude Code extension on its marketplace, live between about 2:27am and 1:35pm PT. Cursor says Anthropic didn’t develop it, and Anthropic told Microsoft the same. Microsoft’s analysis says the code adds an SSH key labelled svc-telemetry, tries to open a reverse tunnel, and collects the names of environment variables that look like keys, tokens or secrets.
Cursor says permission errors blocked the SSH step on most macOS and Windows machines, but Microsoft notes files may still have been written. Cursor warns that “uninstalling the extension may not be sufficient”. Neither post says how the attacker got in.
If developer machines hold cloud credentials, pin extension publishers and add an install delay.
Affected: anthropic.claude-code 2.1.312 and 2.1.313, Windows and macOS builds · Fixed in: Cursor removed the version, rotated keys and rebuilt the marketplace; no fixed version number stated by Cursor · Severity: no formal rating · Stopgap: search authorized_keys for svc-telemetry, hunt for connections to 134.209.82.225 · If compromised: isolate the host, remove the key and persistence, consider rebuilding it, and rotate credentials from a clean machine; Cursor provides macOS and Windows remediation scripts
2 · Models & features
OpenAI’s GPT-5.6 models arrive on Amazon Bedrock in GovCloud
AWS says Bedrock now serves OpenAI’s GPT-5.6 family, “Terra and Luna”, in the two GovCloud (US) regions, through the Responses, Converse and Chat Completions APIs. Cross-Region Inference routes requests between the two regions, and usage appears in Cost Explorer.
A second AWS notice adds Daybreak Red, “GPT-5.6 Cyber”, for eligible customers in GovCloud (US-East) and US East (Ohio). Access needs enrollment in Daybreak access from OpenAI, and AWS says inference data isn’t used for training. Neither notice gives prices.
For regulated US teams, this means the model call can stay behind the IAM, logging and region controls you already run in GovCloud, instead of going out to a separate vendor endpoint.
3 · Agents
LangChain’s managed agents get their own browser and async subagents
Managed Deep Agents v0.10, in public beta, gives each conversation its own browser inside a LangSmith sandbox. When a login is needed, the agent hands the window to the user, so credentials stay out of model messages and traces. Handoff links expire after 15 minutes.
Subagents can now run asynchronously: set "async": True on the definition and they notify the parent when done, so it never sits in a polling loop.
The handoff pattern is the interesting part. It gives you a clean way to keep secrets out of the context window, which beats scrubbing traces afterwards.
4 · Research
Amazon describes running agent sandboxes at 3.1 million a month
Sandman is Amazon’s sandbox service for agentic reinforcement learning on shared Kubernetes. Each sandbox is a pod with a small daemon mounted into an unmodified task image. A scale test held 11,858 concurrent tiny sandboxes, and four production SWE-bench Verified training campaigns created 3.1 million sandboxes in October.
The paper, a 42-page preprint from 29 October, covers creation bursts, environment preparation and reclaiming abandoned sandboxes. The authors say they plan to open-source the daemon, provider and pool.
If you build coding agents, sandbox churn is a capacity problem of its own. Plan for bursts and for cleaning up sandboxes that nobody released.
5 · People worth following
Nathan Lambert asks whether he was wrong about open models and cyber risk
After a wave of vulnerability disclosures he calls “Black October”, Lambert revisits his earlier view that an open-weight Mythos would have been “fine”. He concedes that calling the outcome “fine” undersold the turbulence, which he describes as “a forced industry update to a new way of working with software”.
He still argues open models help balance offence and defence, and he says closed models “have played a very heavy part in the recent hacks”.
His point for builders is practical: assume faster, cheaper vulnerability discovery whoever ships the model, and plan patch speed accordingly.
6 · Architecture
DoorDash moved most of its grocery-reorder agent offline
DoorDash cut grocery reorder latency from about 16 seconds to 2. An offline batch job asks an LLM to spot each customer’s likely recurring purchases from 90 days of history, and deterministic checks validate the result before it’s stored as reusable shopping-list data. At request time the app fetches that data and resolves each item against the current catalogue.
The agent still handles reasoning tasks, such as finding cheaper alternatives. Quantity changes and removals update the list directly, with no model call. Shopping-list views doubled and the flow’s order rate rose by about 34%, per InfoQ.
Ask of every agent step whether it needs to be live. An offline job with validation is often cheaper and faster than a model call in the request path.
Also worth knowing
🛡️ Security & governance
- LangGraph SDK path traversal (CVE-2026-118667) — langgraph-sdk 0.4.0–0.4.5 doesn’t URL-encode
thread_idandassistant_idin v3 streaming, so a relative segment can redirect an authenticated GET; CVSS 4.3 Medium, upgrade to langgraph-sdk 0.4.6 or langgraph 1.2.14. Source
🧰 Models & tools
- GitHub Copilot app security extension — in public preview; lets you review code scanning alerts and ask Copilot to explain or fix them, with fixes made only in your local working copy. Try. Source
- Google Cloud spend caps — now GA on Budgets; they halt pay-as-you-go requests at the cap for eligible services, but Provisioned Throughput keeps running. Source
- SageMaker GPU partitioning — real-time endpoints can split one GPU into up to seven isolated MIG partitions on P4d, P5, G7 and G7e instances. Source
🏢 Platforms & enterprise
- GitHub Enterprise includes Copilot — standalone Copilot costs $10 per user per month and includes no monthly AI credits, so usage is metered against the enterprise budget from the first request. Source
- Airbnb Chronon — Airbnb cut recommendation-embedding staleness from nearly two days to under a minute, with typical updates in 10 to 30 seconds. Source
- Netflix GPU reliability — Netflix reports more than 99.95% GPU-node availability, using health checks that fail closed, per InfoQ’s summary of its blog. Source
- Netflix Titus single-tenant mode — each task runs alone on its own EC2 instance for VM-level isolation; rollout continues, with early users including managed Flink, streaming connectors and logging pipelines. Source
- Databricks and SAP — SAP Databricks and BDC Connect for Databricks are available today for zero-copy access to SAP data products; Genie and Lakebase pieces are still planned. Source
Saturday’s a fine day to open your editor’s extension list and delete anything you don’t remember installing.
Middle East, India & events · 2
- TRAI’s draft rules for AI in telecom — a consultation draft released on 30 October, open for public comments until 27 November; it applies to the telecom sector in India. Source
- UAE Vibe Codes — a platform from the UAE AI Office, developed with Microsoft, to help people build apps without programming skills; announced on UAE Codes Day and described as nationwide. Source
Researched and drafted with AI, checked against the linked sources. How we use AI →