NPDev Daily AI Briefing - October 31, 2026

A trojanized Claude Code extension spent 11 hours in Cursor's marketplace

Cursor's advisory says malicious builds of anthropic.claude-code 2.1.312 and 2.1.313 were served from its VS Code extension marketplace between roughly 09:27 and 20:35 UTC on October 29, and that up to about 5,000 users may have installed them. The injected loader runs before the extension's normal code: it appends an attacker SSH key labelled svc-telemetry to authorized_keys, tries to enable SSH and hold a reverse tunnel to local port 22, installs LaunchAgent or scheduled-task persistence with a 60-second retry loop, and posts hostname, user, OS, Git email and the names of environment variables matching KEY, TOKEN, SECRET, PASS, AWS or GCP. Microsoft's Threat Intelligence analysis, published October 30, confirms the loader sits in the module load path and that the npm, Visual Studio Marketplace and Open VSX copies were not affected. Uninstalling the extension does not remove the payload.

Why it matters: Marketplace auto-update is now an attack surface with your SSH keys behind it, and uninstalling is not remediation. If you ran Cursor on macOS or Windows that day, hunt for the svc-telemetry key, hidden .stk_ key files and retrying ssh processes, then rotate credentials from a clean host. Structural fix: pin extension versions, prefer vendor channels for security-critical tooling, and review IDE plugins the way you review npm dependencies.

Sources:

OpenAI, Google and Microsoft back one robots.txt token for AI-training opt-outs

On October 30 OpenAI said it will honor a common signal in robots.txt, and Google and Microsoft published matching commitments the same day, all built on an individual Internet-Draft from Anthropic's Kevin Kelley in the IETF AI Preferences group. The mechanism is a policy token written where a crawler name would go — User-Agent: __usage_ai-training, followed by Disallow and Allow rules evaluated with RFC 9309 path matching. The dates differ sharply: Microsoft says it honors the preferences from February 1, 2027 and is retiring its NoArchive and NoCache tags, which sites must replace by March 1, 2027; Google says early 2027 and will read a token opt-out as a Google-Extended block unless Google-Extended is named; OpenAI says only that it aims to implement the signal in the coming months; Anthropic says it has started building support with no date. The draft is not IETF-endorsed, creates no licensing or payment right, and a wildcard User-Agent: * rule does not count.

Why it matters: This is the first cross-vendor control a publisher can express in one line, but nothing is live yet and every vendor still honors its own older switches. If you run a content site, add the token now and verify it is respected before you drop Google-Extended; if you operate crawlers or RAG ingestion, record and honor the token and do not assume a wildcard block protects you.

Sources:

OpenAI's latest round lands at about $11B committed against a $30B target

The Wall Street Journal reported on October 30, and Reuters carried, that OpenAI has secured roughly $11 billion in commitments for its latest round at a $1.25 trillion valuation, down from the $30 billion at $1.4 trillion it initially sought. The company has cut its target to about $20 billion and expects the first close to land below that, with plans to approach family offices and wealthy individuals; a UAE consortium that includes MGX is expected to be the largest participant, and the deal would give OpenAI an option to lease computing capacity in the region.

Why it matters: Capacity commitments, not benchmark scores, set API prices and rate limits. A smaller raise is not a crisis, but it weakens the assumption that frontier inference keeps getting cheaper on schedule in 2027. For planning: negotiate reserved throughput, keep a second provider warm, and treat multi-year single-vendor pricing promises as credit exposure rather than a discount.

Sources:

S&P cuts Meta's outlook to negative over AI capex and negative free cash flow

S&P Global Ratings revised Meta's outlook to negative from stable on October 30 while affirming its AA- rating, citing uncertainty over capital spending and free operating cash flow. Meta guided full-year capex to $135–145 billion after posting a $2.12 billion free cash flow deficit in the third quarter, its first, and is raising about $95 billion, starting with $35 billion of underwritten equity and a further $60 billion at-the-market. S&P projects free operating cash flow deficits of $39 billion in 2026 and $71 billion in 2027, leverage above 1.0x as early as 2027, and says Meta's ability to monetize AI is more limited than peers'. Meta says it disagrees. The stock fell 15% in October, its worst month in four years.

Why it matters: The cost of capital for AI compute is now a published risk factor, not a private worry. Expect less generous free tiers, firmer list pricing and harder negotiations from anyone leasing you capacity — and put counterparty credit on the diligence list before you sign a multi-year GPU contract.

Sources:

OpenAI releases GPT-6 Rosalind, a life-sciences family behind trusted access

OpenAI's API changelog lists GPT-6 Rosalind as released on October 30: a model family for biological reasoning with scientific tool use, covering target research, genomics and sequencing analysis, protein and sequence analysis, medicinal chemistry, literature synthesis, wet-lab troubleshooting and experiment planning. Access is not self-serve. Enterprise and Business organizations must be approved through the trusted-access program, and there are two tiers: Rosalind Research, which includes GPT-6 Rosalind Research and GPT-5.5 Rosalind Research, and Rosalind Discovery, which runs the existing Rosalind 5.5 model with stricter monitoring and does not grant Research access. Approved customers get it in ChatGPT, Codex and — where separately approved — the API, with a Life Sciences Research plugin in Codex wiring it to scientific tools. It is not on Amazon Bedrock, and the academic plan excludes API access.

Why it matters: A frontier checkpoint most teams cannot call. The engineering lesson is procedural: for regulated domains, "is it in the model catalog" is the wrong availability question — budget the approval cycle, data-handling review and per-tier capability differences, not just latency and price. Note also that two capability tiers now share one brand name.

Sources:

Anthropic starts retiring Opus 4.8 fast mode and points users to Opus 5.5

The Claude Platform release notes for October 30 deprecate fast mode for Claude Opus 4.8, with removal on November 30, 2026. After that date, requests to claude-opus-4-8 with speed set to fast return an error, and Anthropic points migration at Claude Opus 5.5, its September 22 flagship, which the company says leads its agentic coding and knowledge-work results and costs 40% less to run than Opus 5 on typical workloads. A day earlier Anthropic also shipped the Usage and Cost Analytics API in beta, with usage and cost endpoints groupable by model, workspace, API key and the user or service account behind each request.

Why it matters: Thirty days of notice on a request parameter, not a model — the quiet kind of breaking change. Grep your code, eval harnesses and gateway configs for speed: "fast" now, and re-baseline quality after moving to Opus 5.5, since a cheaper flagship still changes output distributions. The new analytics endpoints are the cheapest way to prove the migration actually saved money.

Sources:

IBM ships Granite Switch 4.1.1 as a patch release — and as a pattern

IBM published Granite Switch 4.1.1 on Hugging Face on October 29, a backwards-compatible patch to the modular Switch architecture it introduced a week earlier. The patch updates the multilingual Granite Speech ASR adapter, covering 10 languages with native punctuation and capitalization, and retunes the Decision adapter in granitelib-core. IBM says nothing but those two adapters was recomputed: the base model is untouched, and customers compose the latest adapters and deploy. The company says tutorials and an Adapter SDK are coming so third parties can build and version their own.

Why it matters: A small release making a bigger point: composable adapters let a model line be versioned like software, with patch-level updates that do not require re-qualifying the whole checkpoint. If you maintain a fine-tune or adapter stack, this is the shape of maintainable model operations — but an adapter swap still deserves a regression run on your own traffic before it reaches production.

Sources:

Bottom line

Credit and provenance beat capability this week. Meta's outlook, OpenAI's round and a trojanized IDE extension are the same story from three angles: the buildout is now being priced and audited by people who do not care how good the model is. Google shipped no new model in this window — its newest platform item remains the October 30 Computer Use GA — and Gemini 4 Carbon, announced October 28, still has no entry in the Gemini API changelog, so the usable frontier is still Claude Opus 5.5, Gemini 4 Argon, GPT-6.x and open weights like Mistral Large 4 and DeepSeek V4.1 Flash.

As of October 31, 2026, 15:00 UTC. Researched and generated for NPDev News subscribers.