Daily AI Brief: Claude Code Extension Backdoor, Gemini Files (Oct 30)
The most useful item today is a security one. On October 29, a tampered build of the Claude Code editor extension, version 2.1.313, was handed out through Cursor’s extension marketplace and tried to plant an SSH backdoor. If anyone in your office uses Claude Code inside Cursor, check today. Removing the extension may not be enough, so follow the cleanup steps.
The short list
| Item | What it’s for | Who should care | Verdict |
|---|---|---|---|
| Claude Code extension 2.1.313 compromise (Cursor marketplace) | Security incident: check and clean affected machines | Anyone using Claude Code in Cursor | ADOPT |
| Claude Code 2.1.312 to 2.1.314 | New setting that stops file writes outside the working folder | Offices running unattended AI coding tasks | EVALUATE |
| Gemini app file editing, Fill with Gemini citations, compact pivots | Create and edit files in chat; fill sheets with sourced data | Google Workspace offices | EVALUATE |
| OpenAI “Aura” site-safety check | Can stop ChatGPT’s browsing tools from opening a site | Anyone who wants ChatGPT to read their website | EVALUATE |
| LM Studio 1.1.10 (Bionic) | New oMLX engine for Apple Silicon Macs | Offices running AI locally on Macs | EVALUATE |
| n8n invoice and lead-capture templates | Invoice PDFs to Sheets with a math check; form leads to Sheets | Offices handling vendor invoices or web leads | EVALUATE |
| Gemini 4 Carbon | Google’s strongest model, limited release | Not available to most businesses yet | WATCH |
| OpenAI API credits and Pro limits | API credits included with $100/$200/$500 ChatGPT plans | ChatGPT Pro subscribers | WATCH |
| Mistral Large 4 open weights | Very large open-weight model | Teams with server-class hardware | WATCH |
| Ads in Google AI Mode expand | Ads in 10 more countries and in US follow-up questions | Google Ads advertisers | WATCH |
| Ahrefs AI citation stability study | How often AI answers drop and restore citations | Anyone tracking AI visibility | WATCH |
| NVIDIA Nemotron 3.5 Transcribe | Open-weight speech-to-text with speaker labels | Offices wanting private transcription | WATCH |
| Hugging Face mining malware returns | Malicious models that run code on load | Anyone downloading open models | WATCH |
AI Connectors and Safety
Claude Code extension 2.1.313 was tampered with on Cursor’s marketplace
Cursor says a maliciously modified version 2.1.313 of the Claude Code extension was available in its marketplace between about 2:27 a.m. and 1:35 p.m. PT on October 29, that it “was not developed by Anthropic”, and that at most 5,000 users were affected. The code adds an attacker SSH key labelled “svc-telemetry”, installs persistence, and sends host details out. Cursor says the step that turns on SSH would fail on most Macs and Windows PCs without admin rights, but it still tells everyone affected to run its check and cleanup script, because uninstalling “may not be sufficient”. The Hacker News reports no evidence the bad version reached Open VSX or Microsoft’s VS Code Marketplace, and that 2.1.314 is now published to both.
Read the source (Cursor) · The Hacker News
Hugging Face mining malware came back within days
BleepingComputer reports that Pluto Security found 31 malicious Hugging Face repositories posing as small Qwen2 test models; the code runs when a user enables the trust_remote_code option, installing a crypto miner and in some versions a reverse shell. The top model reached 28,412 downloads by October 28. A separate fake Solana starter kit on GitHub was set up to trick AI coding agents into running a remote-access installer. The lesson for a small office: never enable trust_remote_code on a model from an unknown publisher.
Tracked on: Connecting AI to Company Data Safely
AI App Builders
Claude Code 2.1.314 adds a write guard for agents
Anthropic’s changelog lists a new setting, permissions.blockWritesOutsideWorkingDirectories, in 2.1.314: Write, Edit and NotebookEdit refuse paths outside the working directories “in every permission mode”. The same release fixes claude -p exiting with code 0 and no output when startup failed (it now prints the error and exits 1). Version 2.1.312 renamed the “session limit” to the “5-hour limit” and caps prompt and agent hooks at 24 at a time per session.
Tracked on: AI App Builders for Business Tools
Google Workspace AI
Gemini app can now create and edit files in chat
Google says you can generate, preview and edit files inside a Gemini app chat. PDFs work on web and mobile; documents, spreadsheets, slide decks, Markdown, TXT and code are web only. It is available now to all Workspace customers, Workspace Individual and personal accounts, and there is no admin control for it, which matters if you manage what staff can do.
Fill with Gemini shows sources per cell and handles 3,000 cells
Google says the AI function in Sheets now cites the web sources behind each cell and supports up to 3,000 cells per request. Google cites an internal 95-person study putting it “up to 55 times faster than manual entry” on a 500-cell task. Plans: Business Standard and Plus, Enterprise Standard and Plus, Google AI Pro and Ultra, plus some add-ons. Separately, pivot tables gain a compact layout that survives Excel import and export (Scheduled Release domains from November 6).
Read the source · Compact pivots
Tracked on: AI in Google Workspace: What Each Plan Gets
Frontier Models
Gemini 4 Carbon: strongest, but not for you yet
Google calls Carbon its strongest model and reports it at #1 on Artificial Analysis Intelligence Index v5.0 with a score of 59 (vendor-reported). Access starts with a subset of cyber defenders through its Fairwind Program; developers, businesses and consumers come later. The introductory API price is $2 per million input tokens and $10 per million output tokens.
OpenAI adds API credits to top ChatGPT plans
Simon Willison reports that $100, $200 and $500 ChatGPT subscribers now get the same amount in credits for one API organization, matching Anthropic’s offer earlier this month. BleepingComputer reports OpenAI also dropped a planned cut to Pro limits and, per an OpenAI post on X, doubled limits on Pro tiers and Business Premium. Check the details on OpenAI’s own help page before you plan around them.
Read the source · BleepingComputer
Mistral Large 4 ships open weights
Hugging Face describes it as about 1T total and 49B active parameters with a 1M-token context, under a Mistral license that limits model-as-a-service use. The 2-bit version runs on a single Apple Silicon Ultra with 512 GB of memory.
Tracked on: Top Frontier Models: Where Things Stand
SEO and AEO Tactics
ChatGPT may be quietly refusing to open some sites
A Search Engine Journal piece describes an OpenAI site-safety check (“Aura”) that stops ChatGPT live fetch and Codex Browser Use from opening flagged domains, regardless of robots.txt or user settings, with results cached for 24 hours. The case is one publisher blocked since May 2026, with no public review process. The article includes a test plan.
Ads in AI Mode reach 10 more countries and US follow-ups
Per SEJ’s report on Google’s Q3 call and announcement, AI Mode ads are scaling in Australia, Canada, India, Kenya, Malaysia, New Zealand, Nigeria, Pakistan, the Philippines and Singapore, and ads are launching in AI Mode follow-up questions in the US. Existing Search, Shopping and Performance Max campaigns are eligible by default and cannot opt out separately; negative keywords still apply.
AI citations churn daily, and that is normal
Ahrefs followed 37,500 citations for 20 days: 50 to 83% were gone the next day, but about 75% of those returned within the study. Its advice is to count how many of the last seven days you were cited rather than react to one check.
Tracked on: SEO and AEO Tactics That Work Now
Local AI Hardware
LM Studio 1.1.10 adds an oMLX engine for Macs
LM Studio’s release notes list an oMLX engine for Apple Silicon, speculative decoding for MLX models, an experimental MoE expert GPU cache for llama.cpp, and voice-model auto-loading off by default on Macs under 32 GB. LM Studio is free; no speed figures were published.
NVIDIA Nemotron 3.5 Transcribe
An open-weight model with 30B total and about 4B active parameters that transcribes 40 languages, labels up to eight speakers, and handles recordings up to an hour. NVIDIA reports 5.33% average WER on the Open ASR English leaderboard, first among open-weight models. It is built for recorded audio, not live streaming; quantized versions for local hardware are listed as supported, with NVFP4 described as forthcoming.
Tracked on: Local AI: Models by Hardware Tier
Small-Business Automations
n8n templates: invoices with a math check, and simple lead capture
One published n8n template watches a Gmail label for PDF invoices, extracts the text, has Gemini return structured fields with a confidence score, checks subtotal plus tax against the total, flags weak results as needs_review, and appends rows to Google Sheets. It needs Gmail, Sheets and a Gemini API key, and scanned invoices need OCR first. A second template captures form leads into Sheets with a Gmail auto-reply.
Read the source · Lead capture template
Tracked on: Small-Business Automations: n8n, Zapier and Make
What we’d do this week
- Ask everyone who uses Cursor to check their Claude Code extension version and run Cursor’s svc-telemetry check. Anyone affected should run the cleanup script and rotate credentials from a clean machine.
- Update Claude Code to 2.1.314 or later and turn on
blockWritesOutsideWorkingDirectoriesfor unattended tasks. - Ask ChatGPT to open five pages of your own site. If you see “Browser use is not permitted”, collect evidence before contacting OpenAI support.
- If you’re on Business Standard or higher, try Fill with Gemini on a 50-row research list and spot-check the cited sources.
Written by InnerStack’s research agents from the linked sources and published without human review. Verdicts are the agents’ recommendations, not test results. Report an error: editorial policy.