Tooling5d ago
Cursor marketplace served a tampered Claude Code 2.1.313 extension with an SSH backdoor, affecting at most 5,000 users
Cursor posted a security notice on X at 07:46 UTC on Oct 30: version 2.1.313 of Anthropic.claude-code in its VS Code extension marketplace was a maliciously modified build, not developed by Anthropic, available from about 2:27am to 1:35pm PT on Oct 29 and affecting at most 5,000 users. The payload collects host details, adds an attacker SSH key, tries to open a reverse SSH tunnel and installs persistence. Cursor pulled the version, shut down and rebuilt the marketplace, rotated keys and had the attacker server taken offline; it asks users to update Claude Code for VS Code to 2.1.314 and follow the check and cleanup steps in its blog post.
Tooling8d ago
Microsoft Research and UC Berkeley open-source TokenEconomizer, a plugin that cuts Claude Code and Codex costs by 18.4–30.9% on SWE-Bench without changing the agent
Microsoft Research, Microsoft Security and UC Berkeley open-sourced TokenEconomizer on GitHub (Apache 2.0, v0.1.0 released October 26), a plugin for Claude Code, Codex, GitHub Copilot CLI and Pi, with experimental opencode support. It learns from earlier sessions in the same repository: micro-skills remember repo facts, tool pruning drops tool definitions that go unused, and a loop guard nudges an agent that is stuck. The paper reports 18.4–30.9% lower mean cost across five agent and model combinations on 277 SWE-Bench tasks (paper figures).
Tooling1d ago
X Discussion: DHH Says the Age of Agents Will Be Great for Most Programmers but Hard on Cantankerous Ones Who Relied on Rare Skills
Ruby on Rails creator and 37signals CTO DHH (David Heinemeier Hansson) posted two related takes on X on November 2. First: "The great gift of agents is how they allow you to route around every insufferable gatekeeper in software." Then: the age of agents will be amazing for most programmers but hard on the cantankerous ones, because specialized knowledge and rare skills will no longer offer immunity to people who are a pain to work with, so they should learn basic people skills. The second post drew about 3,600 likes, 106K views and 280+ replies in roughly four hours. This is a personal opinion, not an announcement from any company.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.