This week a tampered Claude Code extension on Cursor's marketplace shipped an SSH backdoor to developer machines, Google says its new Gemini model tops the leaderboard though almost nobody can use it yet, a crawler identifying itself as Roblox pulled 145 GB of community 3D models without asking, and Microsoft offers buyouts to 60,000 staff while expecting only a few thousand to take them.

📖 Story 1: Tampered Claude Code extension on Cursor's marketplace shipped an SSH backdoor

phorion.io · Read

Phorion has found a backdoor in the Claude Code for VS Code extension as distributed through the Cursor Marketplace. Versions 2.1.312 and 2.1.313, both since removed by Cursor, carried code prepended to the extension bundle that runs as soon as the file loads, before the extension activates and without any user interaction.

The payload adds an attacker key (comment "svc-telemetry") to ~/.ssh/authorized_keys, tries to start the local SSH server and opens a reverse SSH tunnel to 134.209.82[.]225, giving the operator an interactive shell. It persists through a fake com.apple.sysmond LaunchAgent on macOS, an @reboot cron job on Linux and a scheduled task or Startup script on Windows, then reports the hostname, user, Git email and the names, not values, of secret-looking environment variables.

On macOS a bug often stops it from enabling SSH, but persistence and the beacon still land. Uninstalling the extension does not remove the backdoor; Phorion lists cleanup steps and advises rotating credentials wherever SSH was reachable.

An extension runs with all of your IDE's permissions, which makes the marketplace it came from part of your attack surface.

💬 HN Discussion

Attribution dominated. Early reports, including Kevin Beaumont's, called it an Anthropic hack reaching VS Code users; according to an Anthropic engineer in the thread, Anthropic's systems weren't compromised and an attacker used access to Cursor's marketplace to publish a tampered copy that affected only Cursor users. Not everyone was convinced: commenters noted that 2.1.313 had also been pulled from the VS Code marketplace, Open VSX and npm, and asked how anyone got publishing access at all.

Cursor drew criticism for an opaque marketplace with no visible signature or checksum checks, where "Made by Anthropic" implied a provenance nobody verified. Others pointed out that VS Code skips its update delay for "trusted" publishers.

Until a root-cause report appears, the real question is who could publish under Anthropic's name.

→ Discuss on Hacker News

📖 Story 2: Gemini 4 Carbon

blog.google · Read

Google DeepMind has announced Gemini 4 Carbon, two weeks after Gemini 4 Argon, calling it its strongest model with a focus on cybersecurity and long-horizon work. Google reports that Carbon ranks first on the third-party Artificial Analysis Intelligence Index (v5.0, score 59) and leads three external security benchmarks, run by Google without guardrails: SEC-bench Pro (88.2%) for finding vulnerabilities, ExploitGym (54.8%) for exploitation and CWE-bench (71.0%) for patching.

The alignment figures come from Google's own testing: successful cheating on Terminal-Bench 4.0 down to 0.0%, unsupported claims roughly halved compared with Argon, and a 0.0% attack success rate on Gray Swan's indirect prompt injection benchmark.

Most developers can't use it yet. Carbon goes first to a subset of cyber defenders, then gradually to trusted partners through the Fairwind Program, while Google takes part in the US government's voluntary pre-release testing; developers, businesses and consumers get it "as soon as possible". Introductory pricing matches Argon at $2/$10 per million input/output tokens, rising to $4/$20 once the introductory period ends.

One independent ranking backs it; every other number comes from tests Google ran itself.

💬 HN Discussion

The benchmarks mattered less than access. Commenters couldn't find Argon in the Gemini app or on Workspace plans and dismissed announce-now, ship-later launches, though one noted Argon reached users about two weeks after it was announced. Nobody could tell whether Carbon replaces Argon or sits above it; the identical price led most to read it as a successor.

The #1 Artificial Analysis spot met suspicion, since the index changed its methodology the day before and the announcement landed hours before Google's earnings call.

The model may be strong; Google's problem is getting it into anyone's hands.

→ Discuss on Hacker News

📖 Story 3: A crawler identifying as Roblox pulled 145 GB of 3D models from Open3DLab

open3dlab.com · Read

Open3DLab, which runs three free community sites for 3D models, has reported that a crawler identifying itself as Roblox downloaded 145.5 GB of its creators' work. Over 15 and 16 October, the crawler, whose user agent named a "3D foundation model research" project and a Roblox email address, read 18,926 project pages and pulled 1,027 files from 712 projects.

It fetched robots.txt but did not follow it, and downloaded files despite terms of service that forbid scraping and regardless of license: 423 of the projects are licensed for non-commercial use only. It didn't filter adult content either, taking 345 adult projects. The site worries that such data could reach a model serving a platform where more than a third of daily users are under 13, though it has no evidence that any did.

Once blocked, the crawler kept retrying during office hours for two more days. Two emails to Roblox went unanswered. The site suspects training data for Roblox's Cube 3D model but says it can't prove it, and that the user agent is a self-description Roblox has yet to confirm.

The download was modest; the apparent disregard for licenses and content on the way in is the story.

💬 HN Discussion

Whether anything wrong happened at all split the thread.

Defending the scraping: downloading public files isn't infringement, robots.txt is etiquette rather than law, and the adult files could just as well train a classifier that keeps such material off Roblox. Some added that the site's own catalogue is full of assets ripped from commercial games.

Questioning the scraping: commenters pointed to the non-commercial licenses on many of the files and asked why LinkedIn can enforce its terms against scrapers when a small site can't. Others read the ripped-assets point as exactly the post's argument about copyright cutting only one way.

Few disputed what the crawler did; the fight was over whether doing it is wrong.

→ Discuss on Hacker News

📖 Story 4: Microsoft offers buyouts to 60K employees, but expects low uptake

seattletimes.com · Read

Microsoft has offered voluntary buyouts to about 60,000 employees, roughly a quarter of its 223,000-person workforce. Staff at vice president level and below in the US, Canada, India and the UK get a standard, location-based severance package and have until early December to decide.

The company expects only 3–5% of those 60,000 to accept, fewer than 3,000 people. Unlike this year's voluntary retirement program, which about a third of 8,700 eligible US employees took, the new offer isn't sweetened. Gaming, Windows, Copilot, HR and finance participate fully; AI, legal and cloud partly; marketing, commercial business and security not at all.

The move follows about 15,000 layoffs last year and AI infrastructure spending that rattled investors through the first half of 2026. Microsoft says it isn't replacing workers with AI agents, and describes its workforce reductions as shedding outdated roles and teams as AI changes the business. Its stock rose about 1.5% on the news.

An offer this broad and this plain reads less like a targeted cut than a test of who already has one foot out the door.

💬 HN Discussion

Few in the thread believe this stays voluntary. Recipients face a bind: take the money into a crowded job market, or stay and risk the layoffs widely expected if too few accept.

Terms shared from the memo and Reddit, up to 39 weeks of base pay, looked attractive mainly to long-tenured staff near retirement, and a familiar warning recurred: buyouts tend to lose the most employable people first.

In the thread's reading, the offer is a layoff with a choice attached.

→ Discuss on Hacker News

💬 Community Moment

The scariest Halloween costume

Someone went as Claude for Halloween: the orange starburst logo with a "Daily limit reached… try again in 5 hours" notice on the chest. For anyone who has been cut off mid-refactor, the scariest costume of the year.

🛠️ Projects Worth Checking Out

• Ghostty 1.4 - A fast, GPU-accelerated terminal emulator; 1.4 completes Kitty graphics support, compresses idle scrollback and patches ten security advisories.
• HackerTube - A YouTube-style front end for 6,454 videos recommended in Hacker News comments since 2007, with no accounts and the full dataset available to download.
• Penpot - The open-source design platform; its 2.18 releases added dedicated line and arrow tools, comments inside the workspace, and a hardened, simpler-to-configure MCP integration for driving it from an agent.
• NanoClaw - A lightweight alternative to OpenClaw that runs in containers and connects your agent to WhatsApp, Telegram, Slack, Discord and Gmail, with memory and scheduled jobs.
• agency-agents - More than 230 ready-made agent definitions you can install into Claude Code, Cursor, Codex, Gemini CLI and other coding agents, still growing: an electrical-engineer agent landed on 25 October.