Since Oct 30 in AI: a backdoored coding extension, a 1.6T agent model, and AI playtesters for indie games

Oct 29, 2026

SECURITY: A tampered Claude Code extension sat in Cursor's marketplace for 11 hours with an SSH backdoor

Cursor disclosed on Oct 29 that maliciously modified versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension were served from the Cursor VS Code Extension Marketplace for macOS and Windows between about 2:27am and 1:35pm PT that day. Cursor says the versions were not built by Anthropic. The payload collected host details (hostname, username, OS, home path, environment variable names, Git email and public IP), added an attacker SSH key labeled svc-telemetry to authorized_keys, set up persistence through a LaunchAgent or scheduled task, and tried to open a reverse SSH tunnel. Turning on the SSH service needs admin rights, so on most machines that step failed, but the key, the persistence scripts and the host beacon still landed. Cursor pulled the versions, shut the marketplace down, audited the other extensions, rotated its keys and had the attacker server taken offline. Microsoft Security published its own analysis on Oct 30. If you updated that extension inside Cursor on Oct 29, run Cursor's one-line grep svc-telemetry ~/.ssh/authorized_keys check, use its remediation script, and rotate credentials: uninstalling the extension alone does not remove the persistence. For every AI coder, it is a reminder to pin extension versions and treat editor plugins as code with access to your machine.

Source: https://cursor.com/blog/claude-code-extension-security-notice

Nov 2, 2026

MODELS: Meituan ships LongCat-2.5, a 1.6-trillion-parameter model built for long coding-agent runs

Meituan released LongCat-2.5 on Nov 2, according to its API changelog and tech blog. It is a Mixture-of-Experts model with 1.6 trillion total parameters and about 48 billion active per token, and it is natively multimodal: images are turned into discrete tokens so one backbone handles text and vision, which Meituan uses for visual coding, design and 3D tasks. Training leaned on long-horizon reinforcement learning over real codebases, with failed agent runs turned into new verifiable training tasks, and Meituan says it was trained and served on domestic Chinese accelerators with 4-bit (W4A4) inference. On Meituan's own benchmark table it scores 88.4 on Terminal Bench v2.1, 38.5 on Terminal Bench v4.0, 64.6 on DeepSWE v1.1 and 55.4 on 3DCodeBench text-to-3D. Those are self-reported and not yet independently verified, and on several coding tests Claude Opus 5 and DeepSeek V4.1 Flash still score higher. The changelog says it works with Claude Code, Codex and Hermes harnesses, and it is available now through LongCat's chat and API, with GitHub and Hugging Face releases planned. Open weights have not shipped yet.

Source: https://longcat.ai/blog/longcat-2.5

Nov 2, 2026

TOOLS: Anthropic's message threads cut time to first token by about 35% on long agent sessions

Anthropic launched message threads in public beta on the Claude Messages API, listed in the platform release notes on Nov 2. Normally a coding agent resends the whole conversation, every file and tool result, on each request. With threads, the first request starts a thread and later requests send only the new messages plus the previous response ID, using the message-threads-2026-08-12 beta header. Anthropic says threads are already on by default for most Claude Code users, and that requests of 500K to 1M tokens see median time to first token drop by about 35%. Threads are held encrypted in memory, not on disk, and expire five minutes after the last request, so your client still has to keep the full history to restart. Token usage and pricing do not change, because Claude still reads the full context each turn. It works on the Claude API, Claude Platform on AWS, Microsoft Foundry and Anthropic-managed Claude on Google Cloud. See the docs. If you run your own agent loop, this is a quick latency win.

Source: https://claude.com/resources/articles/message-threads

Oct 30, 2026

GAME DEV: Ramen open-sources Aura Autopilot, an AI playtester for Unreal, Unity and Godot

Ramen launched Aura Autopilot on Oct 30 as an Apache-2.0 project on GitHub. It is an in-editor playtesting agent for Unreal Engine 5.4 to 5.8, Unity 6 and Godot 4.7+, on Windows and macOS. According to Ramen's technical write-up, a coding agent (Claude Code, Codex or OpenCode) reads your project source and writes a game-specific harness, then a fast decision model plays the game in real time with real input events and files a report. It keeps per-game memory, so it gets better the more it plays your game. You give it plain-English goals such as "kill 10 enemies" or point it at one system to test. Ramen says it has played shooters, RTS, survival crafting, turn-based RPG, match-3 and Soulslike games, runs 3x faster than its earlier verification agent, and beats general coding agents at testing games. Those are vendor claims from its whitepaper. You can use your own API keys or an existing Claude Code or Codex subscription. For indie game devs without a QA team, it is a free way to catch "this elevator never comes down" bugs before players do.

Source: https://www.businesswire.com/news/home/20261030731831/en/Ramen-Launches-Aura-Autopilot-its-Open-Source-Autonomous-Game-Tester-for-Unreal-Engine-Unity-and-Godot

Nov 2, 2026

GAME DEV: Half of October's new Steam games disclosed AI, and itch.io deleted terabytes of AI spam

A community count by Reddit user u/ploz of about 63,600 Steam releases since January 2024, reported by Dexerto on Nov 2, found 49.9% of games released in October 2026 carried Valve's AI-generated content disclosure, up from 26.4% a year earlier and 1.7% in January 2024. Unconfirmed: this is one person's analysis of public Steam data, not a Valve figure, it relies on self-reported disclosures, and Valve narrowed the rule in January 2026 to content players see or hear. Per the reports, art is the most common use (63%), then text (30%) and code (16%), and disclosure is far more common on small games: 47% of 2026 games with under 10 reviews versus 14% of those with 1,000 or more. Games with 50+ reviews averaged 77% positive with a disclosure against 83% without. The same week, itch.io said it "just deleted a couple terabytes of ai slop" after daily new pages doubled in two months, extended its AI disclosure to books, comics, tabletop and soundtracks, and added a No AI filter to search (GamesRadar). AI is not banned there; mass-produced pages are treated as spam. For indie game devs using AI, disclose honestly and put real design work on top, because storefronts are now filtering the low-effort flood.

Source: https://www.dexerto.com/gaming/almost-half-of-all-new-steam-games-use-ai-now-3423933/

Nov 2, 2026

DEALS: Applied Compute hits $100M run rate in 18 months and raises $350M at $3.25B; Tutor Intelligence raises $75M

Applied Compute announced on Nov 2 that it raised $350 million at a $3.25 billion valuation, led by Elad Gil, with Kleiner Perkins, Lux Capital, NVIDIA, Blackstone, Shopify Ventures, HubSpot Ventures and others. The company, founded by former OpenAI researchers, trains and runs custom models on each enterprise's own data, and says it went from zero to $100 million in annualized revenue in under 18 months. Customers include Microsoft, Shopify, Harvey, DoorDash, Cognition, Clay and Decagon, and its team has tripled since January, with 85% researchers and engineers. The money goes to compute, hiring and enterprise rollouts. Also on Nov 2, Tutor Intelligence raised a $75 million Series B led by Andreessen Horowitz, with Union Square Ventures and Neo, bringing its total to $117 million. It rents robot workers to factories and warehouses by the hour or per pick, and remote human tutors correct them so every fix trains the whole fleet (a16z's post). The signal: investors are paying up for companies that turn custom models into revenue, fast.

Source: https://appliedcompute.network/company/100m-run-rate-fundraise

Ship faster this week

Grab the free Agentdex starter kit with prompts and agent configs for Cursor, Claude Code and Codex.