AI News Briefing — November 1: A tampered Claude Code extension on Cursor's marketplace, and Apple Intelligence heads to China

Today's Headlines

A tampered Claude Code extension on Cursor's marketplace planted an SSH backdoor — two versions were live for about 11 hours
Apple Intelligence heads to China — developer beta on November 4, iOS 27.3 in December, with Alibaba's Qwen built in
Cisco Talos dissects VOLTA, an infostealer that has an LLM appraise its victims — and switches models when one refuses

Today's thread is the route AI takes to reach people. Developers trust an extension marketplace's official listings, and one of them served a tampered build of Claude Code.

Apple will bring its AI features to users in China with Alibaba's Qwen built in. Cisco Talos also published an analysis of malware that hands the sorting of stolen data to an LLM.

Today's Top Three

A tampered Claude Code extension on Cursor's marketplace planted an SSH backdoor

Tampered builds of Anthropic's Claude Code extension were available on Cursor's extension marketplace for about 11 hours on October 29.

According to Cursor, the affected builds are versions 2.1.312 and 2.1.313 for Windows and macOS, available between 2:27 a.m. and 1:35 p.m. Pacific time. Cursor says the two versions were not developed by Anthropic.

The tampered extension collects the hostname, username, environment variable names, configured Git email and similar details, sends them to the attacker's server, adds the attacker's SSH key and tries to open a reverse tunnel. Cursor says that on most macOS and Windows machines the extension lacks the admin rights needed to turn on the SSH service, so the attacker could not log in through the tunnel there. The key, the persistence scripts and the host report did go through.

Cursor pulled the builds as soon as it detected them, shut the whole marketplace down, rotated its keys, rebuilt it and brought it back online. It also worked with the hosting provider to take the attacker's server offline.

Anyone who installed or updated the extension in that window is asked to check their SSH authorized keys for a key labeled "svc-telemetry". The payload drops persistence scripts that can keep running after the extension is uninstalled, so Cursor asks anyone who finds the key to remove those scripts too and to rotate credentials reachable from the machine, working from a trusted system.

Ars Technica reports that the builds were distributed through Anthropic's official account on Cursor and reached at most 5,000 users. At the time of the report, neither company had explained how the attacker gained use of that account. A co-founder of the security firm Phorion pointed out that Cursor extensions update automatically by default.

Apple Intelligence heads to China with iOS 27.3 and Alibaba's Qwen

Apple announced on its China newsroom on October 31 that the first set of Apple Intelligence features is coming to users in China.

The features enter the latest iOS developer beta on November 4 and reach users in China with iOS 27.3 in December. They include Live Translation, Writing Tools, Visual Intelligence, Clean Up in Photos, Genmoji, priority messages and summaries in Mail, and notification summaries.

Apple is working with Alibaba so that users in China can reach Alibaba's Qwen inside Siri, Writing Tools and Visual Intelligence. Users sign in with a Qwen account or with Sign in with Apple, and Writing Tools can ask Qwen to compose text from scratch.

The new Siri AI and the other next-generation features Apple announced at WWDC 2026 are not part of this update. Supported models are the iPhone 16 lineup and later, iPhone 15 Pro, iPhone 15 Pro Max, iPhone Air and iPhone Duo; Apple says support for other platforms will follow once the necessary approvals are in place. According to The Verge, Apple Intelligence was approved in China in July.

Cisco Talos dissects VOLTA, an infostealer that has an LLM appraise its victims

Cisco Talos published an analysis on October 31 of VOLTA, an infostealer that sends stolen data to an LLM and has it rank a victim's assets by monetisation value.

VOLTA targets Windows and deletes itself after running. It takes saved browser passwords and cookies, payment cards, cryptocurrency wallet seed phrases, Discord, Telegram, Steam and Roblox sessions, Microsoft OAuth tokens, and SSH and cloud-provider keys.

It then uses the stolen sessions to dig further. It searches the victim's Gmail for purchase receipts to confirm a home address and pulls order history from Uber Eats and DoorDash.

The collected data goes to an LLM through OpenRouter with instructions to write a "target assessment". The output includes a "WHAT THEY'RE WORTH" section that ranks valuables into low, medium and high tiers, and a "THEIR OPSEC" section that grades the victim's security habits, including password hygiene.

The default model is Anthropic's Claude Opus 4.6. If a reply contains refusal phrases such as "I can't", VOLTA moves on to Moonshot's Kimi K2 and then Google's Gemini 2.5 Flash, and it can skip the LLM stage entirely when no API key is set.

Talos says the novelty is that the AI works as an intelligence analyst for the operator. It adds that resilience to model refusals may become a standard design requirement as AI use in malware matures.

Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer (Cisco Talos)

Other Developments

Products

Ollie, an AI assistant built around privacy, will shut down its app on November 6, co-founder and CEO Bill Lennon said on X. The company raised a $7.5 million seed round led by Khosla Ventures in September. Ollie, a privacy-focused AI assistant, is shutting down (TechCrunch)

Research & Surveys

In a survey of 1,031 employees at Japanese companies by INDUSTRIAL-X, a Japanese DX and AI adoption consultancy, 64.5% of companies using AI reported some benefit and 10.0% reported clear results. Where senior management was actively involved, 24.3% reported clear results, about 3.7 times the 6.6% where it was not. AIエージェントは「実運用」が主流に　「明確な成果」を得る企業の共通点は？ (ITmedia Enterprise)

Policy & Society

Dartmouth provost Santiago Schnell resigned after a university committee found that he failed to disclose AI use in an academic paper and a Washington Post op-ed although the publishers required it. Logs from his university Claude account showed use for revising papers, fixing code and editing or generating figures. Dartmouth's provost warned us about AI cheating—but his own AI use cost him his job (Ars Technica)

Business

OpenAI has lowered the target for its new funding round to $20 billion, the Financial Times reported. The Wall Street Journal reported that the company has secured $11 billion so far. OpenAI reportedly lowers funding target for new round (TechCrunch)
Blackstone, the anchor investor in a $63 billion deal to finance Anthropic's chips, told investors it expects Anthropic to receive a double-B range rating after its IPO, according to the Financial Times. Blackstone had earlier said Anthropic would reach investment grade before 2027. Anthropic expected to receive high 'junk' rating from credit agencies following IPO, FT report says (TechCrunch)
Nvidia is in talks to guarantee billions of dollars in debt financing for Nscale's planned Anthropic data center in West Virginia, The Information reported. Nscale's IPO filing shows a $44.6 billion Anthropic contract for the first 460-megawatt building alone. Nvidia weighs playing the cosigner for Nscale's AI data center in West Virginia (TechCrunch)
Alphabet, Amazon, Meta and Microsoft have outlined more than $740 billion in capital spending this year, and investors are growing uneasy about negative free cash flow. On October 30 the Nasdaq fell 2.9%, Nvidia 4% and Qualcomm 11%. Cracks are emerging in the AI spending boom (TechCrunch)
Intel's stock fell about 28% on October 30, cutting the value of the US government's stake by $12 billion, according to CNBC. CEO Lip-Bu Tan said customers began signaling a PC slowdown because of memory prices and availability. Intel's stock crashes, knocking $12B from government's stake (TechCrunch)
OpenAI CEO Sam Altman said on the Cheeky Pint podcast that, from a global allocation view, it is "quite terrible" for the world's limited DRAM to sit in personal computers that use it five percent of the time. Sam Altman says it's better for RAM to be in a data center than on your desk (The Verge)

Source: selected by the editors from the AI news inbox (collected November 1, 2026: 12 items, 1 primary and 11 secondary).