AI news for Saturday, October 31, 2026: AI turns Firefox fixes into exploits, fake Claude Code hits Cursor

Two security stories that should change your week, one opt-out that changes the web, and AI money that just got pickier.

Safety Open source3 min
GLM 5.3 turns Firefox fixes into exploits in 12 hours
Epoch AI says Z.ai's open-weight GLM 5.3 built working exploits for all six Firefox releases it tested, at about $1,000 each, by reading public security fixes. If you ship software, the gap between a public fix and an installed update is now an attack surface.
Why it matters Any team whose fixes sit in public code before users have the update is now racing a model anyone can download, for the price of a laptop. Shorten that window this quarter, and stop treating "fixed upstream" as "safe" on your own machines.
SRCEpoch AI
Safety Agents3 min
Fake Claude Code extension backdoored Cursor users
Cursor says tampered versions 2.1.312 and 2.1.313 of the Claude Code extension sat in its marketplace for about 11 hours on Oct. 29 and tried to plant an SSH backdoor, reaching at most 5,000 users. Uninstalling may not be enough, so check for the key today.
Why it matters If you use Claude Code inside Cursor on a Mac or Windows machine and it updated on Oct. 29, search your authorized_keys file for "svc-telemetry" now and rotate credentials. If you don't, the lesson still lands: the store your editor installs from is part of your supply chain.
SRCCursor
Policy Business3 min
OpenAI, Google, Microsoft back one AI training opt-out
A new robots.txt token, __usage_ai-training, lets a site state one preference against AI training, and OpenAI, Google, Microsoft and Anthropic say they will support it. It is a request, not a lock, and it does not cover AI answers.
Why it matters If you publish anything online, you can soon say no to training with two lines instead of a list of crawler names. But training and AI search answers are separate choices, only Microsoft has a control for answers so far, and nothing here pays you or guarantees traffic.
SRCIETF Datatracker
Business3 min
OpenAI cuts its raise to $20B as AI stocks slide
OpenAI now seeks about $20 billion at a $1.25 trillion valuation, down from $30 billion at $1.4 trillion, the Financial Times reports, as S&P turned Meta's outlook negative and the Nasdaq fell 2.9% on Friday. The money paying for your AI tools just got pickier.
Why it matters The cheap tokens and generous plans you build on are paid for by investors betting on future profits. When those investors start asking for proof, prices, limits and free usage are where it shows up first. Price your product as if your AI costs could rise.
SRCCoinDesk (citing the Financial Times)
Hardware Research2 min
Google's orbiting TPU answers its first AI prompt
Google says its Project Suncatcher prototype satellite ran Gemma 4 on a data center class TPU in orbit and sent back a haiku, a month after its Oct. 1 launch. The poem is a demo. The radiation and heat tests that come next are the real story.
Why it matters Power and space for data centers are the constraint behind every AI price you pay. Google is testing whether some of that compute can live in orbit. Nothing changes for you this year, but watch the 2027 twin-satellite test before you dismiss it.
SRCGoogle

ShareX LinkedIn Hacker News Email

Prompt of the day

Find the weakest links in your developer tool supply chain

› Act as a blunt security reviewer for a small software team.

Here is what we install on developer laptops and in CI: [paste your editor extensions, package managers, CLI tools and CI actions].
Here is how we ship security fixes: [describe: public or private repo, beta channel, release cadence, how users update].

1. For each tool, tell me who publishes it, where we get it from (the publisher's official channel, a third-party marketplace or a mirror), whether it updates automatically, and what it can reach on a laptop (files, SSH keys, environment variables, network).
2. Rank the five that would hurt most if a tampered version shipped tomorrow. For each, give one concrete control: pin the version, verify the publisher, turn off auto-update, or limit its permissions.
3. Estimate how long one of our security fixes is visible in public before most users have the update. Give three specific changes that would shorten that window.
4. Write a ten-minute checklist I can run on one laptop today to spot an unauthorized SSH key, a new startup item or a reverse tunnel.

Ask me for anything you need before you answer. No generic advice: every line should name a tool or a step from my list.

Open in Magai

Works in any AI chat. In Magai, run it against several models at once.

Get every edition

This one arrived in inboxes at 6am ET.

GLM 5.3 turns Firefox fixes into exploits in 12 hours

Fake Claude Code extension backdoored Cursor users

OpenAI, Google, Microsoft back one AI training opt-out

OpenAI cuts its raise to $20B as AI stocks slide

Google's orbiting TPU answers its first AI prompt