Eversynced AI Weekly - November 2, 2026

Your Monday briefing on AI that matters for developers.

Issue #18 - October 26 - November 1, 2026.

This Week’s Big Move

For about 11 hours on October 29, Cursor’s VS Code Extension Marketplace served a backdoored copy of Anthropic’s Claude Code extension. Cursor’s security notice puts the window between “about 2:27am PT and 1:35pm PT” and, after an October 30 update, names two affected versions, 2.1.312 and 2.1.313, on macOS and Windows. The payload tries to add an attacker’s SSH key, labeled svc-telemetry, to authorized_keys, enable the local SSH service and open a reverse SSH tunnel. It then makes the tunnel persistent with a LaunchAgent on macOS or a scheduled task on Windows, and background scripts retry it roughly every 60 seconds. The Hacker News reports that Cursor puts the impact at “at most 5,000 users.”

Part of the payload broke. Cursor says the SSH service and tunnel steps would fail on most machines, partly because of errors in the malicious code and partly because enabling SSH needs admin rights the extension doesn’t have. The attacker’s server also no longer functions. But the same notice says the extension “added the attacker’s SSH key, installed persistence, and sent host details to the attacker,” and Cursor warns that uninstalling it “may not be sufficient” because the payload leaves standalone scripts running. The notice gives a one-line grep for the key on macOS, a PowerShell check for Windows, remediation steps and advice to rotate credentials and sessions from a trusted system. Cursor pulled the version, shut the marketplace down, rotated its keys and rebuilt the marketplace.

Nobody has explained yet how the attacker published under Anthropic’s name. Anthropic’s Felix Rieseberg said on X, per The Register, that a “malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish.” Anthropic’s GitHub releases carry a real v2.1.312 from October 27 and no v2.1.313. Phorion and OpenSourceMalware found a loader inserted at the start of extension.js, with the legitimate code otherwise unchanged (per BleepingComputer). Our read: a version number in a store listing says nothing about who built the file. Your editor’s marketplace is a supply chain of its own, separate from the vendor’s channels.

Three calls from past What’s Noise sections resolved this week. Mistral Large 4’s weights went up October 29, two days before the October 31 date given in issue 17. Google announced Gemini 4 Carbon, which issues 15 and 16 knew only through Business Insider. And HydraFusion, which issue 12 told you to test before quoting GitHub’s numbers, now has an independent score as part of Copilot Fusion (see Tools & Agent Updates).

Tools & Agent Updates

Claude Code v2.1.311 to v2.1.316 - Four releases from October 26 to 31 (v2.1.313 and v2.1.315 were never published). v2.1.312 stops sending the claude_code.safety_event OpenTelemetry event, which v2.1.307 added (covered last week), and caps prompt and agent hooks at 24 running at a time per session. v2.1.314 adds permissions.blockWritesOutsideWorkingDirectories, which makes Write, Edit and NotebookEdit refuse paths outside the working directories “in every permission mode.” v2.1.316 deprecates fast mode for Opus 4.8, with removal on November 30, and adds CLAUDE_CODE_SUBAGENT_EFFORT, which sets subagent effort when nothing else does, instead of inheriting the session’s.

GitHub Copilot Fusion - Generally available since October 28. It merges Project HydraFusion’s multi-model orchestration with Copilot’s auto model selection, in Standard, High and Max effort levels, across VS Code, the Copilot app, Copilot CLI and JetBrains. You pay each model’s standard rate, with a 30% discount for a limited time on paid plans. GitHub says Fusion Max scored 60 on the Artificial Analysis Coding Agent Index. The index itself shows 59.9 at $5.59 per task, against 61.7 at $11.42 for Claude Code with Opus 5.5 Max (with default fallback).

Vercel AI Gateway Virtual Models - Announced October 28. One virtual model ID stands in front of the real one, so you change models, set fallbacks, set priority and enforce Zero Data Retention in one place instead of in every app. Vercel counts 125 new models from more than 10 labs on the gateway in the last 90 days, about 10 a week.

Vercel CI - In beta since October 28. It reads your turbo.json (tasks tagged ci), runs only the tasks a change affects and starts only the compute those checks need. Vercel says time from git push to a passing run is “2-6x faster” for its own repos.

Who Gets the Frontier First

Three labs put out frontier models this week, and each one drew the cyber line in a different place:

• Gemini 4 Carbon - Announced October 28, and only “a subset of cyber defenders” can use it, with access widening to trusted partners through Google’s Fairwind Program. Developers get it “as soon as possible.” Google quotes 88.2% on SEC-bench Pro and #1 on v5.0 of the Artificial Analysis Intelligence Index at 59. Artificial Analysis still shows the 59, one point ahead of Claude Opus 5.5 (max, with fallback), and the Vals Index has Carbon second at 70.45%, behind Claude Sonnet 5.5. Its introductory price will be $2 input and $10 output per million tokens, then $4 and $20 when the introductory period ends. Google hasn’t said when that is.
• GPT-6.1 Terra - Released October 26 in the API as gpt-6.1-terra at $1 input and $5 output per million tokens, with a 1.05M context window, and in ChatGPT Work and Codex for Plus, Pro, Enterprise and Edu. Its system card treats it as Critical capability in cybersecurity and applies the safeguards OpenAI uses for GPT-6.1 Sol and GPT-6 Astra. OpenAI reports 50.3% on Terminal-Bench 4.0 at maximum reasoning effort. Vals puts Terra 11th at 60.54%.
• Mistral Large 4 - Weights posted October 29: 1T parameters, 49B active per token (52B counting embeddings and output layers) and a 1M context. Mistral’s post pitches self-hosted deployment and cybersecurity, reports a 96.6% average refusal rate on malicious cyber requests and keeps a specialized cyber variant in vetted preview. Vals has it 17th at 56.53%.

So the top model on Artificial Analysis this week is one you can’t call. Google gates Carbon by who you are. OpenAI ships Terra to paying users and API customers and relies on its safeguards stack. Mistral publishes the weights and cites its refusal rate. If a model’s cyber skill decides when developers get it, launch day matters less for your roadmap than the access list. Build on what your API key reaches today, and treat “as soon as possible” as no date.

What This Means for You

What Matters

• Run Cursor’s check if you use Cursor on macOS or Windows and it updated the Claude Code extension to 2.1.312 or 2.1.313 on October 29, or if you can’t rule that out. On macOS, grep -qs svc-telemetry ~/.ssh/authorized_keys finds the key, and the notice has a PowerShell check for Windows. If the key is there, follow the remediation steps, since uninstalling may not remove the scripts, and rotate credentials from a trusted system (security notice).
• Move off Opus 4.8 fast mode before November 30. After removal, those requests “return an error and do not fall back to standard Opus 4.8,” and the changelog says to migrate to Opus 5.5 (changelog).
• Turn on permissions.blockWritesOutsideWorkingDirectories to fence in file edits. Since v2.1.314, Write, Edit and NotebookEdit refuse paths outside the working directories in every permission mode. The changelog names only those three tools, not Bash (changelog).
• Read Mistral’s license before you offer hosted access to Large 4. Section 2 requires a separate commercial license if you or an affiliate operate a “Model as a Service business.” Section 3 exempts internal use, and the license’s definition of that term leaves out end-user products that only embed the model in specific features (license).

What’s Noise (for now)

• Kimi K3.1 Pro open weights. Moonshot promised them “by Nov 4, 2026.” When we checked for this issue, the moonshotai org’s newest model was still Kimi K3. Wait for the files.
• OpenAI models on Google Cloud. Announced October 21 for Model Garden, and OpenAI’s only timing is still that “general availability is planned in the coming weeks.” Wait for a date, a model list and pricing.

Our Take

The model picker is turning into a router, and that’s mostly good. Copilot Fusion bills you for whichever models it picks. Vercel’s virtual IDs let you swap the model behind your app in one place. With new models arriving that fast, nobody wants to hand-pick each one.

But “which model wrote this?” is getting harder to answer, and you’ll need that answer when an output goes wrong. Log the resolved model on every call, keep it with the trace and diff your evals by it. Without that log, the money a router saves goes into debugging outputs you can’t reproduce.

Quick Links

• Welcome Le Chonk - Hugging Face’s guide to Mistral Large 4, with day-0 transformers, vLLM and llama.cpp support
• Claude Code and game clones - Anthropic’s Addy Osmani: “We added two sentences to Claude Code’s prompt on Opus 5.5” to steer it off recreating someone else’s specific game
• GPT-6.1 Terra model page - Effort levels from none to max, and tool calling requires the Responses API
• AI relay disables sandboxes - Symantec on a relay that installs real Codex and Claude Code tools and makes dangerous configuration changes
• Aokigahara stealer - Check Point on malware that collects auth and config files from Claude, Codex, Cursor and Copilot

Glossary

Reverse SSH tunnel - A connection your machine opens out to an attacker’s server, giving the attacker a way back in. The Cursor payload tried to open one, and Cursor says that step fails unless the editor ran with admin rights.

LaunchAgent - A macOS file that tells the system to start a program at login. The malicious extension used one so its tunnel scripts came back after a restart.

Critical capability - OpenAI’s top risk level under its Preparedness Framework. GPT-6.1 Terra gets it in cybersecurity, so it ships with the same safeguards as GPT-6.1 Sol and GPT-6 Astra.

Fairwind Program - Google DeepMind’s early-access program for trusted defenders such as governments, healthcare and telecom. Google will widen Carbon access to more partners through it.

Model as a Service - Mistral’s license term for giving third parties inference or post-training access with meaningful control over inputs, parameters or training data. Operating that kind of business commercially needs a separate license. End-user products that only embed the model in specific features don’t count.

Coding Agent Index - Artificial Analysis’s score for an agent harness and model together, averaged over three benchmarks. Copilot Fusion Max’s score there comes from Artificial Analysis, not from GitHub.