Cursor expands the list of malicious extension versions

  • Cursor adds an earlier Claude Code version to its warning — Review installation history for both affected versions, because updating the extension can leave the attacker’s separate startup scripts behind.
    • Today’s 11:30 a.m. Pacific update adds version 2.1.312 alongside 2.1.313 for macOS and Windows packages distributed through Cursor’s extension marketplace.
    • The dated response instructions specify October 29, approximately 2:27 a.m.–1:35 p.m. Pacific, as the exposure window. Compare historical installations with the updated platform-specific package hashes.
    • The payload plants a key for SSH, a remote-login service, and startup files that keep attempting a return connection. Failed service activation can still leave those files installed.
    • The updated notice and cleanup guidance call for isolating affected hosts, removing persistence and rotating accessible credentials from a trusted machine.
    • Anthropic’s incident response distinguishes Cursor’s distribution from the unaffected official VS Code marketplace and OpenVSX. Matching a version number alone leaves the distribution source unresolved.
    • Our earlier Security account names only 2.1.313. The expanded version list changes which historical installations need investigation.
    • Caveat: The marketplace operator leaves its initial compromise and successful attacker logins unresolved, despite reporting that the attack server is offline. (HN 606 points · 408 comments · lobste.rs · updated operator notice and technical payload analysis)

Claude changes when subscribers can spend their weekly allowance

  • Anthropic removes five-hour limits for verified Ultra subscribers — Longer coding sessions can consume an existing weekly allowance without waiting for a session reset once the account qualifies.
    • Today’s announcement renames Max 5x to Max at $100 monthly, and Max 20x to Ultra at $200 monthly. Existing subscriptions move automatically without a price change.
    • The announcement says weekly limits remain unchanged. The current plan documentation describes Ultra’s weekly allowance as ten times Pro’s, separately from the former plan name.
    • Verification happens automatically using account and payment history. Newer accounts retain a temporary session limit, and verifying a phone number is a separate process.
    • Check Settings > Usage: the help page says a verified account has no Current session bar. Claude Code and chat continue drawing from the same subscription allowance.
    • Caveat: Ultra still has weekly limits, including a separate Fable limit, and Anthropic reserves additional capacity restrictions. (Techmeme · exact announcement, pricing page and account-verification documentation)

One local model pass can answer many classification questions

  • Spinf publishes a server that scores many questions per document — Bulk tagging and routing can reuse a document’s processing while returning scores for predefined answers rather than generating a separate response each time.
    • The Apache-2.0 project describes version 0.1 and an OpenAI-compatible API. It listens on all interfaces without authentication by default, so configure --token and restrict network access.
    • The default twelve-billion-parameter Gemma model uses one 24 GB Nvidia GPU. The documented setup needs Linux, CUDA 13 support and Python 3.12, with weights stored at lower precision to fit in less memory.
    • In the public comparison, 24 articles each receive 56 questions. On one RTX 4090, those 1,344 questions take 2.74 seconds after warming, versus 6.72 for vLLM.
    • The vLLM 0.26 comparison already reuses repeated prompt beginnings and allows 128 simultaneous requests. Spinf packs questions into shared passes, so the comparison concerns many questions about each document.
    • Its score documentation separates probability among supplied answers from correctness. Check thresholds against labeled examples and preserve question wording when comparing scores over time.
    • Caveat: The maintainers also sell hosted access, and these are their warm classification measurements rather than independent evidence of faster general chat or equivalent answer quality. (HN 13 points · 0 comments · public code, comparison procedure and implementation-status documentation)

Delta explains how it stores every edit without copying everything

  • Delta details how its database preserves parallel coding histories — The new engineering account offers concrete storage and synchronization choices for keeping code changes tied to the conversations that produced them.
    • October 29’s account represents changes as a graph of their dependencies. Its compact version marker tracks open branches, avoiding permanent counters for every short-lived assistant or remote workspace.
    • The database uses CRDTs, data structures that merge concurrent changes consistently, stored locally in SQLite. Offline edits apply immediately and synchronize when a connection returns.
    • Cached snapshots share unchanged tree nodes. Reconstructing an older state starts from a cached ancestor and replays intervening edits, reducing the need for complete copies.
    • Each conversation synchronizes through its own Cloudflare Durable Object, an addressable process with transactional storage. This separates conversations, while simultaneous writers within one conversation still share that process.
    • This adds implementation detail to our August introduction, rather than announcing the product again. An agent is a model running a multi-step task with tools.
    • Caveat: The documented Claude Code plugin uploads conversation and checkout contents, including uncommitted files, to Delta’s service when syncing is enabled. (lobste.rs · complete engineering account, current plugin documentation and earlier published coverage)
All gathered items - what was cut and why (10)