If you run Cursor with Anthropic's extension installed, stop reading for a minute and check which version you have. Everything else in this post can wait. That one can't.
Friday's news had a common thread, and it isn't a model release. It's the layers you build on but never look at: the extension marketplace that auto-updates your editor, the credit markets that pay for your API provider's GPUs, the robots.txt file that decides what gets into training data, and the actual demand behind the agent-commerce pitch. Every one of them got stress-tested this week. So I've sorted today by what you should do about each one, not by how big the headline was.
Do this today: audit your Cursor extensions#
According to Ars Technica, version 2.1.313 of Anthropic's official VS Code extension went out through Anthropic's own verified account on Cursor's marketplace and carried a backdoor. Cursor says it reached “at most 5,000 users.” The payload tried to add an attacker-controlled SSH key, turn on the local SSH service and open a reverse SSH tunnel, and it was written for Windows, macOS and Linux. It also grabbed environment variable names, which Phorion says let the operator see quickly which machines held cloud credentials and API tokens worth going back for.
“It was a supply-chain compromise where the attacker gained access to the official distribution channel.” — Luke Roberts, Phorion CTO, to Ars Technica
Your affected window is any install or update between 5:27am and 4:35pm ET on Thursday. Anthropic shipped 2.1.314 several hours after the bad version appeared. Cursor cut off the command server, pulled the package and briefly shut down its marketplace to rotate keys. Bugs in the Windows and macOS code stopped the backdoor in some cases, but Phorion still calls it a significant threat that sets up persistence.
Two things bother me more than the malware. First, nobody has explained how the attackers got into Anthropic's account. Second, as of Ars's report Anthropic hadn't publicly warned customers. A company that sells its agents on trust lost control of one of its signing identities for half a day and said nothing. Updating to the fixed version does not remove an SSH key that has already been planted.
Here's my checklist for the weekend:
Check ~/.ssh/authorized_keys on every machine running Cursor and remove any key you don't recognise.
Check whether sshd is enabled on dev laptops that never needed it.
Rotate every token that lived in an environment variable on those machines. The env var names were the reconnaissance.
Turn off extension auto-update for anything that runs with your IDE's permissions, and pin versions. Cursor ships with auto-update on by default.
We spent the year arguing about prompt injection. This attack used the oldest trick in the book: steal the publisher's account.
Plan for it: the money behind your API is getting nervous#
Separately, the Financial Times reports via TechCrunch that Blackstone, the anchor investor in a $63 billion chip-financing deal for Anthropic, now expects Anthropic to get a double-B rating after its IPO. That's the top tier of junk. Blackstone had previously expected investment grade before 2027. It's a forecast, not a ruling from a rating agency, but it raises the cost of every dollar Anthropic borrows for compute.
The same day, Nvidia was reported to be weighing a guarantee on billions in construction debt for Nscale's West Virginia campus, where Anthropic has signed a $44.6 billion contract for the first 460-megawatt building alone. Under the structure, Nvidia would take over the site if Nscale defaulted and find a new tenant. So the chip seller is now also the lender of last resort. The Information puts Nvidia's total investments and credit support for neoclouds and big customers at about $170 billion.
The wider market wasn't calm either. TechCrunch's roundup of the spending boom has Alphabet down 12% on Thursday, its worst day on record, and the Nasdaq off 2.9% on Friday. It also counts $326 billion in 2026 debt raised by the five biggest spenders, about triple last year.
The practical point for builders is simple. Your inference price is now partly set by credit spreads. If you've put all of your production traffic behind one frontier provider, this is the week to make sure your abstraction layer actually works. Run your evals against a second vendor before you need it, not after a pricing change.
Ship it when your crawler policy is due: one token for four labs#
Some news that's actually helpful. The Verge reports that OpenAI, Google, Microsoft and Anthropic will honour a shared “policy token” in robots.txt that opts a site out of AI training across all of them at once. Anthropic's Kevin Kelley proposed it at the IETF. Anthropic already supports it. Google and Microsoft plan to add support next year, and OpenAI says “coming months.” Microsoft will also let sites opt out of grounding separately from training, without dropping out of Bing. Meta says it supports the idea but hasn't committed to honouring the token.
If you run a content site, I'd add it now even though only one lab reads it today. It costs nothing and makes your preference machine-readable when the others catch up. It doesn't replace Cloudflare's blocking or RSL-style licensing. It's a polite request, and it only works on crawlers that are polite.
Ignore the hype for now: agents buying burritos#
Agentic commerce had a reality check on DoorDash's earnings call. CEO Tony Xu said third-party AI agents have brought in roughly “several hundred” orders in total, TechCrunch reports. DoorDash completes about 3 million deliveries a day. Ars Technica ran the same number. Xu was candid that nobody should be “delusional” about the current size. DoorDash still ships its own chatbot, a CLI agent, a text-to-order agent and an MCP connector, and it floated running ads inside third-party agents.
I read that as DoorDash building the pipes and waiting. If you're pitching a consumer agent on transaction volume, this is the number your investors will quote back at you. Enterprise ordering through MCP looks like the more realistic wedge for now.
Worth a look this weekend#
Google's Project Suncatcher booted the TPUs on its test satellite and got a Gemma 4 model to write a haiku from orbit. Radiation and thermal testing come next, then two linked satellites in 2027. It's a cute demo with a serious question underneath: whether compute can escape the grid fights on Earth.
Neuron steering went hobbyist: pseudonymous developers pushed single neurons in open Qwen models into producing hostile output. The open-source Neuron Explorer tool works with Claude through MCP. VentureBeat hasn't reproduced the results, and the prompt set is tiny, but interpretability has clearly become a weekend hobby.
One prediction. Within a month we'll see the first serious push for signed, reproducible builds of AI coding extensions, probably from an enterprise security vendor rather than from the labs. Your coding agent's extension can do anything your IDE can. Until publishers can prove where a build came from, I'm treating every auto-update as untrusted code running on my laptop. That's what it was on Thursday.