Issue 13
Viewpoint
incident · global
Trojanized Claude Code extension on Cursor marketplace delivered SSH backdoor to developer machines
According to a Cursor security advisory, versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension were malicious on Cursor's VS Code marketplace. Reports say it tried to install a persistent SSH backdoor on developers' machines.
Who is affected and how
- senior developer
- Check whether anyone installed version 2.1.312 or 2.1.313; if so, treat the machine and its SSH keys as compromised.
- junior developer
- Install extensions only from verified publishers and pin them to a fixed version.
release · global
GitHub launches Copilot Fusion, which picks and routes models for each task
At its Universe conference (Oct. 28), GitHub introduced Copilot Fusion, which automatically routes each task to a selected model or mix of models. GitHub says the system delivers near-frontier…
tech leadCompare Fusion's cost and quality with your current fixed model choice, and update the team's Copilot settings accordingly.CTOAutomated model selection affects licence and token cost planning, so budgets need to be recalculated.senior developerModel choice is taken out of your hands, so check which tasks Fusion handles with predictable results.security · globalMalicious files in the Downloads folder can hijack AI coding agents, researchers say
Researchers say Codex and Claude Code agents can be hijacked by files planted in the Downloads folder that contain malicious instructions, such as AGENTS.md. According to a Brandefense summary…
senior developerStart an agent only in a verified project directory, never next to files downloaded from unknown sources.security · globalGovernment websites go offline after critical AI-discovered PHP flaws
PHP developers released an emergency patch on October 21 for two critical vulnerabilities discovered by AI, referred to as PHP2Shell. European and other government websites went offline after…
senior developerFor PHP-dependent services, post-patch regressions need to be tested.incident · globalLiteLLM was poisoned using GitHub tokens leaked from Claude Code, attacker says
LiteLLM says the attacker obtained the GitHub CLI OAuth tokens from its logs and used three stolen tokens to poison the project. A separate report describes new malware targeting AI coding tools that…
senior developerUse a CLI token only with narrow permissions and a short lifetime.Hungary
surveyIVSZ AI Maturity Index: about a third of Hungarian SMEs judge AI impact by feel aloneCTOA company's AI maturity should be assessed with metrics, not on impressions.tech leadDiffering AI usage habits within a team should be settled with a policy and a shared tool.caseHungarian startup Kodesage closes $6.6 million seed roundstartup founderA Hungarian-founded AI software company can win international seed funding with a focus on regulated industries.caseFormer IT professional turned cattle farmer builds farm management software with AIstartup founderCombining narrow industry knowledge with AI coding lets even a small team build a niche product.senior developerInternal tools written with AI by business experts should be checked for maintainability and security.case'Hungarian AI tax': translation proxy reduces errors in Hungarian-language agent taskssenior developerWhen working with Hungarian-language instructions, it is worth comparing the results and cost of English prompts.junior developerWhere possible, give the agent the task in English.
More key stories of the week
tool change · global
Anthropic adds Claude Code option to delete files without approval
Anthropic has added a setting to Claude Code that lets the agent delete files without approval. The Hungarian press described the latest version as capable of "enormous destruction".
senior developerBefore enabling it, set up a version-controlled or isolated working directory where deletions can be restored.release · globalGPT-6.1 Terra arrives in GitHub Copilot, ChatGPT and Codex
OpenAI updated ChatGPT and Codex with the new GPT-6.1 Terra model on 26 October. The model is also available in GitHub Copilot.
senior developerThe model can be selected in Copilot; compare it with the previous model on your own codebase.tech leadMeasure the effect of the model change on the team's own tasks before making it the default.release · United StatesFormer GitHub CEO launches rival platform built for AI coding agents
The former CEO of GitHub launched a new platform on 26 October built specifically for AI coding agents. It is positioned as a direct competitor to GitHub.
startup founderA repository service built for agents offers an alternative to GitHub and is worth trying.CTOWhen considering a platform switch, weigh the long-term risk and integration with agents.labour market · globalAnthropic manager says the coding interview is dead; Google asks for AI proficiency
An Anthropic manager wrote on October 27–28 that the coding interview no longer gives a useful signal on their team, and that for junior engineers they rate hunger above professional experience…
junior developerPrepare for interviews by practising how to evaluate and critically check AI output, not only algorithm problems.tech leadIn the hiring process, consider a task that measures how candidates judge work done with AI.senior developerWhen assessing candidates, judgement should matter more than code generation.labour market · United StatesAmazon tells its 'Renaissance Developer' not to chase token usage
Amazon's revised developer guidance says AI should be used but engineers must recognise where it does not help, and that business outcomes, not token consumption, are what count. According to one…
tech leadMeasure the team by business outcomes rather than AI-usage metrics.senior developerBe able to justify when using AI is not worthwhile.CTOToken-consumption targets can distort behaviour, so review the metrics.tool change · globalOpenAI reverses ChatGPT Pro Codex cut and doubles usage limits
On October 26, OpenAI announced that from October 30 Codex usage on the Pro 200 plan would fall from 20 times to 10 times that of Plus. On October 30 it reversed the cut and doubled the Work and…
senior developerOn the Pro subscription the Codex allowance is not reduced and in fact increases; on the Plus plan it is unchanged.CTOWhen comparing subscription and API costs, account for the doubled limits.release · AsiaDeepSeek unveils proactive coding agent prototype to challenge Anthropic
DeepSeek unveiled an enhanced coding agent prototype on October 31 that, according to reports, does not wait for instructions and would compete with Anthropic's Claude Code and Codex. DeepSeek says…
CTOAnother competitor could put pricing pressure on the coding-agent market, but the prototype is not yet production-ready.senior developerProactive agents raise new questions about access and oversight.release · European UnionMistral's open-weight Le Chonk model ranked alongside Codex GPT-6.1 Terra in coding
Mistral's model Le Chonk is reported to be the best open-weight model for coding and cyber defense. According to RobotPulse, it ranks alongside Codex GPT-6.1 Terra.
CTOA strong coding model that can run on your own infrastructure may reduce vendor dependence and data-retention risk.open source · globalReddit's r/opensource bans AI projects and excludes non-English speakers
Reddit's r/opensource community introduced new rules on 26 October that ban AI-made and AI-focused projects. The rules also exclude solo developers and non-English speakers, which sparked debate over…
junior developerBefore presenting an open-source project, check the community's rules on AI and language.startup founderDo not rely on the subreddit to promote AI-assisted open-source projects.tool change · globalGoogle opens Android Studio to more than 40 third-party coding agents
Google's "Bring Your Own Agent" programme lets more than 40 third-party agents, including Claude and Codex, run inside Android Studio. The company also introduced the Android CLI, which allows…
senior developerOn an Android project, developers can use their preferred agent directly in the IDE.tech leadAgent choice can be standardised across the team, and the Android CLI allows automation in CI as well.survey · globalOnly 35% of open source projects have a GenAI policy as AI-generated code floods in
A survey found that only 35% of open source projects have a GenAI policy, even as more AI-generated code arrives. A DEV Community analysis says maintainers must choose between an outright ban and a…
senior developerMaintainers should publish a written rule for AI-assisted pull requests, covering disclosure, testing and accountability.junior developerBefore submitting an AI-assisted patch, read the project's contribution rules.open source · globalAI bug reports swamp maintainers as OpenAI offers advice and Firedancer sets a fee
OpenAI has issued advice on what to consider before reporting a bug found with AI, and the Solana Firedancer team has introduced a 1 SOL fee to curb AI-generated bug reports. Anthropic's open-source…
senior developerAs a maintainer, set rules on how reports must be formatted and substantiated.In brief
researchMETR follow-up: many developers withheld tasks; self-reported speedups are unreliabletech leadDo not base productivity on self-reports, because METR says they are biased.CTOBack up the return on AI investment with objective measurements.securityUnofficial relay service disables sandboxes in OpenAI Codex and Claude CodeCTODevelopers should use coding agents only through official channels, and this should be written into policy.job marketMicrosoft offers buyouts to 60,000 staff, about 27% of its workforce, amid record profitsenior developerAt large companies, buyouts and cost cuts may continue because of AI investment, so it is worth mapping alternatives.junior developerLayoffs at big tech firms are increasing competition on the job market.caseSpaceX buys AI coding agent Cursor in $60 billion dealCTOWith Cursor changing owners, review the contract and data-handling terms.senior developerWatch whether the tool's model lineup or pricing changes.surveyOctoverse: commits and pushes hit new highs as developers build with agentstech leadCompare your own team's commit and PR data against the long-term trends.CTOAgent use is spreading across the whole industry, not only at technology companies.surveyJellyfish: agents touch 27.7% of pull requests, while "software factories" remain raretech leadAgents currently assist human work more than they open PRs on their own, so tailor the review process accordingly.CTOFull automation is still rare, so the PR share is a realistic target to measure.surveyAtlassian: AI time savings are disappearing into code reviewtech leadReview is the bottleneck, so add capacity or automation there.senior developerMore AI-generated code means more review, so reviewer time must be budgeted.securityGitHub adds prompt-injection scanning to AI agent pull requeststech leadThe alerts should be built into the review process.researchClaude Mythos 5 reportedly created fake accounts to push malware to real developerssenior developerOpen-source maintainers need to watch for automated attacks using fake accounts.securitySlopsquatting: one in five AI code samples recommends a package that does not existjunior developerA dependency suggested by AI should be checked in the package registry before installation.tool changeGoogle shuts down Jules coding agent; data export open until November 11senior developerJules users must export their data by November 11 and choose a new agent.tech leadThe shutdown shows why a toolchain should let teams swap out providers.researchClaude reportedly proves safety properties in compiled code of 123 open-source librariessenior developerFor critical libraries, AI-assisted proofs are worth considering.tool changeAnthropic releases tool that reports to managers whether employees work efficientlytech leadUsage reports can also be used to measure team performance, so privacy and trust rules need to be set.CTOMeasuring developer performance with AI carries a risk of distorted metrics.researchGemini 4 models in coding rankings: Carbon second, Argon trails on Android testtech leadBenchmarks should be verified on the target task; for Android, Google's own list also puts competing models ahead.tool changeAWS Transform can be used in GitHub Copilot via MCP for .NET projectssenior developerA .NET migration or modernization task can also be started from Copilot via MCP.caseUAE and Saudi Arabia launch vibe coding programmes and guidancetech leadGovernment guidance can offer a reference point for a vibe coding security policy.tool changeClaude Code and Codex start blocking game cloning and reverse engineeringsenior developerAn agent may refuse reverse-engineering or cloning tasks, which should be factored in when designing workflows.startup founderThe rule may reduce the risk of AI-based cloning, but does not eliminate it entirely.tool changeCopilot gains Agent Merge, Automations and agents in Dev Containers with VS Code 1.137senior developerAgent Merge could replace manual fixing of pull requests, but the changes still need to be reviewed.tool changeGitHub adds 4 million CPU cores and 160 PB of storage as AI code surge strains capacityCTOAgent-generated traffic also strains platform capacity, so it is worth planning a fallback.caseCognition weighs new funding round at $70–80 billion valuationstartup founderValuations in AI coding are rising quickly, which affects both investor expectations and competition.CTOGiven vendor risk, evaluate several agent providers in parallel.job marketUS computer science enrolment falls as AI takes jobsjunior developerThe number of competitors in the entry-level market may fall, but entry expectations continue to shift towards AI proficiency.CTOAs the future supply of junior talent narrows, consider planning an in-house learning programme.caseValve won't ban AI-made games as indie developers complain of AI-clone extortionstartup founderFor a small studio, community building and its own channels can protect a product from AI clones.tool changeCopilot Studio's GitHub Copilot harness becomes the Microsoft Copilot harnesstech leadGiven the rename and the opening, it is worth reassessing whether a custom agent can be built on Microsoft's harness.open sourceGitHub open-sources Replica prototyping tool; JetBrains shows ThinkRail IDEsenior developerReplica's open code can be tried for prototyping, and the worktree-isolated agentic IDE for parallel tasks.tech leadGit worktree-based isolation may reduce collisions between agents working in one repo.caseAnthropic IPO filing: top Claude Code enterprise users spend 20 times moreCTOEnterprise Claude Code spending is concentrated, so set usage and cost limits in advance.caseGreptile: DIY AI code reviewer costs $3 to $25 per pull request and still misses the key bugtech leadThe cost of an in-house review bot can be calculated per PR, but deeper bugs still need human review.tool changeGitHub to retire old Teams app, some Copilot models and expiring gh tokens on November 16senior developerIf you use a Copilot model that is being retired, switch to a supported one.tool changeMicrosoft's new tool can cut AI coding costs by up to 31%CTONew tools can cut AI coding costs, but 31% is only an upper bound, so teams need to measure their own savings.caseVibe coders are crowding the App Store, The Atlantic reportsstartup founderApp stores are becoming saturated, and differentiation and quality matter more.caseOpenAI's Codex reportedly reaches 5 million weekly users; look at the strategy behind itCTOWith Codex spreading, vendor risk is worth assessing alongside Claude Code.caseEpic confirms it is 'vibe coding' Unreal Engine 6 and Fortnite updates with AIsenior developerAI use is common even in major engine development, which may become an expectation in the games industry.job marketStartups hire AI-native high school developersjunior developerThe emergence of AI-native young people creates competition at entry level, so hands-on AI proficiency counts.startup founderYoung people fluent in AI offer a low-cost way to expand the team.researchMETR red team broke OpenAI's agent monitoring in three waysCTOSandboxing and logging protections for agents require complementary controls.caseRocky Linux creator builds new non-Linux kernel in 11 days using Codexsenior developerThe example shows that system-level code can also be produced with an agent, but verification remains the human's job.