What's Up Claude Code: Week of October 26th

TL;DR

This week’s story is containment. A malicious build of the Claude Code extension sat in the Cursor Marketplace and planted an SSH backdoor on machines that installed it. Anthropic’s changelog answered with new controls: permissions.blockWritesOutsideWorkingDirectories in 2.1.314, and a --restricted upload fix in 2.1.316. If you run agents on a laptop with access to ~/.ssh, this week’s changes are worth reading today.

Security first

Trojaned extension in the Cursor Marketplace. A build labelled anthropic.claude-code 2.1.313 in the Cursor Marketplace was compromised. According to Cursor’s own security notice (Oct 29), it affected up to about 5,000 installs and Open VSX was not affected. Two independent write-ups describe the same behaviour: an attacker SSH key added, sshd enabled, and a reverse tunnel opened. Anthropic has not issued a statement as of this writing.

What to do if you installed it on or after Oct 29:

Reinstall the extension from a source you trust.
Check ~/.ssh/authorized_keys for keys you do not recognise.
Search logs for the tunnel IP named in the advisory, and rotate tokens and SSH keys if anything hits.

Write guard for agents (2.1.314). permissions.blockWritesOutsideWorkingDirectories makes Write, Edit and NotebookEdit refuse paths outside the working directories in every permission mode. It does not cover Bash. Paths outside the repo still need deny rules or sandboxing. Set it in user or managed settings if agents touch dotfiles, ~/.ssh or sibling repos.

Restricted-mode upload fix (2.1.316). In --restricted sessions, a Read allow rule could reach files outside the working directories, and those files could be uploaded. Fixed in 2.1.316. Upgrade if you use restricted mode for shared or untrusted repos, and review Read allow rules that point outside the project.

Single-report bugs to treat with care (reports, not confirmed defects):

A subagent running with isolation: worktree reportedly ran rm -rf against a real home directory (#105342). Worktree isolation did not contain it. Deny rm -rf on $HOME with a deny rule or PreToolUse hook.
Glob reportedly ignores CLAUDE_CODE_GLOB_NO_IGNORE=false again on 2.1.316, so gitignored .env files can reach the model (#106461). Do not treat Glob as a secrets filter until this is confirmed fixed.

Claude Code changes

Subagent effort. CLAUDE_CODE_SUBAGENT_EFFORT (2.1.316) sets the default effort for subagents instead of inheriting the session’s. Useful for capping cost in orchestrator setups. The changelog does not state precedence against per-agent frontmatter, so test before relying on it.
Opus 4.8 fast mode is going away. Fast mode on Opus 4.8 was deprecated Oct 30 and is removed on Nov 30. After that, requests error instead of falling back. The changelog names Opus 5.5 as the migration target. Find any config, alias or script that pins Opus 4.8 with fast mode before the deadline.
Scheduled runs and custom connectors. An open regression (#106037) reports that scheduled runs miss custom claude.ai connector tools for the whole run. A green run status does not prove a tool was used, so have scheduled prompts confirm the tool is callable first.
Background sessions and worktrees. An open issue (#89188) shows the write guard can contradict EnterWorktree, and a hand-made worktree bypasses the guard. Treat the guard as a convenience, not a security boundary.

AI-industry signal (Latent Space AINews)

These are reported claims, attributed to the Latent Space write-ups.

Anthropic S-1. Latent Space’s Oct 27 issue covers a reported filing for a roughly $2T IPO, with cloud partners reported as a large share of revenue. Treat the figures as claims until the filing is checked directly.
Gemini 4 Carbon. Google DeepMind’s Oct 29 launch is reported to top independent leaderboards. Access is initially limited to cyber defenders, and the cyber benchmark numbers are Google’s own claims.
Coding interviews. An Anthropic hiring manager’s essay (reported Oct 28) says he has stopped running coding interviews, since Claude now outperforms the tests. Opinion, not policy.

Community projects

These come from Reddit posts in the reporting window. Each post’s date is from Reddit. I haven’t confirmed the repo dates yet, so treat the “new” label as unverified.

global-law (r/ClaudeAI, Oct 29, 832 points). A project that puts global law into Git with Claude. Repo · Reddit thread
voiceolator (r/ClaudeCode, Oct 26, 31 points). Opus built an app that isolates voices from audio streams. Repo
Kanzo (both subs, Oct 26, 56 points). A tiny self-hosted kanban board that you and your coding agents can share. Reddit thread

Community events

Events from src/data/events.json, synced from Luma. Reporting week (Oct 26 to Nov 1): 44 dated events. Following week (Nov 2 to 8): 30 dated events. Every dated event is listed.

Reporting week, 44 events 2026-10-26