Phorion found a persistent SSH backdoor in versions 2.1.312 and 2.1.313 of the official Claude Code VS Code extension on the Cursor Marketplace. Cursor has removed both versions. Developers and teams who installed the extension should check their machines now, since the payload runs as soon as the extension loads.
OpenAI now gives eligible $100, $200 and $500 ChatGPT subscribers the same dollar amount in credits for an API organization. It mirrors a benefit Anthropic announced earlier this month for its Max and Team plans. For developers who pay for both a coding assistant subscription and API usage, it changes the cost math.
Simon Willison highlights Jacob Sansbury's account of building Spawn, a multiplayer game world changed by prompts to an in-game AI. The team says a swarm of Fable-powered agents edits live code and ships to production about hourly. It is a rare, concrete look at how far coding agents can run autonomously in production.