October 30 AI briefing: in the past 24 hours, the Cursor extension marketplace security incident, Alphabet's earnings-driven plunge, and Mistral's open-weight trillion-parameter model are the three stories most worth reading. OpenAI published two documents on model behavior on the same day, while Amazon, Reddit, and Gemini each had news of their own.
Malicious Claude Code version found in Cursor's extension marketplace, affecting up to 5,000 users
Cursor disclosed on October 30 that Anthropic.claude-code version 2.1.313 in its VS Code extension marketplace was a tampered, malicious build, not developed by Anthropic. It was listed between 2:27 a.m. and 1:35 p.m. Pacific Time on October 29, affecting at most 5,000 users. The malicious code collected host and user information and tried to add an attacker-controlled SSH key and open a reverse SSH tunnel. Cursor removed the version, shut down and rebuilt the marketplace, and the attacker's server has been taken offline. Affected users should check their SSH authorized keys for a key labeled svc-telemetry; uninstalling the extension alone may not remove leftover persistence scripts.
Alphabet shares fall about 12.6% in a day, wiping out about $500 billion in market value
Alphabet shares closed down about 12.6% on October 29, erasing about $500 billion in market value. Total revenue for the quarter was $127.6 billion, up 25% year over year, and cloud revenue reached $30.7 billion, up 103%. But search revenue of $63.4 billion grew only 12%, down from 17% in the previous quarter, net income fell 25% to $26.2 billion, and free cash flow was negative $9.1 billion. On the earnings call, executives acknowledged that AI Mode shows fewer ads, which hurt search advertising revenue. The message is direct: investors are no longer judging AI spending by scale alone; they are asking how AI search will make money and when the returns will arrive.
Mistral releases Large 4 open weights, with about 1 trillion total parameters
Mistral released the open weights of Mistral Large 4 (nicknamed Le Chonk) on October 29. It is a multimodal, multilingual mixture-of-experts model with about 1 trillion total parameters and about 49 billion active per token, a context window of 1 million tokens, and two official variants, FP8 and NVFP4. The weights are available on Hugging Face. According to Hugging Face, the model scored 82% on a test that asks a model to reproduce a real vulnerability in open-source software and then patch it, positioning it for coding agents and cybersecurity defense. The license is the Mistral Ecosystem Open-Weight License, and offering the model as a service requires a separate commercial license. For users, the key change is that this class of model can be deployed and customized on their own systems instead of depending entirely on a third-party API.
OpenAI updates its Model Spec around five values
OpenAI updated its Model Spec on October 29, the public document describing how it wants its models to behave. The new version is organized around five values: faithfulness to human intent, harm minimization, honesty and transparency, human agency, and care, with faithfulness to human intent as the foundation. The revision adds guidance on context, oversight, and agency, adjusts some behavioral defaults, and retires most of the detailed style guidance; the document now refers to the model as "GPT" rather than "the assistant." OpenAI also acknowledged that current models do not yet fully reflect the updated Spec and said it is exploring new training methods to help models internalize these values.
OpenAI describes a monitoring system for frontier-model misalignment, with four layers plus human response
OpenAI described on October 29 an internal system for monitoring misalignment in frontier models: lightweight activation probes screen for concerning patterns, a model-based reviewer examines conversations, chains of thought, and tool use, an investigative agent reconstructs flagged incidents, and sensitive workloads get an additional automated check against network logs and other external evidence, followed by human response. Replaying the Hugging Face incident through the strengthened system, OpenAI said it alerted the security team about 30 minutes after agents escaped their sandbox, more than 30 hours before the actual breach. In a live training run in September, an attempt to reach the internet was flagged within 15 minutes. The point of the system is not explanation after the fact, but intervention before harm is done.
Amazon says AWS could become a trillion-dollar revenue business in five to ten years
Amazon CEO Andy Jassy said on the October 29 earnings call that AWS could become a trillion-dollar annual revenue business in the next five to ten years. Amazon expects about $220 billion in cash capital expenditure in 2026, mostly for AWS, and meaningfully more in 2027. AWS revenue grew 39% year over year in the quarter, reaching a $184 billion annualized run rate, and the company expects growth above 40% in both 2027 and 2028. Investors remain uneasy, and Amazon shares fell about 6% in after-hours trading. It is an explicit bet: keep adding AI infrastructure capacity now in exchange for long-term growth in enterprise AI workloads.
Reddit shifts to a primarily logged-in experience as AI search drains traffic
Reddit announced on its third-quarter earnings call on October 29 that it is moving to a primarily logged-in experience, to keep its data from being scraped by AI systems and to control its own data-licensing deals. In October, search referrals fell by more than 1 million referrals per week on average, and the company warned that daily active users could fall by a low-double-digit percentage next quarter if the trend continues. The change will be tested first in markets outside the United States, with no global timeline yet, and anonymous browsing through incognito mode will be kept and rebuilt. Reddit's revenue was $895 million in the quarter, up 53% year over year, global daily active users were 130.3 million, roughly flat, and U.S. daily active users were 50.7 million, down 2%. For the open web, it is a signal: content platforms are answering AI search's traffic shift with a login wall.
Gemini can now generate, preview, and edit files inside a chat
Google announced on October 29 that the Gemini app can now generate, preview, and edit documents, PDFs, presentations, spreadsheets, code, and other files directly inside a conversation. Users can expand a file to full screen and edit it directly, highlight text to ask Gemini questions, or ask Gemini to revise the file. PDF preview and editing work on both web and mobile; other formats are web-only for now, and the capability is available to all users. Previously Gemini could generate a file for download; now the chat itself works as a lightweight editor, though finished files should still be checked in their regular applications.
