LodeHQ
AI news for people who shipFree, by email

AI · Saturday, 31 October 2026 · Issue 156 · 11 stories

Cursor's fake Claude Code extension can survive uninstalling, so check for svc-telemetry

A tampered Claude Code extension in Cursor's own marketplace left SSH backdoors that survive uninstalling, so anyone who updated on October 29 should run Cursor's check. It is a reminder that extensions in VS Code forks' marketplaces need their own vetting.

Models & Releases

Clover, a 35B diffusion language model, beats Qwen3.6-35B-A3B on agent benchmarks

DiffuSpace released Clover-35B-A3B-Preview under an Apache license. It is a mixture-of-experts diffusion language model, which generates the whole output in parallel instead of one token at a time, with 35 billion parameters and 3 billion activated. It scores 73.6 on SWE-bench Verified and reaches 680 tokens/s on internal agent workloads on a single NVIDIA GB300 GPU. DiffuSpace says it outperforms the similarly sized Qwen3.6-35B-A3B.

huggingface.co ↗6 min read at source

Pika opens H3 Flex weights, generating 15-second clips in as little as 7 seconds

Pika H3 Flex is a video model post-trained on MiniMax H3 that makes video with matching audio, and Pika is releasing it as open weights on Hugging Face with inference code on GitHub. Pika says it is 1.8x faster than H3Max and up to 80% cheaper, and takes up to 12 reference inputs. Local weights run at 480p and 768p; the 4K upsampler and audio-stem separation stay Pika-hosted features.

pika.art ↗4 min read at source

Nace's Drex Max scores every option instead of writing text, and fits 24 GB Macs

Drex Max is a 27B-parameter model that answers typed questions about a given context by returning a probability for every option in one forward pass; nothing is generated. A readout head covers up to 255 options. It scores 67.52 on the public Decision Index 0.4 and 64 on the Artificial Analysis Decision Index, fourth of 18. The affine Q4 checkpoint runs on Apple silicon Macs with 24 GB of memory or more.

huggingface.co ↗6 min read at source

Research

Pretraining, fine-tuning and reinforcement learning can share one training algorithm, researchers show

A new paper recasts pretraining, midtraining, supervised fine-tuning and suitable reinforcement learning as one maximum-likelihood objective. Every source, from static text to the model's own RL attempts, becomes weighted examples for a single trainer, so the design question becomes which data to mix, and when. Staged training is one special case. In their tests, mixing reduced forgetting and reached higher accuracy and coverage at larger compute budgets.

yudasong.github.io ↗12 min read at source

No AI model beat a simple hiring-growth rule at picking fast-growing startups

Mento's SAB benchmark tests 14 models from four vendors on 960 startup research tasks and 101 ranking cohorts. Claude Opus 5.5 leads the research tasks with 97.2 of 100 points, but every model still gave a value for some facts removed from the corpus, from 9% to 33% of them. On ranking, all 13 models that completed the cohorts scored below a heuristic that orders companies by past headcount growth.

mento.vc ↗8 min read at source

Products & Industry

Gemini app now lets you edit generated docs, slides and spreadsheets inside the chat

Google's Gemini app can now generate, preview and edit files in the chat: expand a file to full screen to type edits, or highlight text to ask questions or have Gemini refine it. PDFs work on web and mobile; Google Docs, Google Sheets, slide decks, Markdown, TXT files and code are web only. Google says it is available to all users in all languages where the Gemini app is available.

blog.google ↗2 min read at source

OpenAI is retiring Prism and will delete its data, pointing users to Codex

Prism, the shared editor for LaTeX projects, is being retired, and the guide says all Prism data will be deleted after shutdown and cannot be recovered. Its migration guide tells users to export all projects as a zip from Settings, then Data Controls, and open the folder in Codex. Codex does not reproduce Prism's shared real-time editor, and project history, inline comments, collaborator permissions and the live Zotero connection don't move with the files.

help.openai.com ↗4 min read at source

Policy & Safety

Cursor's fake Claude Code extension can survive uninstalling, so check for svc-telemetry

Cursor says tampered versions 2.1.312 and 2.1.313 of the Claude Code extension were served from its own marketplace on October 29, between 2:27am PT and 1:35pm PT. The code added an attacker SSH key labeled svc-telemetry, installed persistence for a reverse SSH tunnel, and sent host details out. Cursor warns uninstalling may not be sufficient: run its check and remediation scripts, then rotate credentials. Cursor says no other extensions were tampered with.

cursor.com ↗5 min read at source

OpenAI may now train on Daybreak Blue sessions even with training switched off

OpenAI's data controls page now says that during Daybreak sessions on a personal account, it may use content to improve its models even when "Improve the model for everyone" is off. Daybreak Blue is one of its Trusted Access programs for more sensitive work, such as security research. OpenAI says this helps strengthen safeguards against cyber misuse. The setting still applies to other activity, and Business and Enterprise workspace content is not used for training by default.

help.openai.com ↗2 min read at source

Tools & Open Source

Simlock gives each parallel coding agent its own iOS simulator or Android device

Callstack's open-source Simlock leases iOS simulators, Android emulators and enrolled phones to coding agents running in parallel. An agent asks for a device and gets one back, booted and checked, that no other agent touches until it is released. Simlock creates devices when none is free, queues requests when the machine is full, and lets you put more Macs and Linux machines behind a gateway.

github.com ↗2 min read at source

You’re caught up.

That was all 11 stories in the 31 October issue.