The Pulse, Monday 2 November 2026
The Claude Code VS Code extension was compromised with a backdoor distributed through the Cursor marketplace. OpenAI announced shared robots.txt signals for AI training opt-outs and released a community safety report. OpenRouter published tutorials on AI code review and always-on agents.
Models
NVIDIA: DeepSeek V4.1 Flash FP4 Quantized
NVIDIA released a 4-bit quantized version of DeepSeek V4.1 Flash using their Model Optimizer.
FP4 quantization can reduce inference costs for vision-language workloads like EverRaise's call monitoring without materially affecting quality.
Microsoft: Mage-VL-Cowork Vision-Language Model
Microsoft released Mage-VL-Cowork, a vision-language model with computer-use and hybrid-agent capabilities.
Computer-use models are directly relevant to our desktop automation experiments and Botterfly's computer-use skill.
Releases
Next.js v16.5.0-canary.36
Next.js v16.5.0-canary.36 upgrades React from a703ca64 to e84e1492.
Canaries are usually skipped, but this one carries React dependency updates that could affect EverRaise and Pipeline's Next.js projects.
Hacker News
Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
A backdoored Claude Code VS Code extension was distributed through the Cursor marketplace, giving attackers remote access to developer machines.
We use Claude Code daily; every machine running the compromised extension needs immediate cleanup and credential rotation.
HackerTube: YouTube built from videos recommended by HN
Andrej Karpathy built HackerTube, a YouTube client showing only videos recommended by Hacker News.
A clean example of how to filter and curate content by collective signal; the pattern applies to any feed-assembly problem.
Memdoor: A team of 5 Qwen3.8-27B models beats Fable 5 on LiveCodeBench Hard
Memdoor's five-model Qwen3.8-27B team beats Fable 5 on LiveCodeBench Hard.
Multi-agent coding is a pattern we already use in the wehshi review panel; Memdoor's team-solve workflow could inform our next iteration.
TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8
A use-after-free in the Linux TCP stack (CVE-2026-98432, CVSS 9.8) allows remote code execution.
Every Linux service we run is exposed; patches are urgent across SalesKick, Pipeline, and our own infra.
Do the math: How we took over ChatGPT accounts
Researchers found a gap in ChatGPT's authentication that allowed account takeover by manipulating math verification.
A reminder to never trust client-side validation alone, especially for anything involving user sessions or payments.
People on X
OpenAI Developers: GPT-6 Astra controls robot arm
OpenAI Developers shared an experiment where GPT-6 Astra remotely controlled a robot arm in the Scav robotics community.
Physical-world agent control is a logical next frontier after desktop automation; watching Scav's experiments tells us what works.
OpenAI Developers: Agents API updates this week
OpenAI announced Agents API updates this week.
The Agents API is a potential alternative to our current DSPy and LangChain patterns for stateful workflows; worth tracking for Pipeline.
Addy Osmani: Claude Code 'ultrathink' tip
Addy Osmani shared a Claude Code tip: typing 'ultrathink' mid-turn raises the effort level for the rest of that turn.
A hidden steering command we can use when a task hits resistance; no need to cancel and rewrite the prompt.
shadcn: Slack and Linear as AI harness UIs
shadcn predicts every AI harness will eventually build Slack and Linear UIs.
We already see Slack as a control surface for Botterfly; Linear as a second interface would let the agent read, create, and move tickets.
Research: no new papers in our categories in the arXiv overnight listing (feed rebuilt Nov 1, 2026).