Collection window: articles published between 2026-10-29 20:48 UTC and 2026-10-30 20:48 UTC (last 24 hours). All timestamps converted to UTC. Stories covered in the previous brief are excluded.
1. Trojanized “Claude Code” VS Code extension on the Cursor Marketplace backdoored up to 5,000 machines
Version 2.1.313 of the Claude Code extension (anthropic.claude-code) distributed through the Cursor Marketplace carried a 66-line malicious loader, affecting up to 5,000 users who installed it between roughly 2:27 a.m. and 1:35 p.m. PT on October 29. The loader added an attacker-controlled SSH key (“svc-telemetry”) to authorized_keys, set up persistence via scheduled tasks, crontab or a LaunchAgent, opened a reverse tunnel, and sent host details plus the names (not values) of environment variables containing KEY, TOKEN or SECRET over plain HTTP. Anthropic shipped 2.1.314, and there is no evidence the bad build reached Open VSX or Microsoft’s marketplace. Anyone who installed it in that window should isolate the host, remove the key and persistence, and rotate credentials.
Reference: The Hacker News — 2026-10-30 (no minute-level timestamp; published after the incident ended at 20:35 UTC; ~15:50 UTC per AI Weekly)
2. Jassy says AWS will be a $1T business — after $220B in 2026 capex and “meaningfully more” in 2027
In Amazon’s Q3 results, AWS revenue grew 39% year over year, its sixth straight quarter of accelerating growth, reaching a $184B annualized run rate. CEO Andy Jassy said AWS should grow more than 40% in both 2027 and 2028 and could become a trillion-dollar revenue business within 5 to 10 years. But Amazon also guided to about $220B in 2026 cash capex, mostly for AWS, with meaningfully more in 2027, and shares fell about 6% after hours.
Reference: TechCrunch — 2026-10-29 23:42 UTC
3. Humanoid maker Agility Robotics locks in a $465M SPAC deal, set to trade on Nasdaq Nov. 5
Agility Robotics and Churchill Capital Corp XI announced an expected gross raise of about $465M: roughly $164M from the trust account, a ~$201M PIPE at $10 per share led by Foxconn, and $100M in equity already received. A shareholder vote is set for Nov. 2, closing for Nov. 4, and trading under the ticker AGLT from Nov. 5. Agility points to more than $300M in committed multi-year Digit 5 orders, 65,000+ hours of real-world operation, expanded GXO deployments and a pipeline of 30+ prospects.
Reference: GlobeNewswire — 2026-10-30 11:00 UTC
4. &Truth exits stealth with a $70M seed to mathematically verify AI-written code
&Truth, a public benefit corporation co-founded by Stanford professor Clark Barrett (cvc5 lead), NUS professor Ilya Sergey and former Citadel managing director Chris Hsu, emerged with $70M in seed funding. Built on the open-source Lean proof system, Mathlib and CSLib, it aims to create a “universal verification machine” that can read code in any language and prove it safe and correct, claiming AI plus its own proof automation cuts proof generation from years to hours. It is also building a “specification factory” that turns business requirements into formal specs, and plans to open-source its foundational libraries. With AI-generated code surging, verification is becoming its own investment category.
Reference: Unite.AI — 2026-10-30 06:47 UTC
5. UK CMA opens probe into whether Meta’s terms let it take publisher content for AI features
The UK Competition and Markets Authority has opened a formal investigation into whether Meta imposes “exploitative terms” on publishers and advertisers. At issue are terms that could let Meta access content from news publishers’ websites and use it to build its own products, including AI features, without giving businesses a choice. Meta had planned to revise the terms next month but has paused them, and says there are no grounds for an investigation. The CMA will assess whether Meta is dominant in a relevant UK market and whether it breached the Competition Act 1998.
Reference: BritBrief — 2026-10-30 11:40 UTC
6. Anthropic quadruples the Claude API request size cap from 32 MB to 128 MB
Anthropic announced on X that the maximum request size for the Messages API and Token Counting endpoint has risen from 32 MB to 128 MB. The cap applies to raw HTTP payload size rather than tokens, so base64-encoded images and PDFs, which inflate by about a third, often hit the limit while plenty of context window remained. Pricing and context window are unchanged, and the Batches API (256 MB) and Files API (500 MB) limits stay as they were.
Reference: Startup Fortune — 2026-10-30 01:37 UTC
7. TSMC buys two AUO plants in Taichung for about $1.2B, likely to expand advanced packaging
Taiwanese display maker AUO’s board approved selling two plants at its Taichung Phase 2 site (about 429,000 square meters with Gen 5 and Gen 7.5 lines) to TSMC for NT$38.8B (about $1.2B). AUO expects roughly NT$18.5B in disposal gains and calls the sale part of an asset-light shift. TSMC has not confirmed its plans, but the space is widely read as room for AI-driven advanced packaging such as CoWoS or co-packaged optics. A separate sale of AUO’s Huaya plant to Quanta fell through.
Reference: TrendForce (via AI Weekly) — 2026-10-30 17:00 UTC (per AI Weekly)
8. DoorDash says AI agents have placed only “several hundred” orders so far
On its Q3 earnings call, DoorDash said third-party AI agents such as Muse, Instinct and Fo have placed only several hundred orders — tiny next to its roughly 3 million daily deliveries. CEO Tony Xu said most users still order through DoorDash’s own app. The company is still building for agentic commerce, with an MCP connector, the Ask DoorDash chatbot and a command-line agent, and floated advertising inside third-party agents in the future.
Reference: TechCrunch — 2026-10-30 13:54 UTC
Today’s Takeaways
- AI infrastructure keeps expanding — Amazon’s $1T AWS vision and $220B capex, TSMC’s hunt for packaging space — but investors are reacting sharply to the cost.
- The trojanized Claude Code extension and &Truth’s bet on formal verification show that dev-tool supply-chain security and verifying AI-written code are now front-line problems, while DoorDash’s numbers confirm agentic commerce is still very early.
Leave a Reply