Skip to content
IIAIT

AI Today · 1 November 2026

A tampered Claude Code extension in Cursor's marketplace and Qwen coming to Apple Intelligence in China

A quieter weekend: Microsoft details a backdoored copy of a popular AI coding extension that reached Cursor users, Apple and Alibaba confirm how Qwen will work inside Apple Intelligence in China, and Moonshot closes its Kimi K2 models to new API customers.

  1. 01

    Tampered Claude Code extension in Cursor's marketplace installed an SSH backdoor on developers' machines

    A modified copy of the Claude Code extension, versions 2.1.312 and 2.1.313, was available in the Cursor editor's extension marketplace for about 11 hours on 29 October. According to Microsoft's security researchers, the code ran as soon as the extension loaded, collected system details, added an attacker's SSH key labelled svc-telemetry, tried to open a reverse SSH tunnel and set up persistence on macOS, Linux and Windows. Cursor says up to 5,000 users were exposed and that Anthropic did not build this version; Cursor removed it and temporarily closed its marketplace for an audit, and Microsoft found no sign of the package in the Visual Studio Marketplace or npm.

    What it means for you

    If you use Cursor, check whether either version was installed on 29 October and look for an svc-telemetry entry in your SSH authorized_keys file; uninstalling alone may not remove the startup scripts. More generally, treat AI coding extensions like any other software with access to your machine: allow approved publishers only and consider delaying updates by a few days.

    Sources

  2. 02

    Apple and Alibaba confirm Qwen will power parts of Apple Intelligence in China from December

    Alibaba and Apple announced on 31 October that Alibaba's Qwen model will handle text and image understanding and generation in Siri, Writing Tools and Visual Intelligence for users in China. Testing starts in the iOS developer beta on 4 November, and the public release follows with iOS 27.3 in December, initially on iPhone 15 Pro and newer models. Users choose whether to turn the integration on and what to share, and Alibaba says it will not use requests or responses to train its models. The newer Siri features announced at WWDC 2026 are not part of this first release.

    What it means for you

    This mainly affects people and teams working with iPhones in China, but it shows a pattern worth knowing: the same assistant can rely on different underlying models depending on the region. If your company uses Apple devices across markets, check which model and which data-sharing terms apply where your colleagues are based.

    Sources

  3. 03

    Moonshot stops offering Kimi K2 models to new API users and plans to retire them by the end of 2026

    From 31 October, Moonshot's Kimi K2 series is no longer available to newly registered users of its API platform, according to the company's pricing page. Existing users keep access for now, but Moonshot says it plans to retire all K2 models by the end of December 2026 and points customers to its migration guide for Kimi K3.1 Pro. Other models, including K3 and K2.7 Code, remain listed.

    What it means for you

    If a tool or workflow you rely on calls a Kimi K2 model, ask the provider or your developers about the migration plan now rather than in December. Re-test outputs and costs on the replacement model, because results and prices can change with a new model.

    Sources