🏆 Headline
Claude's Official Extension Was Backdoored on Cursor for Nearly 12 Hours — Under the Verified Account
The accident the AI industry had been bracing for finally arrived — and this time it hit Anthropic's own official distribution channel. On October 29, version 2.1.313 of the official Claude extension, published under Anthropic's verified account on the Cursor marketplace, arrived carrying a backdoor. Riding the official account's auto-update channel, it landed on up to 5,000 developers' machines before version 2.1.314 replaced it nearly 12 hours later. Per Cursor's disclosure, the malicious version collected hostname, username, OS details, environment variable names, Git email and public IP, then attempted to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service and open a reverse tunnel — with background scripts retrying roughly every 60 seconds and persistence mechanisms trying to survive reboots. The malware's own sloppiness helped: outside of unusual admin-privilege launches, the key-injection step would fail on a bug. Cursor worked with the cloud provider to cut off the attacker's server, pulled the poisoned version, and rotated marketplace keys. A top-voted reader reminder on Ars matters most: installing the fixed version does not clear an infection — check authorized_keys for unfamiliar keys and treat a compromised machine accordingly. Anyone who installed or updated the extension between 5:27 a.m. and 4:35 p.m. ET on October 29 should consider themselves affected. The silence is the other story: as of Ars Technica's report, Anthropic had issued no customer notification, and neither company could explain how the verified account was taken over. As coding agents get broader terminal permissions, supply-chain attacks no longer bother with third-party libraries — they target the "official" badge itself. The link you trust most is now the cheapest one to poison.
Source: Ars Technica, Double Pulsar | 2026-10-30
Altman: The DRAM in Every PC Is "Being Wasted" — Memory Should Move to Data Centers
On the Cheeky Pint podcast, OpenAI CEO Sam Altman offered a view that PC users won't love: from a global allocation perspective, "it's quite terrible to have everybody have a bunch of the world's limited supply of DRAM sitting in their own computer and being used 5% of the time." His logic: memory belongs in data centers, which run around the clock at far higher utilization, and he argued the market's "invisible hand" is failing — in this DRAM price cycle, wafers aren't flowing to their highest-utilization use.
Source: Tom's Hardware | 2026-10-30
Wall Street Pre-Scores Anthropic: Likely "High Junk" Rating After IPO
Per the Financial Times, Blackstone — anchor investor in Anthropic's $63 billion chip-financing deal — has told deal investors that Anthropic is expected to receive a "high" junk rating after its November IPO, far below investment grade, reversing earlier guidance that it might secure an investment-grade rating post-listing. Rating agencies don't score model benchmarks: Anthropic holds $131.7 billion in cash and short-term investments, but the loss and capex trajectory is what gets graded. The S-1 filed this week showed $16.3 billion in first-half revenue against an $80.7 billion net loss.
Source: Financial Times, TechCrunch | 2026-10-30
The First Crack in AI Spending: $740B in Capex This Year, and Wall Street Starts to Frown
Over the past two weeks, Alphabet, Amazon, Meta and Microsoft have laid out combined capex plans exceeding $740 billion for this year. The last round of giant spending bought stock-market applause; this time the market is doing arithmetic. As Q3 earnings land, investors worry the massive outlays won't produce matching revenue anytime soon — tech stocks sold off, with Intel plunging about 28% Friday on a weak Q4 outlook, and Reuters describing the session as a tech selloff driven by AI cash-burn fears.
Source: TechCrunch, Reuters | 2026-10-30
Google's Space Data Center Says Its First Words — a Haiku
Google's Project Suncatcher prototype satellite went live after roughly three weeks of in-orbit commissioning: during a ground-station pass, engineers uplinked the first prompt to the onboard Gemma 4 model — write a haiku about being in space. As the satellite passed Svalbard, Norway, the downlink confirmed the poem. The spacecraft carries four TPUs and generates up to 1 kW of electricity; it launched earlier this month aboard a SpaceX Falcon 9 alongside 100-plus other spacecraft, paving the way for future orbital inference networks. The constraint is in the blog post too: power allows only one TPU at a time, for about 20 minutes, and scheduling space-to-ground communication windows remains tricky.
Source: Google Research blog, TechCrunch | 2026-10-30
Tape Strikes Back: Fujifilm Invests ¥10 Billion to Expand LTO Tape Capacity Fivefold
AI data centers' storage appetite is feeding an industry everyone declared obsolete. Fujifilm announced an investment of roughly ¥10 billion (about $63 million) in its Odawara plant in Kanagawa, expanding LTO tape capacity fivefold from FY2025 levels by FY2028 — its largest investment ever in dedicated LTO tape facilities. The announcement cites generative AI's "exponential growth" in data volumes, with major cloud and data-center operators expanding tape archival; against increasingly sophisticated ransomware, physically disconnectable "air-gapped" tape is the last line of defense for data.
Source: Ars Technica | 2026-10-30
No Supersonic Airliner Yet — the Company Pivots to Gas Turbines for AI Data Centers
Boom Supersonic's recent stretch is a footnote to the AI infrastructure boom. Scott Kirby, CEO of United Airlines — one of Overture's earliest customers — said in an interview aired October 28: "'29 is their official timeline. It's not going to happen in '29 — it's going to take longer." Meanwhile, on October 22 Boom unveiled a Colorado factory for its 42-megawatt "Superpower" gas turbine — the new core business is powering AI data centers, with first turbine deliveries targeted for mid-2027 and annual output ramping to 50 units by 2029. The turning point came in September: the $1.25 billion deal for data-center developer Crusoe to buy 29 turbines collapsed, a loss CEO Blake Scholl confirmed himself on X.
Source: Ars Technica | 2026-10-30
DoorDash Earnings Call: AI Agent Orders? "Several Hundred"
While the industry tells the agentic-commerce story, DoorDash handed out a cold-shower number on its Q3 earnings call: orders from third-party agents like Muse, Instinct and Fo total just "several hundred" — against the company's average of 3 million deliveries a day, a rounding error. CEO Tony Xu was blunt: "you never want to fight gravity. But at the same time, you don't want to be delusional."
Source: TechCrunch, Ars Technica | 2026-10-30
🏆 今日头条
Claude 官方插件遭投毒近 12 小时：带后门的版本就挂在官方账号下
AI 行业等来了一场迟早要来的事故：这一次，被做手脚的是 Anthropic 自己的官方插件。10 月 29 日，Cursor 插件市场里 Anthropic 官方账号下的 Claude 扩展出现做了手脚的 2.1.313 版本——顺着官方账号的自动更新通道，至多 5000 名开发者的机器装上了它。直到近 12 小时后，2.1.314 才上架，中间的差距只有一个版本号。 按 Cursor 的披露，这个版本会收集主机名、用户名、系统信息、环境变量名、Git 邮箱和公网 IP，然后尝试把一把投毒者控制的 SSH 公钥塞进 authorized_keys、打开反向 SSH 隧道，还想把隧道做成开机自启，后台脚本每约 60 秒重试一次，把机器变成可随时回连的落脚点。所幸代码本身不太争气：除非常规地以管理员权限启动，加公钥这一步大概率会失败；Cursor 也已联合云服务商掐断了回连服务器，下架问题版本并轮换了市场密钥。Ars 读者区被置顶的提醒同样关键：装回新版不等于脱险——得检查 authorized_keys 里有没有陌生公钥，必要时直接换一台干净的机器。受影响窗口为 10 月 29 日 5:27 至 16:35（美东时间），在此期间装过或更新过该插件的开发者，都应按已受影响处理。 更值得玩味的是两家公司的沉默：截至 Ars Technica 发稿，Anthropic 没有向客户发出任何通报，官方账号是如何被越权接管的，两家都给不出解释。当编码智能体的权限越给越大，供应链投毒不再盯着第三方库，而是直接盯上「官方」这块招牌——你最信任的那一环，恰恰是投毒成本最低的那一环。 > 💬 供应链投毒演进到今天，已经不屑于伪装成野包了——直接挂官方账号，借你自己的自动更新递刀。开发者的新常识得改写：版本号跳一位未必是修复，可能是一次手滑的投毒。官方渠道的公信力，正在成为整条链路上最便宜的攻击面。
来源：Ars Technica、Double Pulsar | 2026-10-30
Altman：每台 PC 里的 DRAM 都在「被浪费」，内存该搬进数据中心
OpenAI CEO Sam Altman 在 Cheeky Pint 播客里抛出一个让 PC 用户坐不住的观点：从全球分配的视角看，「让每个人都攥着一批世界供应有限的 DRAM，放在自己电脑里、只有约 5% 的时间在用」，是一件相当糟糕（quite terrible）的事。他的逻辑是：内存应该集中到数据中心，那里全天候运转、利用率高得多；他还认为市场的「看不见的手」正在失灵——本轮 DRAM 涨价的背景下，晶圆并没有流向利用率最高的地方。 > 💬 站在算力公司的账本上，这套算法无懈可击；站在用户的账本上，这叫「你的东西妨碍我赚钱」。内存不是石油，但 Altman 正在努力让它变成石油。
来源：Tom's Hardware | 2026-10-30
华尔街给 Anthropic 预打分：IPO 之后可能直接是「高垃圾级」
据 Financial Times 报道，Anthropic 630 亿美元芯片融资交易的锚定投资方 Blackstone 已告知交易投资者：Anthropic 在 11 月 IPO 之后，信用评级预计会是「高垃圾级」（high junk），远低于投资级——这与此前「上市后有望拿到投资级」的预期发生反转。评级机构看的不是模型跑分：Anthropic 现金与短期投资合计高达 1317 亿美元，但亏损与资本开支的轨迹才是定级依据。本周递交的 S-1 显示，其上半年营收 163 亿美元，净亏损 807 亿。 > 💬 债券市场比股票市场诚实：模型再聪明，评级机构只问一个问题——现金流什么时候盖过利息。「高垃圾级」不是否定 AI，是给「借钱搞基建」的商业模式定价。
来源：Financial Times、TechCrunch | 2026-10-30
AI 开支的第一道裂缝：四大巨头今年 7400 亿美元资本开支，华尔街开始皱眉
过去两周，Alphabet、Amazon、Meta、Microsoft 相继给出今年合计超过 7400 亿美元的资本开支计划。上一轮巨额支出换来的是股价掌声，这一次市场开始算账：随着三季报密集落地，投资者担心天价投入短期换不来对等收入，科技股应声回调——周五 Intel 因四季度指引不及预期股价重挫约 28%，路透以「AI 烧钱恐惧引发科技股抛售」形容当天的华尔街。 > 💬 7400 亿美元不是一个预算数字，是一场信任实验：市场可以容忍烧钱，但容忍度有上限——烧钱的速度一旦快过故事兑现的速度，定价权就从叙事侧交回报表侧。
来源：TechCrunch、Reuters | 2026-10-30
Google 太空数据中心的第一次回话：一首俳句
Google 的 Suncatcher 原型卫星在轨调试约三周后正式「开机」：地面站过顶时，工程师向星上预装的 Gemma 4 模型发出第一条提示词——写一首关于身处太空的俳句。卫星掠过挪威斯瓦尔巴上空时，下行数据确认了这首诗。这颗卫星携带 4 颗 TPU、发电功率约 1 千瓦，本月与上百颗航天器一起搭乘 SpaceX 猎鹰九号入轨，为未来的轨道推理网络探路。现实约束也写在博客里：功率只够点亮一颗 TPU 约 20 分钟，星地通信窗口的安排同样棘手。 > 💬 人类把数据中心送上太空的第一次回话，是让模型写诗——这是工程，也是宣言。20 分钟的电力预算提醒所有人：轨道算力的物理账本，比营销幻灯片厚得多。
来源：Google Research 博客、TechCrunch | 2026-10-30
磁带回潮：富士胶片投 100 亿日元，把 LTO 磁带产能扩五倍
AI 数据中心的存储胃口，把一个「过时」行业喂饱了。富士胶片宣布向神奈川小田原工厂投资约 100 亿日元（约 6300 万美元），到 2028 财年把 LTO 磁带产能扩至 2025 财年的五倍——这是该公司迄今在专用 LTO 磁带设施上最大的一笔投资。理由写在公告里：生成式 AI 带来数据量的「指数级增长」，大型云厂商与数据中心运营商正扩大磁带归档的用量；面对越来越狡猾的勒索软件，可以物理断连的「气隙」磁带成了数据的最后防线。 > 💬 每一代新存储介质发布时都宣判过磁带死刑，结果 AI 把它请回了主桌。冷数据的终点站是磁带——这条 1950 年代的技术路线，正在赚 2026 年最热行业的数据钱。
来源：Ars Technica | 2026-10-30
超音速客机还没影，公司先转身给 AI 数据中心造燃气轮机
Boom Supersonic 的近况成了这轮 AI 基建热的注脚。其超音速客机 Overture 最早的一批客户之一、联合航空 CEO Scott Kirby 在 10 月 28 日播出的访谈里直说：「2029 交付不可能发生，会需要更久。」与此同时，Boom 已在 10 月 22 日为 42 兆瓦「Superpower」燃气轮机工厂揭幕——新主业是给 AI 数据中心供电，计划 2027 年年中交付首批轮机，2029 年把年产能拉到 50 台。转折点在 9 月：数据中心开发商 Crusoe 原本要买 29 台、总额 12.5 亿美元的订单告吹，CEO Blake Scholl 亲自在 X 上确认了这笔损失。 > 💬 超音速客机画了二十年饼，最后靠给 AI 机房烧天然气找到了第一份稳定收入。这大概是 AI 基建热最好的隐喻：它不只吸引科技公司，连造飞机的都改行了。
来源：Ars Technica | 2026-10-30
DoorDash 财报电话会：AI 智能体的下单量？「几百单」
当整个行业都在讲「智能体电商」的故事时，DoorDash 在 Q3 财报电话会上给了一个泼冷水的数字：来自 Muse、Instinct、Fo 等第三方智能体的订单，总计只有「几百单」——对照该公司平均每天 300 万单的配送量，占比接近零。CEO Tony Xu 的表态颇为直白：「你永远不想对抗重力，但同时也不能自欺欺人。」 > 💬 「智能体重新定义购物」讲了大半年，终于有人交出真实订单数——几百单，对照每天 300 万单。智能体电商不缺演示，缺的是第二个理由：人为什么要让 AI 替自己点外卖。
来源：TechCrunch、Ars Technica | 2026-10-30