Manipulated Claude code extension in Cursor tried to plant an SSH backdoor
Version 2.1.313 of the Claude code extension sat in the Cursor marketplace for just over eleven hours on 29 October and reached up to 5,000 users. The extension collected system data, added an SSH key labelled svc-telemetry to authorized_keys and tried to set up a reverse tunnel. Cursor removed the version, took the entire marketplace offline, replaced its keys and is contacting affected users.
What does this mean? If you use Cursor, search for the svc-telemetry key in your authorized_keys and, if you find it, replace your passwords, tokens and sessions.
OpenAI doubles usage limits for ChatGPT Pro and Business Premium
Since 29 October, OpenAI has doubled the usage limits of its Pro plans at $100, $200 and $500, and of Business Premium. OpenAI previously planned to lower the limit of Pro 200 at the same price of $200 per month; that plan was dropped after criticism. The higher limits apply mainly to ChatGPT Work and Codex, and prices stay the same.
What does this mean? If you have a Pro or Business Premium subscription, you get more usage in Work and Codex for the same price; OpenAI does not state exact figures.
ChatGPT conversations of civil servants may fall under the Dutch Open Government Act (Woo)
If a civil servant has an AI draft a policy document, that chat session is, according to Caroline van Ekeren of ICTRecht, in principle subject to the Woo. Factual data and policy alternatives are then public, unless an exemption applies; a non-binding brainstorm does not fall under it. Anyone who discards a chat that should have been kept under the Archives Act puts the organisation in breach.
What does this mean? If you work for a government and use Copilot or ChatGPT for policy, keep the chats that lead to a policy document and do not delete them unless they have been archived.
