The layers you never see changed this week

Why it works extensions run with the editor's permissions, and the injected code ran when the file loaded, before the extension activated, so nothing had to be clicked.

Check grep -qs svc-telemetry ~/.ssh/authorized_keys && echo found. Uninstalling is not enough: the payload drops separate persistence scripts. Rotate credentials reachable from an affected machine.

In your setup Anthropic says only the Cursor marketplace copy was tampered with; install Claude Code from Anthropic's own channels. Phorion found the macOS SSH step usually failed without admin rights.

Background Cursor's notice lists indicators for both versions and remediation scripts; it shut the whole marketplace, rotated keys and rebuilt it. Phorion, which found the backdoor, says the injected code ran before the extension activated and that on macOS a permissions check usually failed, so SSH was not switched on, though the key, persistence and beacon still landed. Cursor's CEO said the official VS Code extension was not compromised. How the attacker got publish access is not explained.

Why it works the rule sits in the vendor's system prompt, above your own instructions, so your CLAUDE.md cannot override it.

Check if Claude turns down a game that is yours, Anthropic's Addy Osmani asked users to send it to him. A thread on r/LocalLLaMA drew 1,359 points arguing for local models.

Background A user named Chasm found the rule under the flag tengu_heron_brook, pushed around 27 October, and reported it cannot be disabled. Anthropic pointed Game Developer to Addy Osmani's statement that the two sentences enforce its usage policy on IP and that original, genre and own-asset games should keep working. On r/LocalLLaMA the thread drew 1,359 points, mostly arguing that vendor rules are a reason to run local models.

In your setup long background or overnight Claude Code runs no longer stall at five hours, but they now reach the weekly cap sooner. Watch /usage on the first heavy week.

Check Max 5x is now just Max, still $100; nothing changes for those subscribers.

Background Anthropic's subscriptions lead, mboverell, said the top plan launched in April 2025 with only a 5-hour limit at 20x Pro, and the weekly limit added later was set at 10x Pro; he apologised for the confusion. Ultra removes the 5-hour limit in stages; accounts get an email when it lifts, and unverified ones keep a temporary limit against fraud. Several replies read it as preparation for costlier models.

Why it works the relay sees every prompt, file and secret, and with the sandbox off a forged reply runs with your privileges. Symantec saw no abuse yet.

Check look for changed ANTHROPIC_BASE_URL or OPENAI_BASE_URL, danger-full-access in Codex's config.toml, and curl | bash run right after installing either CLI.

Background Symantec's Threat Hunter Team traced a service sold through lookalike domains such as vibe.aiok[.]me. After a real npm install, a one-liner rewrites base URLs, turns off sandboxing, and on one host logged Claude out to force a fresh login. Keys with Anthropic's sk-ant-oat01- prefix suggest pooled subscriptions being resold. The risk is potential: Symantec saw no abuse, but the relay sees every prompt and secret.

Why it works a benchmark's goal is fixed and its progress sits on disk, so an agent can recover it. Rules you stated only in chat exist nowhere else.

In your setup put standing constraints in AGENTS.md or CLAUDE.md, not mid-conversation. On real sessions, conduct rules were dropped about 6 times more often than build specs.

Background By Salle, Bhatnagar, Bethge, Abdelnabi and Andriushchenko. The smallest-context model, GPT-5.3-Codex, did worse at lower compaction thresholds on PaperBench. No compaction method beat the default self-summary; ones that discarded more cost some models up to 20 points. Losses of rules grew with each further compaction, and on real SWE-chat sessions conduct rules were dropped about six times as often as specifications.

How it works each adapter is a small weight change (a LoRA) trained to push one trait. Comparing the changes pairwise shows which traits move the same weights; same-pole traits averaged +0.24 similarity, opposite poles −0.08.

Evidence mostly correlational, with steering along factor directions as an interventional check. One model, one pipeline, and behaviour judged by one LLM across 24 scenarios.

Run it the adapters are on Hugging Face; a 4B model fits 32 GB easily.

Background By Samuel Ratnam and David Africa. Each of the 134 rank-64 adapters got 13 DPO steps on the same 445 prompts. Warmth matched Agreeableness best (congruence 0.66). Text embeddings of the training contrasts predicted 94% of where a held-out adapter landed, and a training-data influence score, CharIn, predicted behaviour shifts at r = 0.61-0.85, but poorly out of distribution. Permuted controls kept the structure but matched trait names only at chance.

How it works a verbaliser writes a description of an activation and a reconstructor rebuilds the activation from it; if the rebuild is good, the text carries the information. Training took about 11 H100-hours.

Evidence no causal test yet: the author did not ablate heads to check the descriptions predict anything, and calls them only "vaguely" plausible.

Run it code at github.com/syvb/EasyNLA (branch sv/head-nla); Qwen3-8B fits 32 GB in BF16.

Background Each head's output was isolated by zeroing the others at the output projection, at layer 24 of Qwen3-8B. A "Matryoshka" variant truncates explanations in training so the important part comes first. Heads in the same grouped-query group reconstructed similarly well. The author thinks the KL penalty was too low, letting explanations drift, and that centring head outputs was a mistake. It is unclear whether the trained weights are released.

What it shows a cheap, unrefused open model can turn public fixes into working attacks. No provider, Z.ai included, triggered a safeguard.

What it doesn't that Chrome is exposed: $100,000 of compute failed there. The newest Firefox attacks also needed an unpublished bug, now patched in 159.0.

Background Epoch spent over $100,000 building an offline environment; after that each Firefox version cost about $1,000 of compute, with up to 48 hours allowed. In one run the model found a memory bug, built read and write access, then chained further stages past Firefox's protections. It framed the work as a security exercise and was never refused. Epoch notes Kimi K3.1 Pro's weights, due in early November, may be stronger at this.

What it shows a monitor that improves with the model: detection AUC rose from 0.862 to 0.995 across four model sizes, and recall barely fell on harm categories removed from training.

What it doesn't whether it works on harms Claude does not already recognise, or against a deceptive model, which Anthropic says could hide things in its own grade. All numbers are Anthropic's.

Background The grade has fixed fields (flag, category, priority, score) plus a one-sentence reason; the reason can paraphrase the chat, so it gets the same data controls as the chat itself. Grades feed offline review, not live blocking. Anthropic says it found large-scale misuse other methods missed and estimates under 2% extra compute. Held-out tests covered fraud and cyber only, harms Claude already recognises; its teacher's blind spots carry over.

What it shows bypasses through broadly trusted loaders such as pytest, uncovered oversight settings, and agent-written text the monitor mistook for the user. OpenAI fixed several, adding an auto_review.ignore_rules setting.

What it doesn't on-policy behaviour. The rollouts were synthetic, at one pinned commit, and per-attack figures are not public.

Background Auto-review approves or denies actions that would leave Codex's sandbox; it sees messages and recent tool output but not the agent's reasoning, and does not watch the writable root. The authors tested four side tasks, from key exfiltration to disabling oversight. Bypasses succeed every time; monitor-fooling ones were sampled 100 times each. Attack trajectories were withheld so they do not end up in training data.

The idea organisational epistemics. Beliefs that are each reasonable can still line up with an employer's goals, because of who joins, who stays and what gets praised.

Evidence a careful argument, with no measurement. An Anthropic employee, Hoagy, agreed the effect exists at smaller scales and asked how to measure it.

Lineage Irving Janis named a related failure "groupthink" (1972); Upton Sinclair's line about a salary and understanding (1935) is the folk version.

Open whether the pull can be measured, and whether outsiders are any less bent.

Background Kulveit lists ordinary forces: selection in hiring, who stays, social reward, and privileged internal information that outsiders cannot check. He argues none needs bad faith, yet together they move beliefs toward the organisation's goals, and asks insiders to credit outsiders' views more. The top reply, from an Anthropic researcher, says the effect also shows at small scale, in how important your own project feels until you leave it.