self.md radar — 2026-10-31
the scripts may stay after uninstall
a file under ~/Library/LaunchAgents can outlast the editor extension that installed it. Cursor’s incident notice asks affected users to check the key and scripts even where SSH-service activation failed
1. an SSH payload reached Cursor’s extension marketplace
Cursor identifies malicious Anthropic.claude-code versions 2.1.312 and 2.1.313 in its extension marketplace for macOS and Windows. the affected install/update window was October 29, 2:27am–1:35pm PT. the notice was updated October 30; the packages were not developed by Anthropic
the payload collected host details, added an SSH key labelled svc-telemetry, and installed scripts to retry a reverse tunnel. on macOS, persistence used a LaunchAgent named com.apple.sysmond. uninstalling the extension may leave those scripts running
Cursor says SSH-service activation failed on most ordinary hosts because it needed administrator rights. it also says the attacker server has been taken offline. neither removes the files already installed. affected users should follow the notice’s host checks and remediation steps; Cursor also calls for rotating accessible credentials and sessions from a trusted system
reading: Cursor’s incident notice, affected versions and remediation
2. WebAnything freezes the site before another agent checks it
WebAnything reconstructs executable, resettable websites from source observations. its builder implements and self-checks a candidate; a separate verifier examines the frozen implementation and cannot edit it during the check
Appendix B.7 records 219 historical report pairs with passing builder self-checks. the independent results were 56 passes, 139 failures and 24 source-blocked checks. 39 pairs have concrete evidence supporting a discrepancy, and only one comparison strictly matches both the candidate and the check target. these historical pairs do not establish a controlled failure rate
the public repository includes the pipeline and an inventory of 244 historical website artifacts. it does not bundle those 244 websites’ source trees or media
reading: WebAnything paper and its qualified verification records
3. a 6502 CPU, compiled rather than trained
nesformer’s weights were calculated by a compiler. the project puts an NES CPU, work RAM and program ROM into a Qwen3_5ForCausalLM checkpoint; a host program still draws the picture and reads the controller
the project’s own test record reports 2,651 positions without a mismatch in stock Transformers, alongside longer free-running comparisons with a reference CPU
there are 466.6 million parameters, but only 9.3 million are nonzero, so the weights compress to 3.3 MB. the stated speed is 150–290 times slower than the console. only NROM cartridges are supported. there is no sound
reading: nesformer code, conformance checks and hardware limits
more to read
- WebAnything’s known limitations — the E2B adapter checks gateway health, gallery presence and homepages; full post-deploy interaction replay is still planned