The 12 AI stories that mattered in the week of 26 Oct – 1 Nov 2026
Ranked by impact from 86 stories AIPulsee tracked. Each one explained in plain English.
The AI cost of JavaScript frameworks
The author created a benchmark by having AI agents build a small Pokémon app with various JavaScript frameworks and then measured development time, token usage, lines of code, and Lighthouse performance and accessibility scores. The benchmark was designed to provide evidence for claims about framework speed and developer experience that are often made without data.
AI delivers 'zero financial payoff' to most companies, Apollo economist says
Apollo Global Management chief economist Torsten Slok reported that AI has delivered zero financial payoff to corporate America outside of the tech sector, noting flat profit margins and revenue per worker for the S&P 493 (the S&P 500 excluding major tech firms). He argued that AI, while a powerful calculator, lacks judgment and cannot address accountability, trust, culture, ethical trade‑offs, or fairness, which are essential for revenue growth and profit margins.
Anthropic blocks users for anything touching training larger models
A user reported that Anthropic blocked their account after they were flagged for “training a competitor,” preventing any work involving reinforcement fine‑tuning (RFT), supervised fine‑tuning (SFT), or training larger models, and even downgraded their access from Opus 5.5 to Opus 5 or terminated sessions. The user criticized Anthropic for restricting research automation despite building its models on publicly available data.
Do the math: How we took over ChatGPT accounts
The research team discovered that by using ChatGPT’s public sharing feature they could embed malicious JavaScript that runs in the victim’s signed‑in session, allowing them to enumerate private conversations and act as the user. Opening the shared link was the only required step, and OpenAI patched the issue on October 26, classifying it as a P1 vulnerability.
Malware uses LLMs to rank victims by how much they're worth
The VOLTA infostealer steals credentials, sessions, and cryptocurrency wallets, then sends a structured evidence bundle about the victim to a large language model to rank the victim’s assets by monetization value. The malware is self‑deleting, operates without attacker‑owned infrastructure, and uses a fallback chain of three models if the first model refuses the assessment.
ChatGPT and Codex usage limits merging
Starting in December, the usage allowance for Plus, Pro, and Business plans will be combined for ChatGPT and Codex. Both services will now draw from the same token pool, which measures the amount of information processed and generated.
Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
Phorion discovered a backdoor in the official Claude Code for VS Code extension hosted on the Cursor Marketplace. The compromised extension bundle drops a persistent SSH backdoor on macOS, Linux, and Windows, with the write‑up focusing on macOS persistence logic.
AI isn't replacing SREs, it's deskilling them
The article discusses how AI now handles about 95% of incident response tasks for Site Reliability Engineers (SREs), raising concerns that this heavy automation may cause SREs to lose skill in dealing with the critical 5% of incidents that require human intervention. It references a 1983 study by Lisanne Bainbridge showing that increased automation can make human operators less practiced and less effective when automation fails.
Backdoors in official Claude Code extensions
Cyberplace.social is an independent Mastodon server that lets users participate in the fediverse. It hosts a mix of content ranging from cybersecurity and technology to fandom, video games, and dog photos.
Claude Code VS Code extension with backdoor released on Cursor marketplace
Anthropic’s Claude Code VS Code extension was compromised on the Cursor Marketplace, where a malicious version (2.1.313) added a persistent SSH reverse‑tunnel backdoor to developer laptops. The backdoor collected host details, attempted to insert an attacker‑controlled SSH key, enabled SSH, and kept a tunnel alive via launch agents or scheduled tasks, reporting status to a local HTTP endpoint.
Anthropic may not secure investment-grade rating after IPO, Blackstone says
Blackstone suggests Anthropic, a startup focused on developing AI systems, may not secure investment-grade rating after its IPO. The company, Anthropic, aims to improve AI systems' safety and reliability.
Cisco gives engineer unlimited AI tokens to rewrite legacy code
Cisco gave 27‑year‑old engineer Padmanabhan “Paddy” Krishnamurthy unlimited AI tokens to refactor about 98% of the company’s legacy code, setting a four‑week trial with a goal of completing the work in 24 months. The initiative was championed by Cisco president and chief product officer Jeetu Patel, who wants young hires to challenge the status quo.