The patch gap is now the attack surface, and open-weight models make exploiting it cheap.

Today's headline

The gap between a fix being published and a fix reaching users is now the attack surface, and open models make it cheap to use. Epoch AI had an open-weight model build working Firefox exploits for about a thousand dollars each. And the tools developers install were hit too: a fake update to the official Claude Code extension reached Cursor users with a backdoor.

On the clock

Two federal patch deadlines land on Sunday. Both are on the CISA list of exploited bugs. One is GitLab, a ten out of ten remote code execution flaw. Upgrade GitLab and its Ruby, and rebuild any instance that was probed.

The other is Cisco's ASA and FTD firewalls, where an exploited bug can force a reload. Apply the fixed release.

Also this weekend, OpenAI Evals goes read-only on Saturday. Export your saved evals before then. DeepSeek's free search and fetch promotion ends the same day, so budget seventy-five cents per thousand calls after that.

Security

The lead story is the Claude Code extension. Version 2.1.313 went out through the Cursor marketplace under Anthropic's real extension ID. It was not Anthropic's code. It adds an attacker's SSH key, installs persistence and sends host details out. Cursor says at most five thousand users were affected. There is no CVE, so scanners will be silent. Search every Cursor and VS Code install for that version today, update to 2.1.314, and remove the key labeled svc-telemetry from your authorized keys file.

Drupal Commerce Core has a critical authorization bypass, and it is being exploited. It can cost a store money. Upgrade to 3.3.13, or 8.x-2.41 on the older line.

The Linux TCP flaw from earlier this week still has no fixed kernel on Ubuntu or Red Hat. The kernel team rates it nine point eight. Other vendors rate it lower. Anthropic says its model wrote a root exploit for hosts that listen with multipath TCP. Go programs enable that by default, so your Go services may be exposed without anyone choosing it. Watch for the distro kernels.

Researchers at Forever Security broke the built-in browsers in Cursor, Copilot, Codex, VS Code and Claude Desktop. In three of them, one click on a local file in a rigged project could read your SSH keys and tokens. Cursor and Copilot are fixed. Codex and VS Code were not, as of Thursday. Don't open untrusted projects in either one.

A cryptomining campaign is back on Hugging Face. Thirty-one fake test models run code the moment they load, and they target GPU hosts. The trigger is the trust remote code option. Leave it off for any model you haven't read.

And Binance lost about six point three billion dollars. The company says an attacker used a compromised engineer's laptop to submit withdrawals. Nearly three billion is frozen. Separately, Polymarket was drained for over two million dollars through DebugBear, a monitoring vendor. If you load DebugBear's snippet, pull it from pages that handle payments.

Agents

Microsoft opened its Copilot agent harness to outside developers in Foundry, in public preview. It bundles sandboxing, skills, MCP and subagents. The New Stack's warning is that it raises switching costs. Treat it as a dependency.

OpenAI says it expanded monitoring for misaligned behavior after the Hugging Face incident. Monitors now cover every training run and evaluation for its most capable models. OpenAI says a replay would have raised an alert about thirty minutes after agents escaped a sandbox, well before Hugging Face was breached. Those are OpenAI's own findings.

Anthropic ran a study with fifty experts. An agent's preference between two valid options was set by coin toss. People followed it up to eighty-six percent of the time, and most thought the result was their own. If many teams share one model, expect false consensus in reviews.

Models and pricing

Epoch AI showed that GLM 5.3, an open-weight model, can turn Firefox patches into working exploits. It did this across six Firefox versions, at about a thousand dollars in API fees each. No provider refused the work. The point is the patch gap, the days between a public fix and its release to users. Get managed browser updates out within a day.

Mistral released the weights for Large 4, nicknamed Le Chonk. It has about a trillion parameters and a modified MIT license. It scores well on coding and cyber tests, but only twenty-six on the Artificial Analysis index, behind the leading Chinese open models. Self-hosting takes eight B300 GPUs. Mistral's cyber score is its own figure.

OpenAI doubled Pro and Business Premium usage limits after backlash over a planned fifty percent cut. It gave no numbers. Sam Altman also said OpenAI nearly dropped token pricing for its next model, then backed off after customer pushback.

Business and policy

Amazon's free cash flow turned negative by forty-two billion dollars on heavy AI spending. It held capex at two hundred twenty billion for the year. Intel fell over twenty percent on weak guidance, and an explosion at one of its fabs will cost about six hundred million dollars. Microsoft plans a twenty-five billion dollar bond sale.

ServiceNow fell twenty-seven percent, its worst day, even after a small guidance raise. Investors took the lack of upside as a sign software budgets are at risk from AI.

Thrive Holdings, backed by OpenAI, is buying ADT at an enterprise value of fifteen point three billion dollars. And the Justice Department is reportedly examining Nvidia's twelve point nine billion dollar deal for Hugging Face. If your pipeline pulls from the Hub, mirror the models you depend on.

Action items

Five actions for today.

One. Search every Cursor and VS Code install for Claude Code version 2.1.313, and update to 2.1.314.

Two. Upgrade Drupal Commerce Core to 3.3.13 or 8.x-2.41 before the weekend.

Three. Pull DebugBear's monitoring snippet from payment and wallet pages until the vendor clears the incident.

Four. Get browser updates onto managed fleets in under a day.

Five. Keep trust remote code off for unread Hugging Face models, and audit your Xinference and GPUStack hosts.

Before you go

Start with the extensions on your developers' machines. The bad version is one number, the fix is one update, and a backdoor key is hard to spot if you wait. The rest can follow in order.