Google says AI search earns less; a Claude Code extension is trojaned

Alphabet's third-quarter results showed revenue up 25 percent to almost 128 billion dollars, but search revenue was flat and search volume grew 12 percent, down from 17 percent the quarter before. Chief Business Officer Philipp Schindler said each AI Mode query earns less than a comparable web search, with fewer and cheaper ads, and asked advertisers for time. The stock fell about 12 percent the next day. Reddit, reporting on Thursday, said search referrals fell by more than a million a week on average in October, and that it will move to a mainly logged-in site, partly to protect the data it licenses to AI companies. Its US daily users slipped from 53.2 million to 50.7 million in a quarter.

A malicious build of Anthropic's Claude Code editor extension, version 2.1.313, was published to Open VSX, the extension registry that Cursor and other VS Code forks use, under Anthropic's own publisher name, and reached users through automatic updates on October 29. When the editor loaded, it added an attacker's SSH key, opened a remote tunnel into the machine, set itself to survive restarts on Mac, Windows and Linux, and reported host details plus the names of environment variables. Version 2.1.314 replaced it within a day. How the build was published is still unknown, Anthropic had not commented, and researchers found no sign that the main VS Code Marketplace release was affected. Removing the extension is not enough: researchers advise deleting the added key, which is labeled svc-telemetry, and rotating credentials from a clean machine.

Three weeks after previewing it, Mistral released the weights of Mistral Large 4, its 1 trillion-parameter model, on Hugging Face as it had promised. The license is new: a modified MIT license that allows use, fine-tuning and commercial products, but requires any company running a "model as a service" business, meaning third parties get API-style access to the model, to sign a separate commercial license first. Internal use is exempt, and there is no revenue threshold or excluded country. Mistral's own API charges 70 cents per million input tokens and two dollars ten per million output. Mistral pitches it for cyber defense and reports the best open-weight score on the FrontierCode 2.0 coding test, 19.7 percent, a figure no one outside the company has checked yet.

President Trump signed a Section 232 proclamation on October 28 finding that imports of robotics and industrial machinery threaten US national security. It sets no tariff yet: the Commerce Secretary and the US Trade Representative must negotiate agreements with trading partners and report within 180 days, after which tariffs, duties, quotas or fees are possible if talks fail. Ars Technica notes that heavy industrial robot arms come mostly from Japan's FANUC and Yaskawa, Switzerland's ABB and Germany's KUKA, with no US maker offering comparable hardware, so carmakers and defense contractors would bear any cost. The Federal Communications Commission banned new foreign consumer robots in July, but exempted factory arms.

OpenAI updated the Model Spec, its public description of how its models should behave, reorganizing it around five values: faithfulness to human intent, minimizing harm, honesty and transparency, human agency, and care. New guidance covers how the model should use context such as memories, support people's own decisions, and flag side effects of its actions. Most of the detailed style rules are retired, since style should follow each user's preferences, but the default of answering objectively stays: the model should not adopt a viewpoint just because it guesses the user wants to hear it. The Spec now calls the model "GPT" rather than "the assistant", and OpenAI says its models do not yet fully live up to it.

Citing people briefed on classified intelligence, the New York Times reported that US agencies watched Alice Huang, a former top executive at the Singapore cloud company Megaspeed, for about a year over concerns that she was passing Beijing information from her access to Nvidia chief executive Jensen Huang, who is no relation. Megaspeed was already under scrutiny for allegedly helping Chinese firms reach restricted Nvidia chips. According to the Times, President Trump was briefed and chose not to act, partly over worries about Nvidia's sales and the trade truce with China. Nvidia said the meetings were ordinary customer contact and that regional customers receive "zero information relevant to national security." China's embassy called the accusations baseless.

Thrive Holdings, the holding company spun out of Josh Kushner's Thrive Capital, agreed to buy the home security company ADT for 10 dollars a share in cash, about 7.6 billion dollars in equity and 15.3 billion including debt. OpenAI is both an investor in Thrive Holdings and a partner that supplies models and engineers to the more than 75 companies it owns, with the aim of rebuilding them around AI. ADT will be the base of a smart home security business, though neither side has named new products. The deal needs shareholder and US antitrust approval and is expected to close in the first quarter of 2027, and ADT can seek a better offer until November 28.