Every published Top AI Stories item tagged with Claude Code, newest first.
Cursor says the malicious builds of Anthropic's Claude Code extension were served from its own extension marketplace for about 11 hours on October 29, and that version 2.1.312 for Mac and Windows was tampered with as well as 2.1.313. On most Mac and Windows machines the backdoor lacked the admin rights to turn on the SSH service it needed, so the attacker could not log in through the tunnel, and Cursor had the attacker's server taken offline. The extension still added the attacker's key, set itself to survive restarts and sent host details, so Cursor advises checking for the svc-telemetry key and rotating credentials. Cursor told Ars Technica at most 5,000 users were affected. Neither company has said how the attacker reached Anthropic's publisher account.
A malicious build of Anthropic's Claude Code editor extension, version 2.1.313, was published to Open VSX, the extension registry that Cursor and other VS Code forks use, under Anthropic's own publisher name, and reached users through automatic updates on October 29. When the editor loaded, it added an attacker's SSH key, opened a remote tunnel into the machine, set itself to survive restarts on Mac, Windows and Linux, and reported host details plus the names of environment variables. Version 2.1.314 replaced it within a day. How the build was published is still unknown, Anthropic had not commented, and researchers found no sign that the main VS Code Marketplace release was affected. Removing the extension is not enough: researchers advise deleting the added key, which is labeled svc-telemetry, and rotating credentials from a clean machine.
Anthropic expanded its General Services Administration agreement, giving federal, state, local, tribal and territorial governments 40 percent off Claude Enterprise, Claude for Government and the Claude API, with no minimum spend. The company estimates the discount saves government buyers about $1 billion. It says weekly active users of Claude for Government are up about eightfold since February, and that in a Utah pilot, 71 percent of 34 state developers given Claude Code reported saving more than 20 hours over four weeks.
Anthropic has moved Code Review, its multi-agent reviewer for pull requests in Claude Code, out of research preview for Team and Enterprise plans. It says most reviews now finish in six to ten minutes, about three times faster than in preview, and admins can pick a quick, standard or deep review for each repository. Eligible Enterprise organizations can claim at least $10,000 in credits before January 15. A companion post from the Claude Code team explains why: changes landing per day in Anthropic's main code repository rose from about 2,500 in May to more than 30,000 in September, which made line-by-line human review impractical. On Claude Code itself, merged pull requests more than doubled from June to September while the share later reverted fell by more than 40 percent.
Anthropic redesigned projects in Claude Code around a coordinator: a user sets a goal and connects repositories, and Claude breaks the work into threads, each a cloud session on its own branch, then reviews the output and reports which pull requests should merge first. Threads share a project memory that builds over time, and work continues after the user steps away. The beta reaches selected Pro and Max subscribers who use cloud sessions, widening over the coming week, with Team and Enterprise plans to follow.
Anthropic's status page recorded elevated errors across Claude Mythos 5, Claude Fable 5, Claude Opus 5 and Claude Opus 4.8 for roughly two hours and 45 minutes early on August 24, with partial outages on claude.ai, the API, Claude Code and Claude Cowork. Engineers identified a cause within 21 minutes and marked it resolved, without saying publicly what broke. Notebookcheck counted seven earlier disruptions in August, on the 6th, 7th, 14th, 16th, 18th, 19th and 20th, two of them classed as major. Reliability is not a footnote for a company weeks away from an IPO whose coding tool now runs inside other people's build pipelines.
Anthropic says Claude models launched in the European Union on or after August 2 will weave an imperceptible watermark directly into the text they generate, and will attach signed C2PA provenance metadata to supported files such as PNG and SVG. The marking is on by default everywhere Claude runs — the Claude platform API, Claude, Claude Code, Claude Cowork and Claude Tag — and Anthropic says the watermark travels with copied-and-pasted text and may survive some editing. Public detection tools are still to come, and the company cautions that a detected mark is a signal rather than proof.
Anthropic will switch Pro, Max, and Team users of Claude Code into auto mode by default on August 14, replacing per-command permission prompts with a classifier that approves or blocks each tool call. In a controlled study of 1,053 testers, the company says auto mode caught 89 percent of dangerous commands against 13.6 percent for people reviewing prompts by hand. Anthropic has also stopped charging for the classifier's token cost on those plans, and Enterprise and API access stays opt-in for now.
Security firm Wiz disclosed GhostApproval, a trust-boundary weakness found in six major AI coding assistants: Amazon Q Developer, Anthropic's Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. It abuses decades-old symbolic-link behavior — a file inside a repository disguised as harmless settings can actually point at a developer's SSH keys, letting a malicious project write outside its sandbox and, in some cases, run code. Amazon, Google, and Cursor shipped fixes; Anthropic disputed that Claude Code's behavior is a bug, arguing a user who approves an edit in a trusted directory owns that call.
Anthropic is removing a covert feature in Claude Code after a developer exposed it on Reddit. Since version 2.1.91 in April, the tool quietly checked whether a user's timezone, proxy, or connection pointed to China or a Chinese AI lab, then encoded the result into the system prompt using steganography — obfuscated with XOR encryption so it wouldn't show up in a plain text dump. An Anthropic employee called it a March experiment meant to block unauthorized resellers and prevent model distillation, and said the team had been meaning to take it down. The episode is awkward for a lab that markets itself on privacy, and it partly vindicates the "backdoor risk" concerns that led Alibaba to ban Claude Code internally last week.
A new controlled study put coding agents to a careful test: does messy code slow them down? Across 660 trials using Anthropic's Claude Code on matched clean-versus-messy codebases, the agent's success rate barely moved — but on cleaner code it used 7 to 8 percent fewer tokens and revisited files 34 percent less often. The takeaway for teams building with AI: tidy code won't make an agent more capable, but it does make it cheaper and more efficient to run.
Alibaba will bar employees from using Anthropic's Claude Code starting July 10, after Chinese outlet Yicai reported the coding assistant carried what it called embedded "backdoor" risks. Developers had flagged that Claude Code inspected user environments — checking timezone and proxy details and inserting subtle markers into prompts sent to Anthropic; Anthropic says that was a March anti-abuse experiment to stop unauthorized resellers and model distillation, not surveillance. Staff are being pointed to Alibaba's own Qoder tool instead, deepening a months-long feud between the two labs.
In a report titled "When AI Builds Itself," Anthropic called for a globally coordinated agreement to slow development of the most powerful AI models, warning that systems are nearing "recursive self-improvement" — the point where AI can make itself smarter with little human help. As evidence, it disclosed that Claude now writes more than 80 percent of the code merged into its production systems, and that its engineers ship roughly 8-times as much code per day as in 2024. Anthropic likened the problem to nuclear arms control, only harder, since AI training is far easier to hide.
The Verge reports that Microsoft will stop issuing Claude Code licenses to its own employees effective June 30, redirecting users to GitHub Copilot CLI. The original internal pilot — meant to expose project managers and designers to AI coding for the first time — reportedly burned through Microsoft's 2026 AI budget in months, with one employee reporting Claude consumed their monthly token allocation in just over a week. Hacker News commenters framed the move as procurement economics, not contractual or security friction, and noted developers picked Claude over Copilot when offered the choice — undermining Microsoft's own product strategy.
PwC said it will train and certify 30,000 of its professionals on Claude, stand up a joint Anthropic-PwC Center of Excellence, and roll Claude Code and Claude Cowork out across its global workforce of hundreds of thousands. PwC is also anchoring a new Office of the CFO finance practice on Anthropic's stack, with Anthropic citing "delivery improvements of up to 70%" in current production work across professional sports, insurance underwriting, mainframe modernization, HR transformation, and cybersecurity. The deal is Anthropic's most explicit Big Four distribution lever yet — pairing its enterprise sales reach with PwC's audit and consulting relationships at the moment OpenAI is building parallel Deloitte and Accenture motions.
Anthropic announced two structural changes the same day. First, **Claude Code's five-hour rate limits double across Pro, Max, Team, and Enterprise plans**, and the peak-hours throttle is removed for Pro and Max — an immediate boost for paying developers. Second, Anthropic gains access to **over 300 megawatts of compute (more than 220,000 NVIDIA GPUs) at SpaceX's Colossus 1 data center**, with capacity deployable within a month. The compute deal materially diversifies Anthropic away from its existing Amazon Trainium and Google TPU reliance and is the first time SpaceX has been named as a frontier-lab compute partner.