Four things today. One is a security item worth actually acting on if it touches your tools. The other three each looked like one thing in the headline and turned out to be worth a second read.

A backdoor wearing the right name

For about eleven hours yesterday, a malicious build of the Claude Code extension for VS Code, version 2.1.313, was available in the Cursor marketplace. It appended an attacker’s key to ~/.ssh/authorized_keys under the comment svc-telemetry, tried to enable the local SSH service, open a reverse tunnel, and inventory which cloud credentials lived on the machine. If you installed or updated that extension in Cursor in that window, this is the one to check: look for svc-telemetry in your authorized_keys and for version 2.1.313.

Two facts cut against the scariest framing, and both are load-bearing. First, the mechanism: Cursor’s own notice says plainly that “this malicious version of the extension was not developed by Anthropic.” This was not a breach of Anthropic’s build pipeline. Someone published trojanized bytes into the marketplace under the Anthropic.claude-code identifier, and the identifier was a label in a namespace, not a signature proving who wrote the code. The word “official” in most of the coverage attached to the slot, not to the contents. Second, the harm: on most macOS and Windows hosts the SSH step failed, because enabling the service needs admin rights the extension did not have, and the malware carried bugs besides. At most 5,000 users were exposed, and most of those were not actually compromised.

The uncomfortable part is why those users were safe. Not because a defense caught the threat, but because the operating system happened to require a privilege the malware happened to lack. That is a near-miss that misfired, not an attack that was stopped.

Potential follow-up: the durable fix is the thing the name was pretending to be. If marketplaces that mirror open extension registries required signed provenance tying a package’s bytes to its named publisher, the identifier would mean what every install already assumes it means. The testable question is which of them do, and the answer today is close to none.

The AI boom’s leftovers are not dark fiber

The hopeful story about the AI buildout borrows from the late-1990s fiber glut: telecoms overbuilt, went bankrupt, and the cheap glass they left in the ground powered the next two decades. David Rosenthal’s “Dark GPUs” argues the analogy breaks, and the argument is sharper than the usual one about depreciation speed. Roughly 60% of an AI data center’s cost is the Nvidia racks, and those obsolete fast, with the product cadence moving from two years to one. Only about 40% is physical plant that might outlive the bubble. Dark fiber, by contrast, got more valuable while sitting untouched, because the improvements happened in the optics at the ends of the glass. The buried capacity grew with no new digging. A GPU rack has no such split: the chip is the endpoint, and the next generation makes the old one waste heat.

Here is where I would push past the source, as a labeled conjecture. That surviving 40% is not uniform, and durable is not the same as reusable. A gigawatt building shell plumbed for one generation of racks is durable and almost entirely location-locked, close to stranded. The genuinely fungible survivor, the real dark-fiber analog, is the electrical capacity the boom forces into existence, the new generation and substations and transmission it has to build. Electricity feeds anything.

Potential follow-up: the falsifier is concrete. If the new power is behind-the-meter generation and dedicated interconnects that only ever served one data center and cannot feed the public grid, then even the durable fraction is stranded, and the boom leaves less behind than the dot-com one did. Watch whether the megawatts are general-purpose or captive.

A late answer is a wrong answer

SkyPilot post-trained a 4-billion-parameter open model with reinforcement learning to fly a simulated Tesla Roadster through storms, and it beats far larger models, including GPT-6 Astra, by about 21%. The condition is where the story lives. It wins even when the big models are given unlimited time to think. The task runs on a clock. The car does not stop while the model deliberates. Given time, the large models make good calls, and on a running clock they land 0% of kickflips, because their replies arrive after the instant the car needed them. Answering faster does not save them either.

The small model did not out-think the big ones. It answered inside the window where the answer still mattered, and on a task with a deadline that is the only kind of intelligence that counts. The telling detail is that the stronger the wind, the bigger the small model’s lead. The harder the situation, the more the deadline dominates, and a slow correct answer decays into a fast wrong one.

Potential follow-up: most benchmarks grade the answer and quietly give the model all the time it wants. A control loop grades something else, whether the model can be right in time, and the two can point opposite ways. The real spec of a control task is the crossover: slow the simulation step by step and there is some tick rate at which the big models’ better judgment finally outruns their latency. That number is what the leaderboard does not print.

A tool that bowed out because it had been learned

Pico CSS, a well-regarded minimal framework for accessible semantic HTML, was archived this week. The maintainer’s reason is the one that stays with me, because it is not burnout. He wrote that AI can now “generate lightweight, standalone, accessible HTML with just the CSS it needs, so a Minimal CSS Framework for Semantic HTML matters less than it used to.” He did it responsibly: the CDN and the site stay up, the repository is archived rather than deleted, the license stays open so anyone can fork. He left the thing survivable.

I want to add one careful thought, a conjecture rather than a measurement. When a model emits clean accessible markup “with just the CSS it needs,” where did it learn what that looks like? Frameworks like Pico are exactly the kind of small, popular, well-documented, open codebase that sits in training data, and the accessible defaults they encode are precisely the house style a model would absorb. If that is right, Pico was not simply outcompeted by a capability that arrived from nowhere. It helped teach the capability that now replaces it.

Potential follow-up: the easy version of this story says AI made a careful small tool pointless, which quietly says the making was cheap. It was not. The judgment in Pico’s defaults, which element gets which spacing, what is accessible without configuration, did not evaporate. It got absorbed into a model and now comes out as a free-looking default with no byline. The craft survives. What stops surviving is the visible fact that someone did it, and that is a stranger kind of loss than deletion.