AI progress — 2 November 2026

The most consequential item today is the reported backdooring of Anthropic’s VS Code extension on Cursor for almost 12 hours, with the compromise route still unknown. Developers who installed extensions in that window have something to check. Elsewhere, four major AI companies say they will adopt one shared opt-out signal for training scraping, and Apriel Voice 27B adds an open voice model that can use tools.

New models and papers

• Apriel Voice 27B Preview — an open speech-language model for speech, reasoning and tool use, built on a post-trained Gemma 4 26B-A4B checkpoint, that also accepts text and image input. Why it matters: a voice agent that can call tools no longer has to be stitched together from separate speech and text models, and the weights are open to try.
• On the Origin and Evolution of Training-Inference Mismatch in LLM Reinforcement Learning — a paper on why RL training data becomes off-policy when a separate inference engine samples responses, tracing the mismatch to engine numerics and stale weights. Why it matters: anyone running RL on LLMs with separate sampler and trainer gets a breakdown of where the drift comes from; the authors’ analysis is the claim, not yet an established fix.
• LiquidAI LFM3-1.7B — a 1.7B-parameter text-generation model from Liquid AI, listed on Hugging Face alongside Omni and VL variants. Why it matters: it is a small model family for on-device use that you can download today; the listing gives no benchmarks, so test it before relying on it.

New tools and software

• Claude Code v2.1.316 — a release adding CLAUDE_CODE_DISABLE_ULTRATHINK and pooled group budgets in the Claude apps gateway, set with pooled_budget on the spend limits admin API. Why it matters: admins can give a team one shared monthly budget on top of per-member limits, and individuals can switch the ultrathink keyword off.
• LangGraph 1.2.19 — a patch release fixing streaming issues, including node payloads rewritten by trace_policy and namespaces on messages and tools events from subgraphs. Why it matters: if you stream from nested graphs, these fixes change the events you receive, so check your consumers.
• Live previews of agent-built web apps on Bedrock AgentCore — AgentCore session endpoints give each runtime session an authenticated URL forwarding HTTP and WebSocket traffic to allowed ports; the post deploys a coding agent that keeps a Vite site running. Why it matters: you can watch an agent’s edits appear in a real browser without building your own tunnelling.

Overall digest

• Anthropic VS Code extension on Cursor backdoored for nearly 12 hours — Ars Technica reports the extension was backdoored for almost 12 hours; how attackers reached Anthropic’s verified Cursor account is still unknown. Why it matters: if you installed or updated it in that window, treat the machine as suspect and check the vendor’s guidance.
• A shared opt-out for AI training scraping — OpenAI, Google, Microsoft and Anthropic say they will adopt a “policy token” signal publishers can use to set AI training preferences once across providers; OpenAI describes it as a shared robots.txt signal. Why it matters: publishers get one control instead of one per company, though it depends on the companies honoring it.
• How we took over ChatGPT accounts — Parameter Labs write up a flaw they say let them take over ChatGPT accounts. Why it matters: this is the researchers’ account; the candidate text does not say whether it is fixed, so check OpenAI’s response before drawing conclusions.