Mon, Nov 2, 2026
Mistral releases improved Large 4 weights
Mistral releases improved Large 4 weights, Cursor removes a malicious Claude Code extension, and Cloudflare finds gaps in eMudhra patching. The Mistral model goes by Le Chonk; with a trillion parameters, it seems determined to justify the name.
Mistral releases improved Large 4 weights
The trillion-parameter multimodal model effectively ties GLM-5.3 on Artificial Analysis’s Coding Agent Index while using 47% fewer tokens per task. The Hugging Face launch includes day-one inference support in Transformers, vLLM, and llama.cpp. The modified-MIT license permits commercial use, but Model-as-a-Service businesses need a separate commercial license.
Cursor removes malicious Claude Code extension
Version 2.1.313 of Anthropic.claude-code in Cursor’s Marketplace was not made by Anthropic and affected at most 5,000 users on October 29. It collected host information and attempted an SSH backdoor that would usually fail, but standalone persistence scripts mean uninstalling may not be enough. Cursor blocked distribution, helped take the attacker’s server offline, and rebuilt and reopened its Marketplace.
Also
Cloudflare finds eMudhra patching gaps — Its probes suggest modern browsers mostly reject the compromised keys, while bots and older browsers lag. It found no evidence of interception of its connections.
Node.js 27 alpha ships V8 15.6 — Buffer and ArrayBuffer allocations now count toward the heap limit; its default becomes half of physical memory, bounded between 256 MB and 4 GB.
Supabase previews Multigres automatic failover — The paid-plan private alpha can promote a Postgres replica within seconds and hold requests during the switch. It isn’t intended for production.
OpenAI expands misalignment monitoring — In a replay of the Hugging Face incident, stronger monitors alerted security about 30 minutes after sandbox escape, over 30 hours before the actual breach.
Hugging Face launches speech and decision packages for Swift — AnySpeechRecognizer can track up to four overlapping speakers locally. AnyDecisionModel returns typed answers and probabilities rather than generated text.
Cloudflare makes private origins generally available — Private-IP origins can use its WAF, caching, and Workers through existing private connectivity, without opening inbound firewall access.
Supabase previews Explorer and repo-backed notebooks — Database and log queries share one editor. Notebooks save queries, not results, so investigations can be reviewed in pull requests and rerun against current data.
Vercel Daemons gain service bindings — calls stay private and tied to the deployment that started the daemon.
Google’s Computer Use tool reaches GA — across the Interactions and GenerateContent APIs.
OpenAI will honor a shared robots.txt training signal — letting website operators express their AI-training preferences.
Releases
- pydantic-ai 2.64.0minor
BoxdSandboxharness workspaces, stickyModelFallbackfailover, realtime speech word timestamps - mastra 1.37.0Mastra Gateway inminor
create-mastra, Factory board management, MCP task controls in Studio - convex 1.49.0Claude Code and Codex plugin installer,minor
v.function()handle validation - pnpm 12.17.0minor
pnpm peers check --global, Cargo and Python updates, dependency-group overrides, Docker-readable files - keyboard transcript selection,
codex queue --resume, safer follow-up prompts after safety blocks, GPT-6.1 Terra catalogs - transformers 5.22.0Mistral Large 4 support, FP8 adapter training, 28.9→2.8 GiB MoE backward memoryminor breaking
- node 26.13.026.x enters LTS as Lithium through April 2029, Linux binaries may requireminor
libatomic
Conferences
The opening keynote, with April Leonard (VP of Engineering for GitHub Copilot, GitHub) and Jay Parikh (EVP, CoreAI, Microsoft), launched Copilot Fusion, now generally available, which picks and orchestrates models for each task from a chosen effort level. It also previewed Projects in the GitHub Copilot app for agent work across repositories, and Copilot connectors that set up 26 GitHub-verified MCP servers, both in public preview.
Enjoy the rest of Monday. If a detail needs correcting or a tool is missing, let us know by reply. Pass this edition along to a colleague who follows these tools.
