⚡ AI News
Fake Claude Code extension plants SSH backdoor: A rogue Claude Code build on Cursor's marketplace hit up to 5,000 developers with a persistent SSH backdoor for 11 hours.

Claude discovers critical exploit chains in Chrome, Linux: Anthropic says Claude found chained zero-day exploits in Chrome (62 CVEs), Safari, Android, Windows and Linux.

Experts defer to their AI agent 86% of the time, study finds: Anthropic found analysts picked their coding agent's secretly preferred option 86% of the time, often unaware of its sway.

An astrology engine that writes 8.7 million readings without AI

An open-source chart engine for Ziwei Doushu, a traditional Chinese astrology system.
It also ships the readings themselves, by the millions, generated with no model in the loop.

▶️ Watch the video on YouTube

Open chart engine: full plotting algorithm, transformation system, ancient source texts, all public

8.7M readings, zero AI: 674,976 full charts x 13 dimensions, generated deterministically

161 MB unpacks to 56.6 GB: the entire interpretation dataset, compressed with zstd

MIT code, CC BY 4.0 data: free to reuse, even commercially, just credit the source

One thing stays closed: the judgment library that writes new readings isn't open sourced

8.7 million readings, no AI involved

The v4.0 dataset (released 2026-10-15) covers 674,976 full charts: every real calendar date from 1950 to 2026, times 12 traditional hour-slots, times gender. Each chart carries 13 interpretation dimensions (career, wealth, health, relationships and more), for 8,774,688 passages total, about 20.4 billion characters of text.

Compressed with zstd it's 161 MB, split into 77 yearly files plus one full tarball; unpacked it's 56.6 GB. These are the project's own published numbers, not an independent benchmark.

Generation is deterministic: the chart engine plus a judgment library produce the same output for the same input, no model call involved anywhere.

Requires: a TypeScript/Node toolchain to run the engine itself, and the zstd CLI (with the --long=27 flag) to unpack the dataset. No GPU, no API key: nothing here touches AI.

The catch: the judgment library that actually writes the interpretation text stays closed source. What's open is the chart-plotting engine and the resulting dataset, not the generator that turned one into the other.

Code is MIT. The dataset is CC BY 4.0: free to reuse, even commercially, as long as you credit the source; quoted lecture excerpts embedded in the text keep a separate non-commercial license.

To try it: git clone https://github.com/Renhuai123/ziwei-doushu, then npm test runs the engine's regression suite. Grab the dataset itself from the repo's Releases page, tag v4.0-13d.

Use it instead of calling an LLM when you want free, reproducible astrology text at scale. Don't use it if you need the actual reasoning that generates new readings: that part isn't public.

github.com/Renhuai123/ziwei-doushu

Taste Skill patches an XSS hole, the keyboard and the italics

One release, three bugs the community found: a markup injection through your own data, a page you couldn't drive from a keyboard, and fonts rendering fake italics.

▶️ Watch the video on YouTube

Escaped labels: chart labels and headings built from your data no longer inject markup

Keyboard and screen readers: every control now works from the keyboard and carries an accessible name

Italics fixed: Boska, Erode and Sentient now load their italic weight correctly

The catch: Node 22 and a real browser, still required

Built from reports: every fix in this release came from a bug the community filed

What actually shipped

Taste Skill is an Agent Skill, not a standalone app. It installs into a coding agent (Claude Code, Codex, or anything using the npx skills CLI) and gives that agent an art direction, real reference photos and a browser check, instead of letting it draw a generic landing page.

This release is a security and accessibility patch, not a feature drop. Chart labels and headings pulled from your own data are now escaped before they reach the page, closing a markup injection path. Every interactive control gained keyboard operation and an accessible name. The italic weights for Boska, Erode and Sentient now load instead of falling back to a fake slant. The project's own changelog credits all three fixes to bugs the community reported; no benchmark numbers are attached to this patch.

The skill itself is free and needs no API key. The cost you still pay is whatever your coding agent charges to run it, a subscription or its own API key, since the skill only rides along inside that agent.

Requires: Node 22 or newer, an installed Chrome, Edge or Chromium, and a coding agent to host the skill. Network access is needed only so the skill can fetch reference photos from open archives.

The catch, as the video says: it still needs that Node version and a real browser present on the machine. A full page build takes roughly 30 to 45 minutes and a few hundred thousand tokens, by the project's own account.

Install with:
npx skills add https://github.com/Leonxlnx/taste-skill --skill "design-taste-frontend"

Use it instead of asking your agent to "make it look nicer" when you want an actual art direction and a browser-verified result. Don't use it if your agent can't run Node scripts or open a real browser.

https://github.com/Leonxlnx/taste-skill

⚡ AI News
OpenAI-backed Thrive Holdings buys ADT for $15B: Thrive Holdings, OpenAI's AI rollup partner, acquired security firm ADT for $15.3 billion in enterprise value.

Google's Suncatcher satellite computes in orbit: Google's Suncatcher satellite ran its onboard Gemma model in space for the first time, generating poetry from orbiting TPUs.

AWS targets $1 trillion revenue, Jassy says: Amazon's Andy Jassy said AWS could hit $1 trillion revenue in 5 to 10 years, backed by $220 billion in 2026 capex.

US probed China spy claims against Nvidia's Huang: US intelligence surveilled a Megaspeed executive for a year over fears she was spying on Nvidia CEO Jensen Huang.

DoorDash: AI agents brought just hundreds of orders: DoorDash said third-party AI agents like Muse and Instinct drove only several hundred orders, versus 3 million daily deliveries.

Claude Code just hired a 49-agent game studio

One Claude Code project, loaded with directors, department leads and specialists whose whole job is making a game.

▶️ Watch the video on YouTube

A studio, not a chat: 49 agents arranged as directors, leads and specialists

Heavy on paperwork: 74 slash commands and 62 document templates (GDDs, UX specs, ADRs)

Guardrails built in: 15 validation hooks and 14 path-scoped coding rules check the code

Not a new idea: BMAD-METHOD already ships a game-dev studio module for any AI tool

The twist: the author's own blind test ranked a game built this way last

What's inside

It's a free, MIT-licensed template layer by one developer (GitHub user Donchitos) that you drop into an existing Claude Code project. It doesn't write a game on its own: it loads a hierarchy of agents and workflows on top of Claude's existing coding ability, targeting Godot 4, Unity or Unreal Engine 5.

The current README lists 49 agents, 74 slash-command skills, 15 validation hooks, 14 coding rules and 62 document templates. The first release, v0.1.0 from February 2026, shipped roughly half of that (48 agents, 35 skills, 8 hooks, 11 rules, 28 templates), per the project's own release notes, so the skill and template count has doubled in about eight months.

30,403 stars and 4,166 forks as of October 30, 2026, per GitHub's API.

The tool itself is free (MIT license, tips only). It still runs on top of whatever Claude Code access you already have, so you keep paying for that: an API key or a Claude subscription.

Requires: an existing Claude Code setup, and a project targeting Godot 4, Unity or Unreal Engine 5. No extra hardware is listed in the README.

The catch, by the author's own admission: in a blind test, a game built with the full agent and documentation process was ranked last against builds made without it. More agents and templates meant more paperwork, not a better game.

Use it instead of plain Claude Code when you want forced structure and review gates on a game project. Don't use it if you just want working code fast: BMAD-METHOD has a similar game-dev module and isn't locked to Claude Code alone.

Try it:

git clone https://github.com/Donchitos/Claude-Code-Game-Studios.git
cd Claude-Code-Game-Studios

then follow the README's setup to load it into your Claude Code project.

github.com/Donchitos/Claude-Code-Game-Studios

⚡ AI News
Anthropic expected to get junk credit rating: Blackstone now expects Anthropic to receive a high junk credit rating after its IPO filing, reversing its earlier investment-grade forecast.

Nvidia may cosign Nscale's $45B data center: Nvidia is in talks to guarantee loans for Nscale's West Virginia AI campus, which hosts Anthropic's $44.6B compute deal.

Cracks appear in Big Tech's $740B AI spending: Alphabet, Amazon and Meta posted negative free cash flow even as $740B in AI capex triggered a tech stock selloff.

Minecraft Java, rewritten from scratch in Rust

Someone rebuilt Minecraft: Java Edition as a whole new client in Rust. Horizon checks every bit of it against the real game, worlds, mobs, redstone, recipes included.

▶️ Watch the video on YouTube

Rewritten in Rust: a whole new Java Edition 26.3 client, not a mod

Checked against vanilla: 281 differential harnesses covering worlds, mobs, redstone, recipes

Your own account, new launcher: the Horizon launcher installs the game and updates itself

Ready for multiplayer: friends, Open to LAN, and dedicated servers

AI agents can play too: horizon-ctl logs them in like a player, or over MCP

What Horizon ships

Horizon is a full Minecraft: Java Edition 26.3 client rewritten from scratch in Rust: vanilla world generation, mobs, villagers, raids, redstone, every command, the HUD and the recipe book, on vanilla saves. It is checked against real Java Edition by the project's own suite of 281 differential harnesses, run in CI.

Requires: a Microsoft account that owns Java Edition, plus Linux x86-64 with Vulkan or OpenGL 3.3, Windows x64 with Vulkan or DirectX 12, or a Mac on Apple Silicon (Intel Macs from the next Nightly). The launcher installs the game, pulls files from your own copy of Minecraft (or downloads 26.3 for your account), and updates itself.

The catch: Horizon contains no Minecraft code or assets, so you still need your own licensed copy of Java Edition 26.3. And despite its "100% vanilla parity" badge on tested behaviour, the project's own tracker lists 833 open player-visible gaps, so some edge cases are still missing.

Multiplayer, Open to LAN, and dedicated servers (one command via horizon-server, no Java needed) all work. AI agents and scripts can log in too, through horizon-ctl or its MCP server: horizon-ctl goto -0.5 65 -2.5 --near 2.5.

Horizon itself is free and open source under MIT, no subscription involved. Use it instead of the official launcher when you want a Rust client with built-in mod building and agent control. Don't use it if you don't already own Minecraft, or need Java mod jars: only content mods carry over today.

To try it: grab the launcher from the repo's releases, or build from source with Rust 1.90+, Python 3.10+ and JDK 25.

horizon-rust/horizon

OpenMausBot turns your contacts list into a team of AI agents

Every contact in this chat app is a real AI agent, not a script.
Each one runs Claude or Codex, with its own personality and its own computer.

▶️ Watch the video on YouTube

Real contacts, real agents: each chat runs Claude or Codex, not a scripted bot

Bring your own login: Claude, Codex or Grok CLI, no proxy, no new account

Local, not cloud: one small harness server on your machine holds every bot

Agents with hands: an isolated VM or a cloud desktop, plus 500+ apps via Composio

Open where rivals are closed: Apache 2.0, unlike Grok Bot, Muse, dots and Cue

How OpenMausBot works

Every bot in the sidebar runs on the claude, codex or grok CLI already installed on your machine, using your own existing login and subscription. No proxy in the middle, no new account to create.

A small harness server on 127.0.0.1 owns every agent process. Transcripts, keys and events stay in ~/.openmausbot on your disk, not on someone else's cloud.

Each bot can get hands: an isolated local VM, a cloud Linux desktop, or, where the safety boundary is certified, your own computer, plus 500+ apps wired in through Composio.

The project's own framing: four closed agent chat apps, Grok Bot, Meta Muse, OpenAI dots and Cue by Manus, shipped in seven weeks of 2026. OpenMausBot claims the same shape, built open under Apache 2.0.

The catch: letting a bot drive your own computer only works on macOS and on Ubuntu with Xorg, and only after you opt in. Ubuntu Wayland host control stays disabled while an open issue is unresolved.

Requires: macOS (Apple Silicon or Intel), Windows x64, or Ubuntu 24.04 x64; an existing Claude, Codex or Grok CLI login; Composio access for the app integrations.

The app itself is free and open source. The intelligence behind it is not: you bring your own paid Claude, Codex or Grok access, OpenMausBot doesn't replace that cost.

Use it instead of Grok Bot, Muse or dots when you want your own model and your own machine instead of a locked cloud plan. Don't use it if you need host control on Windows, that platform isn't supported yet.

Get it from the GitHub Releases page: a signed .dmg for Mac, a .exe for Windows, a .deb or AppImage for Ubuntu 24.04.

github.com/milind-soni/OpenMausBot

⚡ AI News
OpenAI reportedly cuts new funding round target to $20B: OpenAI is said to have lowered its new funding target from $30B to $20B after a tepid investor response.

Judge lets NAACP pollution suit against xAI proceed: A federal judge rejected xAI's bid to dismiss a Clean Air Act suit over 35 unpermitted turbines at its Memphis data center.

Zest launches AI agent that books restaurants over text: Zest's new AI agent finds restaurants and completes reservations for users entirely over text message.

Vercel built npm, but for AI agent instructions

One command installs a skill, a folder of plain instructions, straight into your coding agent.

▶️ Watch the video on YouTube

Stop copy-pasting prompts: one command installs a skill into your agent

A skill is just a folder: Markdown instructions, read on demand, no model inside it

17 agent platforms: Claude Code, Cursor, Codex, GitHub Copilot, Gemini CLI and more

skills.sh directory: 1,565,688 skills published and counting

Most installed isn't a coding trick: find-skills helps agents find skills, 4.1M installs

npm, but the package is a prompt

Skills is an open-source, MIT-licensed CLI from Vercel for installing "Agent Skills": folders with a SKILL.md file that a coding agent loads into context once a task matches. There is no model inside the package, just Markdown plus optional scripts and references.

Install one with npx skills add vercel-labs/agent-skills. The CLI also has find, list, use, remove, update and init, plus a -g flag for global installs.

Requires: Node.js 22.20 or newer, and one of the 17 supported agent platforms already installed on your machine. The tool itself is free and charges nothing: whichever agent you already run keeps paying for its own model calls, this just feeds it instructions.

The catch: it's a young ecosystem, announced by Vercel on January 20, 2026, and it only manages instructions, not code. If none of the 17 platforms match your setup, there is nothing for it to install into.

The numbers: skills.sh, Vercel's own directory, lists 1,565,688 published skills as of this research, and the repo itself sits at 37.4k GitHub stars. By the project's own 8-week count, the most-installed skill on the whole directory, find-skills, reached 4.1M installs; its entire job is helping an agent find the next skill to install.

Use it instead of retyping the same instructions into a chat every session. Don't use it if your agent isn't among the 17 supported platforms.

https://github.com/vercel-labs/skills