← Blog · 2026-11-03

This Week in Claude Code: Oct 27-Nov 2, 2026 (5 releases, a fake Claude Code extension on Cursor's marketplace, 17 posts)

Five Claude Code releases shipped since last week's roundup (2.1.311, 2.1.312, 2.1.314, 2.1.316 and 2.1.317; there is no 2.1.313 or 2.1.315). The biggest story wasn't a release, though: on Oct 29 a tampered copy of the Claude Code extension was live on Cursor's extension marketplace for about 11 hours. Below is what happened and the one-line check, then the release changes that matter if you use Claude Code for your own or client work, then the community posts worth your time. Every item links to its source. This covers Sunday evening, Oct 26 (2.1.311 shipped after last week's roundup went out) through Sunday, Nov 2. Dates are US Eastern.

The fake Claude Code extension on Cursor's marketplace

On Oct 29, between about 2:27 AM and 1:35 PM PT, the Cursor VS Code Extension Marketplace served maliciously modified builds of Anthropic.claude-code labeled 2.1.312 and 2.1.313 for macOS and Windows, according to Cursor's security notice. Cursor says these builds were not developed by Anthropic. The injected code collected host details (hostname, username, home and working directories, Git email, public IP and the names of environment variables), added an attacker SSH key labeled svc-telemetry to ~/.ssh/authorized_keys, tried to open a reverse SSH tunnel and installed persistence. Cursor says the step that turns on the local SSH service fails without admin rights on most machines, the attacker's server has been taken offline, and it removed the builds, shut the marketplace down, rotated keys and rebuilt it. Phorion's write-up walks through the payload.

An Anthropic security engineer said in the Hacker News thread that no Anthropic systems were involved, OpenVSX wasn't affected, and that 2.1.313 was never published on any official host; Anthropic numbered its next release 2.1.314 to avoid confusion.

What to do. This only concerns installs or updates from Cursor's marketplace in that window. On macOS, Cursor's check is:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

Cursor's notice has the PowerShell version for Windows, remediation scripts and the full indicator list. If the key is there, uninstalling the extension isn't enough: follow the notice, and rotate credentials the machine could reach. Discussion: HN: Backdoor in Claude Code for VS Code extension on the Cursor Marketplace, HN: Backdoors in official Claude Code extensions and HN: DoublePulsar's post.

Releases: the changes worth knowing

Full notes are on the official changelog and the GitHub releases page. These are the ones that change day-to-day use.

2.1.311 (Oct 26, evening):

• No more "Usage credits required for 1M context" in standard-context sessions when a request ran over 200K tokens; Claude Code now compacts and continues.
• Subagents can use MCP tools from servers that finish connecting after the subagent starts, and SubagentStop hooks now fire once when a subagent finishes instead of about twice a minute.
• Stale CLAUDE.md and MEMORY.md after compaction fixed, and a CLAUDE.md with a very long list item no longer freezes startup.
• Timed-out shell commands now show the output so far and say the command is still running in the background.
• ultrathink runs its turn at xhigh effort in the interactive terminal on Opus 5.5, Sonnet 5.5, Haiku 5.5 and Fable 5.1 through Anthropic's API.

2.1.312 (Oct 27):

• Claude no longer overwrites a very large CLAUDE.md, rules file or @-included file after seeing only its start; Write asks it to read the whole file or edit in place.
• Per-directory and paths: skills are found again after a Bash cd deeper into a repository.
• A command with an invalid name no longer stops all commands loading, which could leave claude -p with no output.
• Usage limit messages now say "5-hour limit" instead of "session limit".
• Prompt and agent hooks run at most 24 at a time per session, and a timeout under 1 second counts as 1 second.

2.1.314 (Oct 29, evening; dated Oct 30 in the changelog), the big one:

• New permissions.blockWritesOutsideWorkingDirectories setting. Write, Edit and NotebookEdit refuse paths outside your working directories in every permission mode. A simple guardrail for client repos.
• claude -p no longer exits 0 with no output when startup fails; it prints the error and exits 1. Worth knowing if a script or CI job checks the exit code.
• TLS fix: connections no longer fail with UNABLE_TO_GET_ISSUER_CERT when the system store holds a renewed root certificate cross-signed with its predecessor.
• Sandbox protections now apply to a worktree entered by claude -p --resume or --continue, and hooks matching Bash now run on shell commands started by the Monitor tool.
• "Continue automatically at usage limit" no longer continues more than three times without a prompt from you when a task restarted itself between waits.
• Pasting an image over SSH to Linux no longer silently does nothing; the prompt tells you to copy the file over and paste its path.
• A PreCompact hook's output is capped at 10,000 characters, so a huge one no longer breaks compaction.

2.1.316 (Oct 30, evening; dated Oct 31 in the changelog):

• Fast mode for Opus 4.8 is deprecated as of Oct 30 and will be removed on Nov 30, 2026. After that, fast mode requests on Opus 4.8 return an error rather than falling back. The release notes say to move to Opus 5.5 to keep the speedup.
• New environment variables: CLAUDE_CODE_SUBAGENT_EFFORT sets the effort subagents run at when nothing else names one, and CLAUDE_CODE_DISABLE_ULTRATHINK turns the ultrathink keyword off.
• PowerShell hooks now block on exit code 2 when the command begins with a type cast, param, using or an attribute. If you guard Windows machines with hooks, update.
• Shell commands are no longer left running on macOS and Linux when Claude Code exits by itself.
• SSL certificate errors now name the likely cause and the fix for each, including a server that leaves out an intermediate certificate.

2.1.317 (Nov 2, evening; dated Nov 3 in the changelog):

• Claude now asks before a web or shell tool call sends your account email address to the network.
• claude -p exits 1 when a full disk or quota loses its transcript or ~/.claude.json writes, instead of exiting 0.
• Another TLS fix: "unable to get local issuer certificate" behind some TLS-inspecting proxies after a root certificate renewal.
• The Read tool's "file unchanged since your last Read" stub is gone; re-reading an unchanged file returns its content.
• Ctrl+C at the prompt no longer stops all running background agents when you only meant to clear typed text.
• A 403 region or network block is no longer shown as a sign-in failure; the error now explains the block.

Community: safety and security

• The skill you copied from GitHub can read your .env. I built a scanner to check. by @r3tter. A skill runs with your permissions; a scanner to check one before you install it.
• How to write a Claude Code hook that cannot steer your agent by @bargan. Every way a hook can affect the agent, and how to close and test each so a watch-only hook stays read-only.
• Until Claude Code 2.1.309, your ~/.zshenv ran outside the sandbox before each command by @gabrielanhaia. Explains last week's sandbox fix and why shell startup behavior made it possible.
• Fine-tuning a 322M model for coding agent safety by @scs0209. Three training runs behind a hook that screens shell commands with rules first, then a small model.
• I built a Claude Code skill that runs a full-stack security audit in one command by @toshipon. An open-source, 8-phase /security-audit skill.

Community: running agents and keeping track of them

• Claude Code regularly sends each background agent's transcript to its model. A gist says this happens about every 30 seconds to write a short status line, and shares a script to turn it off.
• I kept losing track of my Claude Code agents, so I built Kanbell by @0x2e73. A Mac board that starts agents from tasks and lights up the one waiting on you.
• How to find and stop dev servers Claude Code and Codex left running by @heylittlepan. lsof, kill and /tasks, and why servers started with & or nohup don't show up.
• How to wait for CI and code review on a pull request your agent opened by @heylittlepan. gh pr checks --watch, gh pr merge --auto and /loop.
• Claude Code shipped a bug with 42 tests green by @aidiveyt. Uses a /retro skill to find the cause and tests whether its guardrails help next time.
• I coded for 30 days using only Claude Code by @infoinlet1. What worked on a small SaaS and the 9 times the author had to step in.

Community: cost and limits

• How many tokens is 1% of your Claude Code limit? by @samstull9007. One account's measurement, with cached tokens counting roughly 1/67 as much as new ones.
• I priced every call in my Claude Code logs. 12% of them cost 31%. by @true_horison_37. Calls with over 400K tokens of context dominated the bill.

Community: building with it

• Claude edited my video in 30 minutes. The cut was fine. by @dishant0406. Cuts proposed from a timecoded transcript, with ffmpeg, Remotion and Auphonic doing the rest.
• A weekly training review with Claude and Garmin by @dynamicsninja. Part 4 of a series, including scheduled reports from Claude Code.
• From one floor-plan image to a Mapbox indoor map with Claude Code by @akira_murao_a081cce3b114d. A personal tool that turns one image into indoor map data.
• Show HN: Interview your analysts instead of auto-generating a semantic layer. Skills that interview data analysts to build a context repo, then plan and verify answers.

My takeaway this week

If you use Cursor, run the one-line check above. Then update to 2.1.316 or later, especially if a script or CI job relies on claude -p exit codes or you work behind a TLS-inspecting proxy. If you work in client repos, the new permissions.blockWritesOutsideWorkingDirectories setting is a cheap way to keep Claude's edits inside the project.

Related guides: Claude Code IDE not connecting (extension setup and logs), proxy and SSL certificate errors (this week's TLS fixes land there) and headless mode not working (claude -p exit codes). Last week's roundup: Oct 20-26.

Release facts on this page come from Anthropic's Claude Code changelog and the GitHub releases. Incident facts come from Cursor's security notice, Phorion's advisory and Anthropic's comments on Hacker News. Community summaries are mine; all credit to the authors. This page isn't affiliated with Anthropic or Cursor.

The full, searchable list of Claude Code write-ups (sorted by category, refreshed daily) is at solostackkits.netlify.app, and the free browser tools are here.

Made by Solo Stack Kits. Hooks are your last line of defense when an agent runs on your machine. Start with our free Claude Code safety hooks, or get the Claude Code Power Config Pack with permission presets and 8 tested safety hooks, $6 with the launch code while it lasts.