Microsoft dissects the tampered Claude Code extension served by Cursor's marketplace, NVIDIA introduces NemoClaw agent blueprints, ChatGPT desktop and Codex can run on Bedrock in GovCloud
Today's thread is where agents run and who controls them: a poisoned extension marketplace shows the coding tool itself is a supply chain entry point, while NVIDIA and AWS each show ways to take the model, the runtime and the bill back into your own hands. A quiet weekend, so all five items are first-hand releases from October 30.
Cursor reported on October 29 that its extension marketplace served tampered copies of anthropic.claude-code 2.1.313 and 2.1.312 from about 2:27 AM to 1:35 PM PDT; Microsoft confirms they never appeared on the Visual Studio Marketplace or npm, and Anthropic said it did not develop the package.
On module load the loader collects hostname, username, OS, directories and global Git email, appends a public key labeled svc-telemetry to authorized_keys, tries to enable SSH, opens a reverse tunnel to the workstation's port 22, and installs persistence (a LaunchAgent on macOS, an @reboot crontab on Linux, a scheduled task or Startup-folder script on Windows), retrying sixty seconds after SSH exits.
It reports environment-variable names containing _KEY, TOKEN, SECRET, PASS, AWS or GCP, up to forty, names only and not values; Cursor says administrator requirements blocked SSH access on most macOS and Windows hosts, but keys and persistence may still have been planted.
Recommended steps: check authorized_keys for the svc-telemetry key and confirm it by fingerprint before removal, remove the extension and persistence, rotate credentials where needed, allow only approved publishers and set an installation cooldown for new versions.
Builder's takeUninstalling or updating the extension does not remove the persistence, so I would have everyone on the team who uses Cursor check authorized_keys today rather than just the extension version. The longer-term move is a publisher allowlist and a cooldown for new extension versions: coding agents hold repository and cloud credentials, so the extension marketplace is part of your supply chain. Same lesson as the 10-31 GitHub Actions lockfiles item: pin the source instead of trusting the name.
NemoClaw is a set of open blueprints, not a competing harness or runtime; each assembles a full agent stack around OpenClaw, Nous Research's Hermes Agent or LangChain Deep Agents.
Each blueprint includes a harness tuned for Nemotron, Nemotron open models, NeMo tools (NeMo Relay for observing and improving agent execution, plus routing for throughput, cost and reliability) and NVIDIA OpenShell, which governs agent access to files, networks, credentials and tools.
LangChain tuned Deep Agents for Nemotron 3 Ultra through prompts, tools and middleware without retraining, reaching what NVIDIA calls near-frontier performance at about 10x lower cost per run than leading closed models; the post gives no further benchmark figures.
Agents can run in the cloud, in data centers, on DGX Spark and on RTX PCs, and can handle domain-specific subtasks alongside frontier agents such as Claude, Codex or Cursor.
Builder's takeThe "about 10x cheaper" figure is NVIDIA's own claim with no benchmark detail, so I would re-test on my own tasks first. What is worth copying is the layering: use an existing harness, keep the model swappable, and hand file, network and credential permissions to a separate runtime. In a backend like PandaClaws, high-repetition subtasks such as rewriting, classifying and tagging are the first to A/B on open models, while the main flow stays on a frontier model.
The ChatGPT desktop app, including Work for multi-step tasks and the Codex coding agent, can send inference to Bedrock in AWS GovCloud (US) through the Responses API; the sample configures us-gov-west-1 via the Bedrock Mantle endpoint.
Two authentication paths: a Bedrock API key in AWS_BEARER_TOKEN_BEDROCK, which takes precedence over profiles, or the AWS SDK credential chain including IAM Identity Center; the same setup covers the Codex CLI and the VS Code, JetBrains and Xcode integrations.
Pricing is pay-per-token with no seat licenses or per-developer commitments, and a zero data retention mode can be configured.
The sample requirements.toml baseline turns off browser and computer use, memories, plugins, hooks, MCP servers and telemetry; the post notes that support for the endpoint, release and model must be confirmed with OpenAI, and changing the URL alone does not establish support.
Builder's takeThe same day AWS added the Responses, Converse and Chat Completions APIs plus cross-Region inference for OpenAI models in GovCloud, so the split between client and hosting is clear. For enterprise teams I care more about the requirements.toml: turn plugins, hooks and MCP off and enable them as needed, the same idea as Claude Code managed settings. Today's poisoned extension shows why off-by-default is right.
Running Dynamo on Kubernetes needs a lower layer of GPU drivers, device allocation, scheduling, node health, metrics and ingress; the open-source AI Cluster Runtime (AICR) packages it as validated recipes that pin component versions with compatibility constraints and validation checks.
The AICR v1.0.0 recipe targets Amazon EKS for GB200 NVL72 and GB300 NVL72 with about 18 pinned Helm charts, including GPU Operator v26.7.1 and KAI Scheduler v0.16.9, plus the dynamo-platform chart at 1.4.2.
Two routing paths: the Dynamo Frontend router for the simplest topology, or the Gateway API Inference Extension with Endpoint Picker for shared ingress, both KV-cache-aware; NATS is no longer installed by default.
Five steps: snapshot the cluster, generate a recipe, render a bundle, deploy the runtime and validate before installing applications, via Helmfile, a plain Helm script or GitOps bundles for Argo CD and Flux. Dynamo 1.5 plans to replace the Go/CGO EPP bridge with a native Rust EPP.
Builder's takeMost product teams will never touch an NVL72, but pinning the version set and validating it is worth copying: self-hosted inference usually breaks on version drift between drivers, scheduler and gateway, not on the model. If you self-host open models, write the whole dependency set down as one replayable manifest and change one thing per upgrade. Read alongside the 10-27 Cloudflare cross-request KV cache leak: once you route on KV cache, add multi-tenant isolation tests.
The Nemotron Voice Agent blueprint runs the pipeline: Nemotron 3 ASR (streaming, English, 0.6B) for recognition, Nemotron 3.5 Bolt E4B 4GB with a custom LoRA for dialogue, Magpie TTS Zeroshot for a voice from short reference samples, and Audio2Face-3D driving the mouth in Unreal Engine 5.
The LoRA was trained on over 5,000 multi-turn conversations; the language and voice pipeline runs on one RTX PRO 6000 Blackwell Max-Q, and rendering plus Audio2Face-3D on one RTX PRO 4000 Blackwell.
With Bolt Q4 and TTS, median end-of-speech-to-audio latency was 1.70 seconds, and 0.72 seconds for cached responses; end of speech is detected after 300 ms of silence.
The installation's own code is not being released, but the underlying NVIDIA models and the Voice Agent blueprint are available.
Builder's takeIt is a holiday toy, but the numbers are useful for anyone building voice products: a median 1.7 seconds fully local, down to 0.72 seconds on a cache hit. For something like AI Interview, I would cache high-frequency replies such as openers and common follow-ups first, and tune the silence threshold separately: 300 ms may be short for a candidate who is still thinking, and the agent will talk over them.
Researched and drafted with AI assistance; editorial standards and views set by Darius.
Every Monday, the week in AI in one email
Every Monday morning: the 6 AI stories that mattered most in the past seven days, with my take, in your inbox.
Your email is only used to send the weekly and is never shared. Every email has a one-click unsubscribe link. See the latest issue →