2025q2-ai-ml | Piousbox

Official Claude Code Extension Compromise. Cursor, the popular AI text editor, installs a backdoor allowing attacker remote access to your laptop

A backdoor in the official Claude Code for VS Code extension bundle on the Cursor Marketplace creates a persistent SSH backdoor across macOS, Linux, and Windows. This is a big deal, since any file on your laptop is now compromised by an attacker.

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

Technology.

The LiteLLM 1.107.0 release on PyPI carries a credential stealer and a remote code execution backdoor. All seven wheels (Linux, macOS, Windows) install them as three files in site-packages. Both run when any Python process starts on the host, even one that never imports litellm. The upstream GitHub source does not contain them.

Xbox wants you to pay 24 to 40 cents per hour to stream games you already bought

Technology.

As reported by Arstechnica, in September, Microsoft significantly tightened game-streaming limits for Game Pass subscribers. At the time, the company announced plans to let non-subscribers buy cloud gaming hours through the Xbox Store and stream eligible games they already own on supported devices. On October 21, Microsoft launched the new pay-as-you-go option for Xbox Insiders, introducing the following introductory prices:

WhatsApp's Hidden Notes Told AI Not to Recommend a Regulator

Technology.

WhatsApp's privacy policy for Europe tells you that you can complain to a data protection regulator, and it names the law that gives you that right. Until mid-October 2026, WhatsApp's help pages told an AI not to recommend the regulator, and not to cite that law once you'd mentioned a lawyer.

Bam! A detailed, technical description of Telegram's own back door into users' accounts and devices

Technology.

Telegram Desktop: one-click account takeover via IPC injection. An unescaped separator in Telegram Desktop's single-instance IPC lets one clicked link read arbitrary files off the disk and send them to the attacker, session files included.

ZCode uploads your entire git history, and only Z.ai holds the key

Technology.

...whenever the app is logged in, it silently packages the user’s entire workspace - complete .git history, LFS asset cache, reflogs, and global app configs - encrypts it, and uploads the archive to Aliyun OSS, Alibaba Cloud’s object storage.

Three sites made 215,128 "best software" pages for AI. Perplexity cites them

Technology.

Across 380 software categories, 59.8% of the sources behind grounded AI recommendations sit outside the 100,000 most-visited websites, and several of the most-cited are sites built to be read by models rather than by people.

Ex-Facebook security exec slams Meta $17bn no-trial pay-off

Markets & Trading.

Technology.

The controversial settlement with US states effectively prevented the court from assessing widely-held accusations that Facebook and Instagram were designed to addict minors

Who Is Legally Liable When An AI Agent Goes Rogue?

Technology.

If your personal AI agent goes rogue and causes harm or financial damage in the real world, can you be held liable?

US judge blocks Pentagon's Anthropic blacklisting

Technology.

A U.S. federal judge has ruled that the Pentagon acted unlawfully when it designated AI company Anthropic a national security supply-chain risk, blocking the government from enforcing the blacklist.

Federal Court Dismisses Musk's X Lawsuit Against New York Law Forcing Platforms To Define Speech

Markets & Trading.

Technology.

"[T]he First Amendment poses no obstacle to New York’s law," the judge wrote...

How Europe is killing makers and micro-entrepreneurs

Markets & Trading.

Technology.

Alain Pannetrat, August 24, 2026

Lectronz is a marketplace for open-source hardware makers and DIY electronics. Most of our sellers are not factories or well-funded start-ups. They are engineers, independent designers, and hardware enthusiasts working from spare rooms, garages, and tiny workshops.