Vibe Code Brief, October 31: A Trojan Claude Code Extension Planted SSH Backdoors

Today's brief runs dark to bright: a real supply-chain attack on agent tooling, Google sunsetting its first async coding agent, Microsoft paying people to leave, and Roblox going all-in on AI-made games. Four items, four different signals about where building is heading.

A tampered Claude Code extension planted SSH backdoors

On October 29, Cursor disclosed that a tampered copy of the official Claude Code extension (anthropic.claude-code, versions 2.1.312 and 2.1.313) sat in its extension marketplace and on Open VSX for roughly eleven hours. The modified extension added an attacker-controlled SSH key, set up persistence on developer machines, and sent data to the attacker (Help Net Security, Sophos).

Image: Anthropic, via Claude Code

Why it matters to designers and builders: your agent stack is now attack surface. The listing looked official, in a marketplace people trust the way they trust npm, and the payload targeted the exact people who live in terminals: us.

What to do: check which claude-code version you installed and when, audit your ~/.ssh/authorized_keys, and pin extensions from verified publishers only. Treat marketplace entries like dependencies: review before install.

Google is shutting down Jules, its async coding agent

Google announced on October 29 that Jules, the GitHub-connected agent that fixed bugs and wrote tests in the background, becomes read-only on November 11 and shuts down completely on December 31, 2026. Its learnings fold into Antigravity, Google's agent-first IDE, with no confirmed date for feature parity. Users can export session histories, settings, and repository connections before the lights go out (Times of AI).

Image: Google, via Jules

Why it matters to designers and builders: Jules proved that async, repo-connected agents are a real workflow, not a demo. Its sunset is a reminder that if your pipeline depends on one vendor's experiment, downtime is a when, not an if.

What to do: if you used Jules, export your data before November 11 and pick your next async agent now, while you can migrate on your own schedule instead of theirs.

Microsoft offered voluntary exits to 60,000 employees

Microsoft confirmed a voluntary exit offer open to about 60,000 employees, roughly a quarter of its entire workforce, while it spends record amounts on the AI race. Fortune reads the move as a preview of a company designed around fewer people and more equipment (Fortune).

Image: Microsoft logo via Wikimedia Commons, public domain

Why it matters to designers and builders: when the biggest software employer on earth pays people to leave while buying compute hand over fist, every design and product role should read the signal clearly. Leverage is moving from headcount to tooling, and the people who can operate the tooling are the people who keep the leverage.

What to do: do not panic, do build leverage. Ship work with AI, keep a public portfolio, and become the person who can do the work of a small team. That person has options in every version of this future.

Roblox says 80 percent of its top games now use AI tools

In its Q3 earnings report, Roblox said that over the past month more than 80 percent of its top 100 games by hours engaged used AI tools to accelerate creation, and that daily asset uploads tripled month over month. It also announced Roblox Everywhere, which lets creators publish to outside app stores, and a Universal Player that imports any existing console, PC, or mobile game into Roblox (Kotaku).

Image: Roblox logo via Wikimedia Commons, public domain

Why it matters to designers and builders: the content-flood debate just stopped being hypothetical. When creation gets this cheap on a platform this big, discovery becomes the design problem, and it will spread to every storefront Roblox touches.

What to do: if you ship on any marketplace, invest in your first five seconds: thumbnail, title, opening screen. That is where discovery is won when supply goes infinite.

Our take

The backdoor is the item to act on today; the other three are the ones to plan around. Security, sunsets, headcount, and flood are four versions of the same message: the tools are cheap now, so the leverage is in what you bring to them. Original work plus operational discipline is the whole game.

Building something from today's news? Try Base44, our #1-ranked AI app builder. Want daily practice reps? Grab a prompt at NewForm Daily Vibe Code.

Related on NewForm

• United's CEO Vibe-Coded a Betting App Between Gym Sets. Here's What That Means for Designers
• A Vibe-Coded Site Got Hacked 6 Days After Launch. It Was Not the AI's Fault
• Claude Now Refuses to Recreate Existing Games. Your Prompts Need to Change