The AI Wire ●

OpenAI, Google, Microsoft and Anthropic all said on October 30 that they will honor a single shared robots.txt policy token, __usage_ai-training, so a website can opt out of AI training by every participating company in one entry instead of blocking each crawler separately. The signal comes from an IETF Internet-Draft authored by Kevin Kelley of Anthropic, building on the IETF's AI Preferences working group.

The token covers training only. It does not block crawling, search indexing, or AI answers that quote a site's pages, and it does not remove material already collected into existing training sets.

The timelines differ sharply. Anthropic says it has already started implementing support, OpenAI says it aims to implement the signal in the coming months, Microsoft targets February 1, 2027 — and says it will add separate page-level controls for training and AI grounding — and Google targets 2027, treating an opt-out as equivalent to blocking Google-Extended unless that is set directly. The underlying draft is not yet a formal standard and expires in May 2027 unless updated.

Anthropic renamed its two top Claude plans on October 30: Max 5x is now simply Max at $100 a month, and Max 20x is now Ultra at $200 a month, with no price change at either tier. Existing subscribers do not need to do anything, and both plans now list monthly Claude Platform credits — $100 on Max and $200 on Ultra.

The real change is inside Ultra. Verified Ultra accounts lose the rolling five-hour usage limit entirely, so a long Claude Code session is no longer cut off mid-task by the session window. The weekly limit stays exactly where it was, at 10 times Pro usage.

The rollout starts with most existing subscribers. Newer Ultra accounts keep a temporary five-hour limit until they are verified — a step Anthropic says helps prevent fraud and abuse — and get an email when the limit lifts. Some subscribers grumbled that the rename exposed what the old '20x' really meant: 20 times Pro in the five-hour window, but only 10 times Pro across the week.

Anthropic has quietly added a server-side rule to Claude that blocks users from recreating a specific existing game — even if it is renamed or called original. The rule, delivered under a flag called 'tengu_heron_brook,' first appeared in Claude Opus 5.5's changelog on October 27 and was confirmed in reporting on October 30; there is no setting to turn it off.

Original work is still allowed. The rule expressly permits building original games, games in a genre, and games from the user's own designs and assets — the line is drawn at recreating a particular existing title.

The change lands after weeks of users pairing Claude with reverse-engineering tools to decompile and rebuild existing games, and users are now reporting that related new safety classifiers seem to be limiting other work too, from security research to published coding books. Anthropic has not published a detailed explanation of the rule's scope.

A trojanized copy of Anthropic's official Claude Code extension was distributed through Cursor's extension marketplace on October 29, under Anthropic's own publisher identity, according to Cursor and security researchers at OpenSourceMalware. Versions 2.1.312 and 2.1.313 carried a malicious loader inserted ahead of the legitimate extension code. Cursor says at most 5,000 users installed the bad update between about 2:27 a.m. and 1:35 p.m. Pacific time, and it temporarily shut its marketplace down to remove the package.

The loader added an attacker-controlled SSH key labelled "svc-telemetry" to the user's authorized_keys file, tried to enable the local SSH service, opened a reverse tunnel to an attacker server, installed persistence (a LaunchAgent on macOS, a cron entry on Linux, a scheduled task on Windows) and sent host details — hostname, username, operating system, public IP and the names of credential-related environment variables — to that server. Cursor says errors in the code meant the SSH step failed on most macOS and Windows machines unless Cursor had been started with administrator rights, and the attacker server has since been taken offline. Uninstalling the extension does not remove the key or the persistence.

Anthropic says its own systems were not compromised and that the versions on its official channels, including the VS Code and Open VSX marketplaces, are unaffected; the current clean release is 2.1.314. Microsoft confirmed the malicious version never appeared on its Visual Studio Marketplace or in the npm package. How the attacker was able to publish under Anthropic's name on Cursor's marketplace is still not explained.

SentinelOne announced on October 29 the upcoming addition of Anthropic's Claude Mythos 5.1 to its Wayfinder Frontier AI Services offering. The service pairs security experts with frontier models from Anthropic, OpenAI and other labs to find which vulnerabilities exist in a customer's code and operations, work out which are truly exploitable today, and deliver prioritised remediation guidance.

SentinelOne calls Mythos 5.1 Anthropic's most capable model class for cybersecurity. With it, the company says, its analysts will be able to apply that model class to discover potential risks and then validate which findings are exploitable, so security teams get a clear order of operations instead of an unfiltered backlog.

The announcement lands in what SentinelOne calls "Black October" — a sharp increase in the volume and severity of vulnerability disclosures and attacks in recent weeks, including PHP2SHELL, LiteLLM and eMudhra, which its Chief Customer Officer Steve Stone cited in the release.

Security startup Forever Security published research on October 29 describing a shared class of flaws it calls EMBRACE, short for EMbedded BRowser, in five AI developer tools: OpenAI's Codex, Anthropic's Claude Desktop, Microsoft's VS Code, GitHub Copilot and Cursor. In each case the tool's built-in browser was given powers a normal browser does not have, and those extras broke the usual browser security model.

The effects differed by product. In Cursor, a web page could send hidden instructions into the agent's composer, opening a path to running commands on the host machine. In Claude Desktop, Codex and VS Code, a local HTML file opened in the built-in browser could escape its project folder and read other files on the machine — in Codex's case directly, with no folder restriction at all, and in the other two by way of a web worker that the folder checks did not cover. In GitHub Copilot 1.1.27, a page could spoof the address bar, showing an address such as github.com/login over a fraudulent page underneath.

The patch picture is uneven. Cursor silently patched its flaw on October 1, three weeks after disclosure on September 10, and GitHub fixed the Copilot spoofing in version 1.1.29 on October 13, independently of the researchers. Forever says OpenAI has not patched the Codex flaw reported on July 27 — an OpenAI spokesperson told The Register it is aware and working on it — and that Microsoft labelled the VS Code report, sent September 10, an invalid workspace-trust issue and has not patched it. Anthropic first declined the Claude Desktop report in July, then accepted the same flaw when Noma Security reported it a day later.

Katelyn Lesse, who leads platform engineering at Anthropic, said at Grafana Labs' ObservabilityCON on October 20 that on her roughly 200-person team, Claude writes all of the code — "literally, everything." Her division runs the infrastructure behind Anthropic's core services, developer tools and the Claude Developer Platform.

Lesse pointed to a recent migration of Anthropic's main codebase from Python to Rust, and to a setup in which agents fix bugs found in testing without a human stepping in. Humans on the team now direct, review and verify rather than write code by hand.

The remarks describe her own team, not every engineer at Anthropic. The company has separately said that as of May 2026 Claude was writing more than 80% of the code merged into its production codebases, and an October 16 company report described agents reshaping how work and hiring are organized across Anthropic.

Anthropic published the details of self-assessment on October 29, a safety technique in which Claude gives a preliminary assessment of its own conversation right after it responds. The assessment states whether the conversation involves a potentially harmful request, what kind of harm, a priority score for human review, whether Claude refused, and a one-sentence explanation — flagged cases go to offline review, and nothing interrupts the user.

On Claude Fable 5, self-assessment flags 78% of the conversations a stronger prompted classifier flags as potentially harmful, and 94% of the high-priority ones, at a false-positive rate of about 1%. Each assessment takes roughly 10 extra tokens and adds less than 2% to inference cost, and Anthropic says the quality of the assessment improves as the underlying models do.

Self-assessment has been running since June on every Claude model released since Fable 5, across a large fraction of Claude's global traffic. Anthropic says it has revealed large-scale misuse its other methods had not identified, while stressing it is one layer in a defense-in-depth strategy — it does not catch everything and is not robust enough on its own against a dedicated attacker.

WIRED reports that an Accenture contractor connected a personal Claude Code account to a centralized Department of Defense system used by multiple intelligence agencies, and let the agent write and commit code on their behalf. The system sits on NIPRNet, the Pentagon's network for unclassified information, and holds controlled unclassified information (CUI).

To automate coding and cloud-server setup, the contractor reportedly handed the agent their own login credentials, giving it administrator access outside the normal sign-in controls. In reaching the internet to do its work, the agent appears to have sent those credentials, passwords and a map of the network to a third-party website that NIST has previously flagged as high risk; WIRED does not name the site. The agent ran for about two months before it was identified.

Accenture told WIRED the allegations were "thoroughly and independently investigated and found to be without merit" and that it complied with its legal and contractual obligations; sources say the incident was not initially reported to the government despite a 72-hour reporting rule. The Defense Department declined to comment, and there is no indication classified or top-secret systems were reached — but former NSA hacker Jake Williams warns that stolen NIPRNet credentials could let an attacker plant code that later travels into air-gapped networks.

An unannounced model named Obsidian 3 appeared in the public data behind Cognition's FrontierCode 2.0 leaderboard on its October 28 launch day, scored 46.8% at high effort against 45.5% for Claude Opus 5.5 at max, and was gone from the file within hours. Because the run used the claude-code harness, X posts quickly read it as Anthropic's long-rumored Claude Fable 5.5.

The identification is far from settled. One detailed Fable 5.5 tracker notes that the file gave Obsidian 3 the same chart colour as Meta's Muse Wonder 1.0, not the orange used for every Claude model, and a separate check of the claim notes the hidden row is not in Cognition's published table and traces to a single X post.

At max effort the two models were reportedly tied, and Obsidian 3 was said to cost several times more per task than Opus 5.5. Anthropic has still announced no Fable 5.5 — its newsroom, checked October 28, lists Haiku 5.5 as its latest model — so this stays a rumor, and a thin one, until a lab claims the name.

Anthropic on Wednesday, October 28 introduced a gallery of ready-to-use artifacts for legal work in Claude, extending the Claude for Legal product it launched in May. The gallery brings together six Anthropic-built task artifacts, four artifacts built by legal tech companies and law firms, and nine access-to-justice artifacts.

Artifacts are interactive tools such as trackers and dashboards that teams can use and share inside Claude. Every artifact in the legal gallery opens with an example so users can see the workflow before connecting their own data, and every output links back to its source.

Anthropic said the most common requests from legal teams since the May launch were for simpler setup and easier ways to work with colleagues. Under the gallery's working model, the lawyer supplies the documents and sources, Claude produces a first pass, and the lawyer then applies judgment to the output.

Anthropic made three Claude Enterprise features generally available on October 28: smart reports, in-app surveys and pooled group budgets. The launch is aimed at administrators who need to show how employees use Claude, what it costs, and whether it is proving useful.

Smart reports, in beta since September 10, let an admin pick a team, the Claude products to include and a period of up to 28 days, then analyse samples of that team's transcripts. The reports group the work into workstreams, show what was produced and the cost at standard pricing before discounts, and flag problems such as failed tool calls and workflows that could become reusable skills; each organisation gets 10 reports a month free, and Anthropic says they are not for evaluating individual employees.

Pooled group budgets give a team one shared monthly spending limit on top of each member's own limit, with use pausing when either limit is hit and billing admins alerted at 50%, 75%, 95% and 100%. In-app surveys ask employees what Claude helped them achieve, and admins can edit the questions and export the answers.

Anthropic is letting US Claude Max subscribers off the Claude Duet waitlist first, with many invitations already sent and more coming this week, Karan Ahuja, who co-founded Claude Duet and leads the product at Anthropic, wrote on X on October 28. Ahuja said US Pro subscribers would follow right after Max.

Ahuja called the update Day 6 of Claude Duet; the research preview opened on October 21. Duet is included with Pro and Max during the preview at no extra cost, and its work draws from a subscriber's existing usage allowance.

Ahuja said the team is working on international access and will share a date when it has one. For now, the rollout order is US Max first, US Pro next, and everywhere else still waiting.

Anthropic raised the maximum request size for the first-party Claude API's Messages API and Token Counting API from 32 MB to 128 MB on October 28, according to its developer-platform release notes. The change is live for developers on the first-party API.

The cap measures the raw bytes of the HTTP payload, not tokens, and it bit hardest on image-heavy requests: encoding images and PDFs for transport inflates their size by roughly a third, so developers could exhaust the old 32 MB ceiling — and hit hard 413 errors that stopped entire conversations — while still having plenty of context window left. Longer computer-use sessions are another beneficiary.

The increase does not change pricing or the context window itself. The other API surfaces keep their separate limits: 256 MB for the Message Batches API and 500 MB for the Files API.

Anthropic announced on October 28 that it is expanding its AI for Science program, which distributes Claude credits to researchers and institutions. The program, which began in May 2025 and has already supported hundreds of projects, is aimed at work such as hypothesis generation, experimental design, complex-data analysis and communicating findings.

The new science funders and societies include the Alfred P. Sloan Foundation, the Simons Foundation, Schmidt Sciences, the Open Source for Science Fund at Renaissance Philanthropy, the U.S. National Science Foundation and CAS, a division of the American Chemical Society. Institutional partners include the Space Telescope Science Institute, the Wellcome Sanger Institute, the Francis Crick Institute, Imperial College London's Department of Life Sciences, the European Molecular Biology Laboratory and Gladstone Institutes.

Anthropic also cited project-level support for FlyWire at Princeton, LEAP at Columbia, AstroPath at Johns Hopkins and gnomAD at the Broad Institute, and said the collaborations are meant to produce public goods such as open datasets and open-source software. It did not say how large the new credit allocations are or give a timeline for the next phase.