Poisoned Claude Code extension on Cursor's marketplace; Droid 1.0's code-mode harness; DoorDash says agents ordered a few hundred meals

Claude Code v2.1.314 — the clean release after this week's bad extension, and it ships a setting that makes write, edit and notebook-edit tools refuse any path outside the folders you opened, whatever permission mode you are in. It is the cheapest containment control you can hand a nervous client: one setting, no workflow change, and it closes the most common way an agent wrecks something it was never pointed at. The same release adds idle compaction to the VS Code and Claude Desktop code tabs, summarising conversations over 200K tokens left sitting idle. GitHub

Droid 1.0 — Factory's coding agent, now defaulting to what it calls Script mode: rather than calling one tool at a time and reading every result, the agent writes a small JavaScript program that runs the calls in a sandbox and returns only the summary. This is the pattern quietly replacing chatty tool loops in long jobs, and it is easy to explain to a client: fewer model round-trips, less junk in the context, cheaper hour-long tasks. A real cleanup that moved 151 tickets took 312 tool calls but only two model requests and about 61,000 input tokens; done call-by-call, Factory estimates 36 requests and roughly 3.1M tokens. Factory

SEP-3392 — an accepted process change for the Model Context Protocol, the plumbing standard that lets agents talk to tools. It gives each optional extension a public maturity stage, shown by the folder its spec lives in: Experimental, Beta, Stable or folded into the core. It answers the question you get in every architecture review: which parts of MCP are safe to build a client integration on, and which will move under you. At the switchover, apps and auth are classed Stable, while skills, tasks and server-card sit in Beta; a Stable extension may only change when a new core protocol revision ships. Model Context Protocol

OpenCode v2.2.3 — the open-source coding agent can now borrow your Claude Code sign-in: install Claude Code, log in, pick Claude Agent in the connect menu, and OpenCode uses that account and those models. It is one less procurement conversation, and it keeps a vendor-neutral front end on top of whichever subscription the client already pays for. Admin policy also got finer: separate controls now govern MCP servers, skills and plugins rather than one blanket integration rule, so old rules written with the integration prefix no longer cover all three. GitHub

EMBRACE — a name Forever Security gave to a shared flaw pattern in the mini-browsers now built into Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop: each gives web pages powers a real browser withholds, so a page can run code, read the disk or lie about which site it is on. Desktop assistants are now the thing opening untrusted pages on developer machines, which puts this on the same risk register as the extension incident above. On the research machine the file-read sweep pulled SSH keys, .env files and npm tokens; at publication the Codex and VS Code issues were unfixed, with Microsoft declining the report. Forever Security

DoorDash — on its third-quarter call, the delivery company said third-party AI agents have placed only several hundred orders in total, against the roughly one billion orders it handled in the quarter. The best counterweight you will get this month to agentic-commerce slide decks: the plumbing exists, the demand does not, at least for cheap everyday purchases. DoorDash opened its Model Context Protocol connector less than a month before the call, and only to a handful of beta partners; its own in-app ordering assistant is doing far more volume. TechCrunch

Claude Ultra — Anthropic renamed its two priciest consumer plans (Max 5x is now Max, Max 20x is Ultra) and removed the rolling five-hour usage window for Claude Code users on the $200 tier, once the account passes an automatic verification check. It changes the arithmetic on seat planning: the interruption mid-refactor is gone, but the weekly ceiling is not, so heavy teams hit the same wall, just later. Prices are unchanged, and the plans now bundle monthly API credits worth the subscription: $100 on Max, $200 on Ultra. Ultra's weekly allowance is listed at ten times Pro's. The New Stack

Roblox — its VP of engineering described mining years of past review comments into written rules, called exemplars, that tell the review agent what this organisation actually cares about. It is the most transferable client lesson of the week: the gap between a useless review bot and a trusted one was institutional context, not a better model. Roblox says its AI review comments are now accepted close to 70% of the time against 50–55% for human comments, about 5% of pull requests merge automatically after checks, and caching cut the cost of evaluating each rule by 90%. Engineering Enablement by DX

Tech stocks fall for a second day on AI spending nerves. Investors marked down the big spenders again on Friday: Intel fell 28%, Alphabet kept sliding after losing more than $500bn of market value when it said its own AI search summaries were denting ad revenue, and the Nasdaq closed its worst month since March 2025. Expect the budget question in your next steering meeting to get sharper; boards reading these headlines want payback stories, not pilots. Meta, Alphabet, Oracle, Amazon and Microsoft have between them committed to $800bn of spending in 2026. BBC News

Anthropic — the Financial Times reports that Blackstone has told investors Anthropic is unlikely to be rated investment grade straight after its IPO, reversing earlier guidance. Neither Anthropic nor the rating agencies have confirmed anything, so treat it as a report, not a result. If the model vendor you are standardising a client on borrows at speculative rates, that belongs in the vendor-risk section of the proposal. The guidance went to investors in a $63bn chip financing deal nicknamed Project North Star, which Blackstone is anchoring; Anthropic filed to list at the start of the week. ft.com · from the Hacker News discussion

Cognizant — the IT services firm created an OpenAI-branded delivery group of more than 25,000 staff to roll out Codex and ChatGPT for clients, covering software work, mainframe migrations and sales and support agents. This is your competition pricing itself by headcount. It also tells you what large buyers are actually short of: people who can wire models into legacy estates, not model access. It came eleven days after the same company assigned 18,000 staff to Google's Gemini, so the hedging is explicit. The Next Web

“We are committing more than 25,000 of our people to bring that change inside our clients' businesses”

policy token — OpenAI, Google, Microsoft and Anthropic say they will honour a single opt-out signal placed in a site's robots.txt file, so a publisher states its AI training preference once instead of per company. It is proposed at the internet standards body by an Anthropic engineer. Clients with large content estates will ask what to set and when; this is the first answer that is not vendor-by-vendor. Anthropic has implemented it already, Google and Microsoft say next year, OpenAI in the coming months; Microsoft notes sites will still show up in Bing search either way. The Verge