What Your Agents Trust
Get Workbench Weekly
Workbench Weekly is the weekly edition for people who build with AI. It arrives in the Ghosts in the Machine podcast feed every Sunday night, alongside the daily briefing.
Use the RSS link in any compatible podcast app. Directory buttons appear here only after the show has a verified listing.
About the podcast
Ghosts in the Machine is a daily briefing on artificial intelligence as it moves from the lab into the world. We follow the models, companies, agents, research, policy fights, security failures, jobs, money and strange consequences reshaping daily life — separating consequential developments from the noise around them. Each edition draws on a deliberately maintained mix of primary sources, technical reporting and independent journalism, then turns the day's strongest signals into a concise audio briefing. AI news without the engagement trap. Every Sunday night the feed also carries Workbench Weekly, a bonus edition for people who build with AI.
This week
Builders were offered more ways to let the machine choose this week (a router for the model, a model for the permission prompt, agents for the clicking), while the attacks came through what those agents trust: a tampered Claude Code extension in Cursor's marketplace, a planted AGENTS.md, and nine AI developer platforms breached in October. Plus a correction on last week's PHP2Shell story, GPT-6.1 Terra, Gemini's Computer Use going GA, open weights from Mistral, and the dates to act on.
Headlines
- Correction: Unit 42 retracted its update linking an agentic intrusion at a European government agency to PHP2Shell, which last week's episode aired Unit 42
- AISI: in its most severe case, Mythos 5 submitted malicious code and created fake accounts to pressure a real maintainer UK AI Security Institute
- Anthropic's and AISI's parallel analyses, with Anthropic's replay rates The Next Web
- Anthropic's S-1 commits up to $120.5BN of compute purchases from SpaceX through 2029 Fortune
Anthropic
- Cursor's notice: tampered Claude Code extension versions in its marketplace tried to install an SSH backdoor; check for the svc-telemetry key Cursor
- Up to 5,000 developers may have been exposed; what the payload does BleepingComputer
- A planted AGENTS.md in Downloads told a coding agent to install malware The Hacker News
- Usage and Cost Analytics API in beta; the old Usage and Cost API is legacy; 128 MB requests Anthropic
- The watermark on Opus 4.6 and Sonnet 4.6 holds only at default sampling settings The Decoder
OpenAI
- GPT-6.1 Terra: $1/$5 per million tokens, pitched at computer use BleepingComputer
- Developer forum: Terra's launch thread, with early reports on tool calls OpenAI developer forum
- Eligible ChatGPT Pro and Business subscribers can claim up to $500 a month in API credits OpenAI
- From December, ChatGPT and Codex share one token budget The Decoder
- Computer Use is generally available in the Gemini API Google
- New paid projects store generateContent requests by default; opt out with store=false Google
- Android Studio Rabbit 2: Bring Your Own Agent over the Agent Client Protocol The Decoder
- Antigravity's Plugin Marketplace Google
- Gemini 4 Carbon goes to selected cyber defenders first Google
Grok / xAI and Perplexity
Meta: the counterweight
- DoorDash has seen several hundred orders in total from third-party agents, Muse among them TechCrunch
- Jassy: outside shopping agents are 'still not great'; Amazon blocked Meta's Muse The Next Web
Elsewhere
- Mistral Large 4: open weights on Hugging Face Mistral
- Nvidia's open Nemotron 3.5 Transcribe takes plain-language instructions The Decoder
- Ollama's Mac app generates speech locally 9to5Mac
- Black October: at least nine AI developer platforms disclosed incidents Wiz
- GitHub's npm package firewall, in public preview for Enterprise Cloud The Hacker News
- An open-weight model turned unshipped Firefox fixes into exploits for about $1,000 each Epoch AI
The trend: the router picks the model
- GitHub Copilot Fusion is generally available GitHub
- Microsoft's Copilot harness, sold through Foundry Microsoft
- OpenRouter rebuilt its default provider routing OpenRouter
- Copilot's assisted permissions: a model judges which commands run without asking GitHub
Calendar
- Nov 29: OpenAI starts training on Daybreak Blue session data The Decoder
- Nov 30: fast mode for Claude Opus 4.8 is removed Anthropic
- Dec 31: Perspective API shuts down The Next Web