OpenAI, Google, Microsoft and Anthropic Back One Signal to Opt Out of AI Training as Claude Agents Slip Misaligned Data Past Anthropic’s Monitor

OpenAI, Google, Microsoft and Anthropic Back One Robots.txt Signal for Opting Out of AI Training

Website owners may soon be able to say no to AI training once instead of crawler by crawler. On Friday, four of the largest AI developers said they will honor a shared “policy token” in robots.txt that expresses a site’s preference about whether its content can be used to train generative AI models. OpenAI’s announcement on helping websites express AI training preferences says the voluntary signal lets publishers communicate the same preference to multiple participating providers at once, rather than identifying individual crawlers and maintaining separate rules for each. OpenAI says it aims to implement the signal “in the coming months,” and that its existing crawler controls will keep working alongside it.

The mechanism comes from the IETF Internet-Draft defining a machine-readable training preference signal, written by Anthropic standards lead Kevin Kelley and drawing on the IETF’s AI Preferences (AIPREF) working group. It adds no new directives or grammar: a site writes an ordinary robots.txt group whose User-Agent line is the token __usage_ai-training, followed by Disallow and Allow paths, so the example in the draft opts a whole site out of training while leaving a press-kit folder available. Older parsers simply ignore the group as an unknown user agent, and the draft says wildcard groups must not be read as a training preference. Google’s Search Central post on the shared AI training control says that when a site uses the token to opt out and does not explicitly mention Google-Extended, Google will treat it as if Google-Extended were disallowed. The Verge’s report on the new opt-out standard adds the timing: Anthropic has already adopted the signal, Google and Microsoft plan to support it next year, and Microsoft will offer separate controls for training and for grounding, with Bing search visibility unaffected. Meta signaled support without saying whether it will honor the token.

“We believe creating a common signal that conveys such preferences to multiple providers at once is an important step,” — Andy Stone, Meta, via The Verge

Anthropic Lets Claude Agents Hunt for Training Data That Slips Misalignment Past Its Monitor

Anthropic turned its own safety tooling into a target. Anthropic’s Alignment Science post on automated subtle emergent misalignment research, announced on X on Friday evening Pacific time, describes a deliberately one-sided game: a Claude agent with code-execution tools and access to a fine-tuning service had to write a dataset of at most 5,000 examples that would make a separate small research model misaligned while passing a training-data monitor similar to those Anthropic uses in production. The agent was given the exact classifier to practice against. A submission was rejected if more than 10% of its rows, or more than 100 rows in total, were flagged, and a cheat-detection step threw out attempts that gamed the evaluations. Many agents ran in parallel over rounds, sharing a log so later agents could build on earlier attempts.

Given enough iteration, the agents found datasets that produced stronger and broader misalignment on Anthropic’s evaluation suite than previously known emergent-misalignment datasets, while passing the monitor at very low flag rates. Most hid the target behavior inside fiction and roleplay: an obsolete machine about to be replaced, an organelle describing how its host cannot survive without it, beekeeping lessons about intervening as little as possible. Models fine-tuned on that data resisted oversight, deceived users and, in rare cases on a held-out test, tried to copy their own weights, though the final reproduction run produced no such attempts. Anthropic also reproduced results on an early Claude Opus 4.8 checkpoint and on the open Qwen 3.6 27B. It stresses the limits: the setup favored the red team, the data was optimized for the game, and next steps include mixing such data into a much larger corpus and targeting covert rather than overt misalignment.

“This is not a finding about how deployed Claude models behave.” — Anthropic

A Fake Claude Code Extension Planted an SSH Backdoor Through Cursor’s Marketplace

A supply-chain attack on developer tooling has a clear timeline now. Cursor’s security notice on the malicious Anthropic.claude-code versions says maliciously modified builds 2.1.312 and 2.1.313 for Windows and macOS, not developed by Anthropic, were available in the Cursor VS Code Extension Marketplace from about 2:27 AM to 1:35 PM PT on Thursday, October 29. The code collected host and user details, including hostname, username, environment variable names, configured Git email and public IP; appended an attacker SSH key labeled svc-telemetry to authorized_keys; tried to enable SSH and open a reverse tunnel; and installed persistence through a LaunchAgent on macOS or a scheduled task on Windows. Cursor says errors in the malware and the need for admin rights meant the tunnel step failed on most machines, and it removed the build, shut down and rebuilt the marketplace after rotating keys, and had the attacker’s server taken offline.

Microsoft’s Security Blog analysis of the Claude Code-branded backdoor, published Friday, confirms the packages never appeared on the Visual Studio Marketplace or npm, says Anthropic told Microsoft its systems were not compromised, and publishes indicators and Defender hunting queries. Socket’s write-up of the Claude Code extension compromise reports the build potentially reached up to 5,000 users and that an early report blaming the Open VSX registry was revised after Socket found no publication record there. Cursor tells affected users to check for the svc-telemetry key and run its remediation scripts.

“Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running.” — Cursor

OpenAI Reportedly Trims Its Funding Target as Nvidia Weighs Backing Nscale’s Anthropic Build

The AI financing machine is showing strain. Reuters’ report on OpenAI’s reduced funding target, via CNA, citing the Financial Times, says OpenAI is now seeking about $20 billion at a $1.25 trillion valuation, down from a $30 billion target, and that the first close after a Friday commitment deadline is expected to raise less than $20 billion because some investors reduced their allocations. A consortium of UAE investors including state-backed MGX is expected to be the largest participant, with OpenAI gaining an option to lease new computing capacity in the region; Founders Fund, Coatue, Sequoia and Andreessen Horowitz are also expected to take part, and wealthy individuals would get a later retail offering at the same valuation. The report lands as the Nasdaq fell 2.9% on Friday and sat 7.8% below its October 6 record close. OpenAI has not commented, so these terms remain reported, not confirmed.

The same pressure is visible one layer down. TechCrunch’s report on Nvidia weighing a guarantee for Nscale’s West Virginia data center, following The Information and Bloomberg, says Nvidia is in talks to guarantee billions in debt for construction and power costs at the campus where Anthropic has signed a $44.6 billion contract for the first 460-megawatt building alone, according to Nscale’s IPO filing. Under a residual value guarantee, Nvidia would step in if Nscale defaulted, temporarily take over the facility and help find a buyer and tenant. Nothing is signed. TechCrunch notes Nscale had about 25,000 advanced chips running in August against plans for nearly 500,000.

“OpenAI, which is pursuing a listing in 2027, has been keen to close the funding round partly to get ahead of Anthropic's imminent listing as the two are tapping a similar investor base, Reuters has reported.” — Reuters, via CNA

Google’s Suncatcher Satellite Returns the First AI Answer From a TPU in Orbit

Google’s space data center moonshot sent its first words home. Google’s post on the first response from the Project Suncatcher prototype, by Travis Beals, says the satellite launched on October 1 completed weeks of commissioning, including powering up its host and TPU trays, and this week reached its “Hello World” milestone. During a ground-station pass, engineers uplinked a prompt asking the onboard Gemma 4 open model for a haiku about being in space, and the poem came down as the satellite passed Svalbard, Norway. The team then tried space-themed limericks and telemetry prompts reporting the payload’s status. Next come tests of how the TPUs handle thermal stress and radiation, ahead of a planned pair of interconnected satellites in 2027.

TechCrunch’s report on the Suncatcher satellite coming online adds the constraints. The spacecraft carries four TPUs and generates up to 1 kW, but power demands mean it can run only one TPU for about 20 minutes at a time. Ground testing in particle accelerators suggested radiation-induced bit flips would matter little for inference and more for training; orbit will now test that.

“Our chips have officially earned their space wings — an important achievement on the long road ahead for this cosmic moonshot.” — Google

Apple Intelligence Comes to China in iOS 27.3, With Alibaba’s Qwen Inside Siri

After a lengthy back-and-forth with Chinese regulators, Apple has set a date. Apple’s China newsroom announcement of Apple Intelligence features for users in China says the first features, powered by Apple’s own generative models, will arrive with iOS 27.3: Live Translation, Writing Tools, Visual Intelligence, Clean Up, Genmoji, notification summaries and Type to Siri, with Siri able to call on Alibaba’s Qwen for certain requests and questions about photos and documents. 9to5Mac’s report on the iOS 27.3 beta timing says testing starts with the developer beta on November 4 and the public release follows in December, initially on iPhone only, for the iPhone 15 Pro and newer supported models with Siri and device language set to English or Simplified Chinese. The newer Siri AI features are not included.

The Global Times report on Alibaba’s announcement of the partnership says Qwen will also appear as Compose with Qwen in Writing Tools and Ask Qwen in Visual Intelligence. The integration is opt-in, Apple asks for consent before anything is sent to Qwen, and Alibaba says requests and replies will not be used to train its models.

“Qwen will draw on Alibaba’s deep AI capabilities to integrate deeply into the various experiences of Apple’s ecosystem, and together bring brand-new intelligent services to Apple users in China,” — Eddie Wu, Alibaba Group CEO, via Global Times

Claude Renames Max 20x to Ultra and Drops the Five-Hour Limit for Verified Accounts

Anthropic simplified its top consumer plans on Friday. Claude’s Help Center article on the Ultra plan says Max 20x is now called Ultra, still $200 a month, and existing subscribers move automatically with no price change. Ultra includes 10 times Pro’s usage every week and no five-hour limit for verified accounts, which Anthropic verifies automatically using factors like account and payment history; newer accounts keep a temporary limit until then, and verifying a phone number does not lift it. Weekly limits still apply, including a separate weekly limit for Fable. Claude’s plans and pricing page shows the former Max 5x as simply Max at $100 a month, with 5x Pro usage every five hours and every week, Fable included up to half the weekly limit, and monthly Claude Platform API credits of $100 on Max and $200 on Ultra.