A Do-Not-Scrape Sign Nobody Has to Obey

Today is Saturday, October thirty-first, twenty twenty-six, and welcome to The Daily Reboot.

Here's what happened in tech on Friday.

Four AI companies agreed on one way for websites to say no to training, and it's a request, not a lock. A trojanized Claude Code extension sat in Cursor's marketplace for about eleven hours. And Cloudflare found certificate keys so weak that one of them came down to the number four.

Let's get into it.

The strangest thing about the new AI scraping opt-out is how little is new in it.

The Verge reports that OpenAI, Google, Microsoft and Anthropic said they'll adopt one shared robots.txt signal for publishers' AI training preferences. The details sit in an Internet-Draft from Anthropic technical lead Kevin Kelley, submitted to the IETF on Friday.

Here's the interface. You add a group to robots.txt keyed to a user-agent token, two leading underscores, then usage, then ai-training. Under it you write ordinary allow and disallow path rules. Those rules say which of your content may be used for training.

The draft reuses robots.txt groups and rules exactly as they are. No new directives, no new grammar. The compatibility plan is that old software ignores it, the way it ignores any group it doesn't recognize.

Now the catch. This token expresses a preference about use. It is not a crawling directive. A crawler may use it to inform its crawling, but if you want to limit crawling, you still need rules for each crawler's own product token. It's a note on the door, not a lock.

And it's a draft. The IETF Datatracker says it isn't endorsed by the IETF and has no formal standing in the standards process. It expires May third, twenty twenty-seven.

Timelines differ, per The Verge. Anthropic has already adopted the signal. OpenAI says it will implement it in the coming months. Google and Microsoft plan support next year. Those are company statements, and implementation wasn't complete at publication.

Microsoft said sites can opt out of AI training or AI grounding and stay in Bing results. Google already had separate controls for training and AI search features.

If you run a site, the draft gives you a way to state that preference. If you build crawlers, that's where the work is. Training, grounding and crawling are now three separate questions, and your code has to keep them apart.

Publishers will say a voluntary signal means little without enforcement. And nobody has said what the remedy is when a crawler simply ignores it.

That signal asks nicely and enforces nothing. This repo is the opposite, because every weight in it was computed by a compiler, not trained.

It's called Nesformer. It compiles a sixty-five oh two CPU, two kilobytes of RAM and a cartridge's program ROM into the weights of a stock Qwen three point five model. The model predicts the CPU's execution log token by token, and a host program draws the picture and reads the controller.

Seven Gated DeltaNet layers do the work. Each head keeps a one twenty-eight by one twenty-eight state matrix. With the gate open, an update overwrites a row and a query reads it back. Rows become memory cells.

The README says it matches the nestest golden log for three thousand three hundred forty-eight instructions. Simon Willison reports the author, Drew Breunig, called it a fun, slow experiment.

Slow is accurate. About sixteen hundred fifty tokens per second on one CPU core, against roughly seven hundred thousand needed for real speed. That's one hundred fifty to two hundred ninety times slower than a console.

The limits are honest. NROM cartridges only, so no MMC one or MMC three games. The PPU and APU aren't encoded in the weights.

To try it, unzip the code and weights together, install Python three point eleven or newer, and run the nesformer module on the Thwaite ROM with frames six hundred. The README's advice is to expect it to be slow.

That project runs a machine inside a model on purpose. This next one tried to slip a backdoor into developers' editors, and nobody invited it.

Cursor says malicious versions two point one point three one two and two point one point three one three of a Claude Code extension sat in its marketplace from about two twenty-seven in the morning to one thirty-five in the afternoon Pacific on Thursday. Cursor says Anthropic didn't develop it. Sophos reports Cursor estimated up to five thousand users were affected.

BleepingComputer reports malicious JavaScript sat at the top of the extension's main file and ran when the extension loaded. No clicking needed. It tried to add an attacker SSH key, enable local SSH, open a reverse tunnel and persist. It also sent back your hostname, username, Git email and public IP.

Here's the funny part. The attacker's Windows path called PowerShell through a Unix shell that standard Windows installs don't have. BleepingComputer says that coding error helped stop SSH setup, and Sophos says SSH enablement failed on most affected Windows and macOS hosts.

Don't relax yet. Cursor says the package could still install keys and persistence and send host details. Uninstalling the extension alone may not remove them.

Cursor pulled the package, shut down and rebuilt the marketplace, and rotated keys. It says it found no evidence other extensions or the official Anthropic distribution were affected. Anthropic says its own systems weren't involved. Those are company statements, not an independent audit, and how the attacker got marketplace access is still unexplained.

Phorion's Calum Hall told WIRED everyone was lucky, because this could have been a really dangerous foothold.

If you had that extension Thursday, check your authorized keys for one named svc-telemetry. Remove persistence and tunnels, then rotate every credential that machine could reach, from a trusted system.

Cursor's problem was trust handed to a name in a marketplace. This one is trust handed to a certificate chain, and one of its keys came down to the number four.

Cloudflare says eight eMudhra intermediate certificate keys were weak enough to be recovered from the public certificates. Its summary is that eMudhra was supposed to pick a one hundred fifteen digit number for a virtual combination lock, and picked the number four. Not even four digits, in Cloudflare's words.

Why that matters. An intermediate key signs every certificate beneath it. Recover the key and you can mint a certificate for any domain, and an unpatched client may accept it during a man-in-the-middle attack.

Cloudflare says it discovered this October nineteenth and that its Pingora proxy was updated within hours. It added logging to Pingora's outbound side and saw about twenty-two thousand attempted handshakes involving the weak keys. About a hundred sixty certificates had names unrelated to the requested host. Cloudflare found no evidence they were used against its connections, and some may be misconfigured server defaults.

The number everyone will quote is thirty to forty percent. That's Cloudflare's estimate of embedded browser probes still accepting the chain. Cloudflare itself warns its challenge-page traffic is skewed and bot-heavy, so it's suggestive, not a census.

For builders, Unity's advisory is the practical one. UnityTLS validates chains itself on some platforms and can't check revocation. Windows, WebGL and Android players are covered by platform updates, but macOS and Linux apps using UnityTLS need attention. Unity lists patched Editor releases six thousand point three point twenty-seven f two and six thousand point seven point zero b seven.

My verdict, if your software carries its own trust store, the operating system patch may never reach it. Check your vendor's advisory today.

Both of those stories end with software trusting more than it should, so the most useful change in the log is a boundary.

Claude Code version two point one point three fourteen now has Write, Edit and NotebookEdit refuse file paths outside your working directories in every permission mode. Turn on the new block-writes-outside-working-directories permission. The notes give no config example, and it covers editing tools, not every command, so keep your OS sandbox. It also stops a watcher from repeatedly checking every removed skill in the trash folder, which is housekeeping nobody wanted to need. Upgrade if you let it run unattended.

Claude plans, renamed. The New Stack reports Max five x is now Max at one hundred dollars a month, and Max twenty x is Ultra at two hundred. Verified Ultra accounts lose the rolling five-hour cap, but the weekly allowance stays. You can't request verification, and some Ultra users still hit the five-hour limit while they wait. I haven't seen Anthropic's own page yet.

Bedrock in GovCloud. AWS says OpenAI's GPT five point six Terra and Luna now run through the bedrock-runtime endpoint in GovCloud US, with Responses, Converse and Chat Completions APIs. Call Terra with the geographic cross-region ID, since in-region isn't available there. The card lists a one million fifty thousand token context and short-context standard pricing of two dollars seventy per million input tokens; long-context rates are higher. Not a new model, it launched in July.

Amazon MSK, TLS one point three. Provisioned clusters opt in by selecting a named encryption policy, and existing clusters don't change until you do. A mixed policy negotiates the highest version each client supports, and there's a one-point-three-only option. No extra cost. It's TLS support, not post-quantum protection.

Everything in that log runs on somebody's server, and Intel just told the market it can't make enough of them.

Intel's third quarter looks fine until you reach the guidance. Revenue was sixteen point five billion dollars, up twenty-one percent. CNBC reports data center and AI revenue rose seventy-eight percent to seven point three billion, while client computing fell five percent to eight point one billion.

The outlook is what hurt. Intel guided fourth-quarter revenue of fifteen to sixteen billion dollars and non-GAAP EPS of twenty-five cents a share. CNBC says analysts expected seventeen point one billion and adjusted EPS of forty-three cents. The stock closed down twenty-eight point five eight percent on Friday.

Why you care. CFO David Zinsner said the PC slowdown should last at least through the first half of next year. ServeTheHome says higher DRAM and NAND prices are raising system costs, and substrate availability limits server output. The number to watch is that first half.

Fast Boot, the part of the show where leaked secrets get a speaking role.

Binance bleeds. TRM Labs traced about six point three six billion dollars out of Binance across ten blockchains. The Ethereum attacker pre-signed fifty authorizations and needed only one to match, which is a sturdier retry policy than most deploy scripts.

Northflank's warning. Northflank told customers to assume, as a precaution, that every environment variable was decrypted, after multiple users reported unauthorized use of stored AI API keys. Step one is rotating secrets, step two is reading your provider bill like a thriller.

Applebee's password. A database password was sitting inside Applebee's Android app, and TechCrunch decompiled the app to confirm it. The researcher couldn't find any way to report it to Dine Brands, so the password was easier to find than the reporting channel.

That's three secrets with speaking roles, and not one of them asked for the part.

That's the show. Four AI companies agreed on a polite way to say no to training, a Claude Code extension in Cursor's marketplace turned out to be a trojan, Cloudflare found certificate keys that were barely keys, and an NES emulator now lives inside Qwen's weights.

If you only try one thing before Monday, run Nesformer for six hundred frames. And if you touched that extension Thursday, check for the svc-telemetry key first.

Every source is in the show notes. Follow The Daily Reboot wherever you get your podcasts. Stay patched.