Friday BriefingNo. 02
Week 44 ·
An npm worm that launches through AI tool hooks, Gemini logging by default and open weights for Mistral Large 4
Hijacked GitHub repos run malware through Claude Code and Cursor, the Gemini API now stores requests from new projects, and Mistral Large 4 is open weight.
Three topics of the week
- Security
Topic 1: Hijacked GitHub repos run malware through Claude Code, Cursor and VS Code
SourceJFrog Security Research(opens in a new tab)What happened
JFrog found 42 GitHub repositories from 11 owners carrying a hidden file that launches through hooks planted in the settings of Claude Code, Gemini CLI, Cursor and VS Code. The npm worm behind it steals GitHub and npm tokens and, as of 26 October, sat in 82 package versions.
What it means
With these tools, opening a cloned repo runs code before anyone has read it. If your developers use Claude Code or Cursor, have them check unfamiliar repos for .claude, .cursor and .vscode folders first, and rotate tokens only after removing the persistence, since revoking a token triggers a wiper.
- Privacy
Topic 2: The Gemini API now stores requests from new projects by default
SourceGemini API changelog(opens in a new tab)What happened
Since 26 October, new paid-tier projects on the Gemini API store prompts and responses by default, for 55 days, viewable in AI Studio. Existing projects keep their setting. You can opt out per request with store=false or for the whole project in the settings.
What it means
Anyone starting a new project on the Gemini Developer API now has a copy of every input at Google, and the docs say nothing about storage location or training use. Set store=false before the first production call and check your data processing agreement. Vertex AI isn't affected.
- AI
Topic 3: Mistral Large 4 is now open weight
SourceMistral AI(opens in a new tab)What happened
Mistral has published the weights of Large 4 on Hugging Face, roughly a trillion parameters under a modified MIT licence. Commercial use is free, and only companies selling it as a model-as-a-service need a separate licence. It's also available through Mistral's API and in Microsoft Foundry.
What it means
For data that can't go to a US provider, this is a frontier-class model you can run in your own data centre or at a European host. Given its size, self-hosting takes several GPUs, so for most companies the realistic route is Mistral's API or Microsoft Foundry.
In brief
- Data
Databricks has moved the end of life for the Genie One MCP beta endpoint from 31 October to 30 November. Move to the Unity Gateway MCP, which ChatGPT, Claude and Cursor use without a custom OAuth app.
Databricks release notes(opens in a new tab) - BI
The Govern view in Fabric's OneLake catalog is generally available: tenant-wide health, domains, capacities and workspaces in one place. The Policies Center stays in preview.
Microsoft Fabric blog(opens in a new tab) - AI
OpenAI has released GPT-6.1 Terra, a cheaper model for computer use and visual reasoning. It reached Amazon Bedrock the same day, 26 October, and Databricks Unity Gateway a day later.
OpenAI API changelog(opens in a new tab) - AI
Claude spend in Microsoft Foundry now shows up under the Foundry resource instead of SaaS, with tags per model and separate input and output token costs. That makes chargeback to teams possible.
Azure updates(opens in a new tab) - Teams
From late November, Teams lets two presenters share their screens at once, with rollout done by mid-December. It's on by default, admins can switch it off tenant-wide and organisers per meeting.
Microsoft 365 roadmap(opens in a new tab) - AI
Claude Enterprise gets Smart Reports that turn transcripts into workstreams with cost and friction points, plus surveys and pooled group budgets. Anthropic says they aren't for rating individuals.
Anthropic(opens in a new tab) - BI
Looker's data lineage and its managed MCP server are generally available. Agents can now work against LookML models instead of raw tables, governed through a new admin page for OAuth clients.
Looker release notes(opens in a new tab) - BI
Microsoft is backing Apache Ossie, the open standard for semantic models Snowflake helped found. First scenario: one Ossie document becomes a Snowflake semantic view and a Power BI semantic model.
Power BI blog(opens in a new tab)
Can wait
Gemini 4 Carbon
Two weeks after Argon, Google calls Carbon its strongest model yet, with the top spot on the Artificial Analysis index and leading scores on security benchmarks. For now only a group of “cyber defenders” in Google's Fairwind programme can use it, and there's no date for businesses or developers. Until then, nothing changes about which model to pick or what it costs. We're already looking forward to “Gemini 4 Praseodymium” (Pr).
SourceGoogle(opens in a new tab)Praseodymium (Pr) on Wikipedia(opens in a new tab)Left out on purpose
- Anthropic's IPO: the S-1 is filed with the SEC. Nothing changes for customers, except that someone has to pay those billions eventually (hopefully).Anthropic(opens in a new tab)
- Google using Gmail and Photos data for ads: reportedly not in the EEA and not for Workspace accounts, so not for our readers.
- Sweden's Government Offices blocking ChatGPT and Claude: so far only press reports of an internal memo, no official source.
- Oracle letting ChatGPT into Fusion and NetSuite: all of it in limited availability, and the small-business bundle is US only.Oracle(opens in a new tab)
- Gemini 4 Carbon can supposedly write exploits: we filed it under “Can wait” until someone outside Google is allowed to use it.
Our unsolicited opinion
Opening a stranger's repository used to count as safe as long as you didn't run anything. With Claude Code, Cursor and VS Code hooks sitting in the project folder, opening it is running it. Call it progress: attackers no longer have to wait for someone to type npm install. We'd give agents the same rule we give package installs: only in repos you trust, and only on machines without long-lived tokens.