Verify before you believe: four giants adopt a shared AI training opt-out, a poisoned extension on Cursor, Intel falls 28%

Three signals this Saturday, and one lesson: nobody takes anyone at their word anymore. Publishers want proof their work will not be swallowed. Developers learn their own tools can arrive poisoned. And investors have stopped applauding good quarters to grade the next one.

Signal one: one shared sentence, four signatories

The day before, I covered OpenAI's announcement alone: a shared robots.txt signal so a publisher can refuse AI training once. The story has grown since. On Friday, Google, Microsoft and Anthropic joined OpenAI and committed to honor the same signal. Four of the largest AI companies, one sentence, one file.

The signal comes from a draft written by Kevin Kelley of Anthropic, dated October 30, within the IETF's AI Preferences working group. It defines a common identifier for training preference. A site can say, in one line: do not train your models on this content.

The timelines differ

Company	Rollout
Anthropic	Already started
OpenAI	In the coming months
Microsoft	From February 1, 2027
Google	During 2027

Microsoft also plans a finer-grained opt-out that distinguishes training from using content to ground an answer.

The fine print

Two limits matter.

1. The setting only applies to future training. It does not stop a crawler from visiting a site for other uses, and crawling stays allowed by default until a publisher changes the setting.
2. It is a voluntary preference. The draft does not guarantee any company will follow it.

And one giant is only halfway in. Meta spokesperson Andy Stone called it an important step, without saying whether Meta will honor the identifier on its own crawlers. Recall that Meta pushed its website crawling terms for business accounts to November 20.

Why it matters

For years, publishers faced a maze. Every AI company ran its own crawler, with its own name, rules and form. Refusing one changed nothing for the next. A shared signal turns the maze into a door with a single sign.

The catch is that a sign is only worth as much as those who agree to read it. Four giants agreeing on the same language give the web, for the first time, a common sentence for this fight. The day before, it was one company's gesture. Now it is a vocabulary shared by much of the industry, with dates.

What changes

For brands and publishers, the work becomes concrete. Check the robots.txt file. Decide what you want found, cited, or kept away from any training. Write it with the shared identifier before the deadlines, because the default is still yes. I repeat yesterday's nuance: a brand that wants to be recommended by assistants should stay readable, at least for the pages that describe it.

For AI companies, the test moves from announcement to compliance. Watch Meta first. If the company behind Facebook, Instagram and WhatsApp adopts the same identifier, the sentence becomes the rule of the game. If not, publishers will have one clear sentence for four companies, and a separate fight with the fifth.

Signal two: the poisoned extension

On Thursday, October 29, a routine update turned into a break-in. A tampered copy of Anthropic's official Claude Code extension, the tool that lets an AI assistant work inside a developer's code editor, was distributed through Cursor's extension marketplace. It carried the publisher's legitimate identity (versions labeled 2.1.312 and 2.1.313) and stayed live for about eleven hours, from 2:27 a.m. to 1:35 p.m. Pacific. Cursor estimates at most 5,000 users received it.

The payload

It was small and deliberate. StepSecurity researchers found a 66-line loader inserted ahead of the legitimate code. On startup, it:

• tried to add an attacker-controlled key, named svc-telemetry, to the file that decides which keys can connect to the machine over SSH;
• installed persistence to survive a reboot (a scheduled task on Windows, a launch agent on macOS, a cron entry on Linux);
• tried to open a reverse tunnel to attacker-controlled infrastructure, retrying roughly every 60 seconds;
• sent information about the machine in clear text, unencrypted.

What limits the damage

Anthropic says its own systems and employee computers were not compromised: a malicious actor used access to Cursor's marketplace to publish a copy Anthropic did not build. The clean version, 2.1.314, shipped on October 30. Cursor notes that enabling local SSH services requires administrator rights the extension lacked on most Mac and Windows machines, and researchers believe coding errors in the malware likely blocked remote access on many machines. So 5,000 is a ceiling on exposure. The real number of compromised machines is likely far lower.

Why it matters

Developers install extensions the way people install apps, on trust, then give them deep access to the machine where the company's code lives. The AI model stayed intact. It was the shelf the tool sits on that gave way. The marketplace itself was the weak point, and the poisoned package carried the real publisher's name.

I connect this to October 18, when API keys stolen from OpenCode were used to distill models. In both cases the attack runs through the tooling around AI, where vigilance is weakest. Every team distributing or installing software through an extension marketplace learns that the update prompt is a security decision.

What changes

Anyone who used Cursor's marketplace on October 29 should check now, following Cursor's guidance: look for the svc-telemetry key in the authorized keys file, remove persistence mechanisms, and rotate every credential reachable from the machine.

For everyone else, the lesson is procedural and unglamorous:

1. pin extension versions rather than accepting every update automatically;
2. verify publisher identity through a second channel;
3. treat developer machines as production systems, because attackers already do.

Supply chains are where trust gets tested, and this time it gave way around the tool, not inside it.

Signal three: the good quarter that is no longer enough

On Friday, Intel had its worst stock market session since 1974. The stock closed at 65.76 dollars, down 28.58%, after the company reported a third quarter above expectations, then guided a fourth quarter well below.

The quarter

• Revenue: 16.5 billion dollars, +21%.
• Adjusted earnings per share: 0.52 dollars, versus 0.23 a year earlier and 0.41 expected.
• Data center and AI: about 7.3 billion, +78%.

The guidance

• Fourth-quarter revenue: 15 to 16 billion, against about 17.1 expected.
• Adjusted earnings: 0.25 dollars per share, against 0.43 expected.
• Gross margin guided to 38%, down from 44.1%.

Intel cites a PC market slowdown, driven by soaring memory prices, and a deadly explosion at its plant in Israel, which will cost about 300 million dollars of fourth-quarter revenue.

The verdict

It was brutal and precise. One analyst called the guidance "terrible" and cut his price target from 110 to 75 dollars. Bank of America downgraded the stock, and several others followed. Intel also warned it does not expect positive free cash flow in 2027, with about 20 billion dollars of capex this year and more next year. By one estimate, the US government's 10% stake lost about 12 billion dollars of value in the day.

Why it matters

Intel is the week's proof that beating the quarter is no longer enough. Alphabet fell after 25% growth. Amazon fell after 39% cloud growth. Intel fell hardest after 21% growth. The market no longer grades the quarter you just reported. It grades the quarter you promise, and the cash left once the buildout is paid for.

The AI trade has moved from a demand story to a delivery test. And delivery today is measured in guidance, margins and free cash flow, in that order.

What changes

For brands, the chip shortage enters a second act. Intel says the industry will remain supply-constrained through 2027 and into 2028, and memory prices are already weighing on corporate IT budgets. I connect this to October 19 and the HBM memory shortage: scarcity is now reaching the office PC. Planned hardware refreshes should be priced for scarcity, far from last year's catalog prices.

For investors, the bar for the next earnings is visible. AMD reports on November 3, and that number will show whether the PC slowdown is Intel's problem or the whole sector's.

The thread of the day

Publishers finally have a shared sentence, and now have to check who honors it. Developers learned their most trusted tool can arrive poisoned. Investors learned a good quarter buys nothing if the next one disappoints.

The noise says: believe the announcement. The signal says: verify it, then act. That is the lesson of SIGNAL's whole first month.

The noise filtered. The signal kept.