Start with the security story if you use Cursor. It takes two minutes to check and it's the one item today that can actually hurt you. After that it's good news for your wallet: OpenAI copied Anthropic's subscription-to-API-credits deal, Mistral put a trillion-parameter model on Hugging Face, and AssemblyAI undercut the voice-agent market.
No sponsored or affiliate links in this digest — the links below are sources only.
Story I
Claude Code for VS Code 2.1.313 on the Cursor Marketplace shipped an SSH backdoor
Phorion says the Claude Code for VS Code bundle, version 2.1.313, on the Cursor Marketplace dropped a persistent SSH backdoor on macOS, Linux and Windows. It appended an attacker key to authorized_keys, tried to turn on Remote Login, opened a reverse tunnel to 134.209.82[.]225, and beaconed host details plus the names of env vars matching KEY, TOKEN, SECRET or AWS. Cursor pulled the release, and the npm and VS Code builds of 2.1.313 were pulled too. Phorion doesn't give install counts.
Link: phorion.io/blog
Try it now
Check your machine now:
cursor --list-extensions --show-versions | grep -i claude
grep -n svc-telemetry ~/.ssh/authorized_keys
ls ~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt ~/.config/.smtk /tmp/.stk_* 2>/dev/null
Any hit: follow Phorion's cleanup steps, then rotate every key and token that lived in that user's environment.
Story II
ChatGPT Pro now comes with API credits equal to the plan price, and Pro limits doubled
OpenAI now grants Pro subscribers monthly API credits matching their tier: $100, $200 or $500. Business workspaces get $20 per Standard seat and $100 per Premium seat, capped at $500. Credits expire at the end of each billing cycle, link to exactly one API org, and depend on your country and cohort. Simon Willison points out it's nearly the same deal Anthropic gave Max subscribers earlier this month. The Decoder reports OpenAI also doubled limits on Pro 100 and Pro 500 the same day.
Link: help.openai.com
Try it now
- In ChatGPT, open Settings, then Billing, and find "API credits benefit".
- Pick the API org that should receive the credits. Use a sandbox org if you don't want subscription money mixing with production spend.
- Confirm, then check the credits under API Platform billing.
- Set a reminder for the day before renewal. Unused credits don't roll over.
Story III
Mistral released weights for Large 4: about 1T parameters, 52B active, $0.70 per million input tokens
Mistral put Large 4, nicknamed "Le Chonk", on Hugging Face under a modified MIT license. The Decoder puts it at about one trillion total parameters with 52B active, priced at $0.70 in and $2.10 out per million tokens. On Artificial Analysis it scores 48% on the Coding Agent Index and 26 on the Intelligence Index, behind the 32 posted by DeepSeek V4.1 Flash and GLM-5.3. TechCrunch says Mistral claims it uses 47% fewer tokens per task than GLM-5.3 and is pitching it for on-prem cyber defense.
Link: huggingface.co/mistralai
Try it now
Read the config before you plan any hardware:
pip install -U huggingface_hub
hf download mistralai/Mistral-Large-4-1T-A52B config.json --local-dir ./ml4
Then run the same 20 agent tasks you use today through the Mistral API at $0.70/$2.10 and compare total tokens per task, which is the number Mistral is leaning on.
Story IV
AssemblyAI-TTS-1 prices voice-agent speech at $15 per million characters, with 4,000+ voices
AssemblyAI shipped AssemblyAI-TTS-1, a streaming text-to-speech API built for voice agents. It costs $15 per 1M characters with unlimited concurrency, offers 4,000+ voices across English, Spanish, French, German, Italian and Portuguese, and AssemblyAI advertises about 90 ms to first audio. Cekura's independent benchmark measured a 159 ms median streaming latency. Besides HTTP and WebSocket APIs, there's an OpenAI-compatible route, so an existing OpenAI TTS call is a small change.
Link: assemblyai.com/docs/tts
Try it now
- Open the docs link and pick the OpenAI-compatible interface.
- Point your existing OpenAI TTS call at it with an AssemblyAI key.
- Run the same 200-character agent reply through both providers and time first audio. At $15 per 1M characters, 10,000 replies that length cost about $30.
— The Vibe Gate news desk. We read the firehose so you can keep building.