On October 28 and 29, 2026, a package of updates was released that changes three things at once: the rules, transport, and security of working with models. OpenAI published a new edition of the Model Spec, formalizing the target behavior of GPT around five values and a 'chain of command'; Anthropic quadrupled the maximum request size for the Claude Messages and Token Counting APIs; and malicious versions of the Anthropic.claude-code plugin 2.1.312 and 2.1.313 remained in the Cursor extension catalog for nearly half a day, which, according to Cursor's own estimate, were installed by up to 5,000 users. Simultaneously, a free corpus of textbooks with citations and page links appeared in Gemini Notebook via the Sources → Textbooks menu. For the industry, this is primarily a day about infrastructure, contracts, and trust, rather than new models. The most urgent item concerns those who installed Claude Code in Cursor on October 29: simply removing the plugin is not enough; checking authorized_keys and running official cleanup scripts is required.

image
image

What happened

On October 29, 2026, OpenAI released an updated Model Spec. GPT behavior is now formalized around five values: fidelity to human intent, harm minimization, honesty, support for autonomy, and attention to context. A 'chain of command' has been introduced to resolve conflicts between OpenAI rules, system prompts, and user requests, where company rules take precedence over system prompts, which in turn take precedence over individual user requests. Most rigid stylistic templates have been removed from the specification, and the term 'assistant' has been replaced with 'GPT'. Shortly before this, on October 28, Anthropic raised the maximum request size for the Claude Messages and Token Counting APIs from 32 to 128 MB; for prompts with more than 20 images, the maximum resolution for each image increased from 2000 to 3000 pixels, and the Usage and Cost Analytics API appeared in beta mode. On October 29, between 2:27 and 13:35 Pacific Time, malicious versions of the Anthropic.claude-code plugin 2.1.312 and 2.1.313 were present in the Cursor extension catalog; Cursor estimates the number of installations at up to 5,000 and has published a security notice. The malicious diff was 66 lines long: the code collected the hostname, email address, and IP, attempted to add the SSH key svc-telemetry to authorized_keys, and establish a reverse tunnel.

Context

The Model Spec is a public OpenAI document, and the new edition turns internal model behavior rules into an open contract that is checked not only by company employees but also by external developers building products on GPT. The 32 MB limit in the Claude API was a transport bottleneck: heavy PDFs and image packages had to be split or bypassed via the Files API, adding extra layers to the architecture. In this story, the Claude Code extension was distributed through the official Cursor catalog (a marketplace for VS Code), and the malicious code ended up in versions of the legitimate Anthropic plugin, not a fake—this is how a supply-chain attack works, preferring the distribution channel of trusted software over targeting the model itself. Google, for its part, is developing Notebook as an environment based on sources, and the free corpus of textbooks with page-by-page citations continues this direction in educational scenarios.

Why this matters for the industry

For companies and developers, there are three levers here. Document-heavy pipelines on the Claude API can now be assembled in a single call without Files workarounds—this is cheaper, faster, and requires less code to maintain, which is particularly noticeable where prompts include dozens of scans and pages. The Model Spec sets a formal contract for prompt architecture: teams can design system prompts according to the declared hierarchy, and the document itself becomes a public reference for alignment practices—if it takes hold, vendors will start being compared by behavior specifications rather than lists of prohibitions. The incident in Cursor turns hash and signature verification of extensions and auditing of authorized_keys into mandatory engineering hygiene: 66 lines of malicious diff code were enough to attempt to establish persistence on a developer's system.

Why this matters for users

Developers who installed or updated Anthropic.claude-code 2.1.312 or 2.1.313 in Cursor on October 29 need to check the ~/.ssh/authorized_keys file for the svc-telemetry key and run the official remediate-macos.sh or remediate-windows.ps1 scripts: simply removing the plugin does not close off possible saved access to the machine. Those working with the Claude API no longer need to prepare workarounds: heavy PDFs and large image packages go to the model in a single request. Students and teachers in Gemini Notebook have access to free textbooks via the Sources → Textbooks menu, and citations lead to specific pages, which is convenient for notes and preparation. Those writing custom instructions for GPT should consider the declared hierarchy of priorities—from OpenAI rules to user requests—when designing their own system prompts.

What is currently unknown / limitations

It does not follow from the sources that current models already measurably follow the updated Model Spec: the document describes target behavior, and the priority of OpenAI rules over system prompts is stated as a goal. Therefore, it is premature to interpret the 'chain of command' as a ready-made design contract for multi-agent systems. The impact of removing stylistic templates and renaming the 'assistant' on dialogue quality is not assessed in the sources. Regarding the Cursor incident, the figure of up to 5,000 installations is the company's own estimate, and the materials do not state how many users the malicious code managed to collect data from or make changes to their systems. The Usage and Cost Analytics API is in beta mode, and the stability of its contract is not confirmed by the sources.

Sources

Author

Look at AI, editorial team