Friday, 30 October 2026

OpenAI has doubled the Work and Codex usage included in its Pro 100 and Pro 500 plans and has cancelled the Pro 200 reduction it announced in a September 29 email, according to its ChatGPT release notes [1]. Starting October 29, Pro 200 subscribers on the lower allowance get twice their previous Work and Codex allowance, which brings them up to the same limit; anyone who already had the higher allowance keeps it [1]. Business Premium is included in the increase [1]. The release notes do not state the allowances as numbers [1].

A day earlier, OpenAI started letting eligible Pro and Business subscribers claim API credits for one linked API organization [1][2]. The monthly grant matches the Pro tier: $100, $200 or $500 [2][3]. A Business workspace gets $20 per paid Standard seat and $100 per paid Premium seat, pooled and capped at $500 a month, or $6,000 a year for workspaces that pay annually upfront [2]. Plus, free trials, Enterprise and Edu do not qualify, and the paid subscription must be at least seven days old [2].

The credits come with conditions. Unused credits expire at the end of each billing cycle and do not roll over, and the first grant is prorated [3]. They cover the Responses, Agents, Decisions and Realtime APIs, image generation and built-in tools, but not Codex usage through API keys, and they do not raise ChatGPT or Codex limits [3]. When the free balance and any purchased credits are gone, requests fail with HTTP 429 [3]. OpenAI says the benefit may change or be removed [2]. Simon Willison notes that Anthropic offered a similar benefit for Max and Team subscriptions earlier this month [4].

Cursor says a maliciously modified version of Anthropic's Claude Code extension was live on its VS Code extension marketplace on Thursday from about 2:27 a.m. to 1:35 p.m. Pacific time, and reached up to 5,000 users [1]. Cursor says the build was not developed by Anthropic [1]. The bad version is 2.1.313; the clean releases on either side are 2.1.312, published October 27, and 2.1.314, published October 30, according to StepSecurity [2]. Reports differ on where it first appeared: Cursor describes its own marketplace [1], while Help Net Security says Phorion, the firm that found it, spotted it on Open VSX, the store that Cursor, Windsurf and other VS Code-based editors use [3].

The code ran as soon as the editor loaded the file, with no click needed [3]. It added an attacker's SSH key, labelled svc-telemetry, to the user's authorized_keys file, opened a reverse SSH tunnel to the attacker's server, set up persistence on macOS, Linux and Windows, and sent back host details and the names of environment variables that look like credentials [2]. Cursor says it attempted to collect hostname, username, operating system and public IP address, and that a key remote-access step would have failed on most machines because it needs administrator rights [1]. Cursor removed the version, shut the marketplace down, rebuilt it and brought it back online; it says no other extensions were affected [1].

StepSecurity says removing the extension alone is not enough: check authorized_keys for the svc-telemetry key, delete the persistence entries and rotate every credential the machine could reach [2]. How the attacker published under Anthropic's extension identity has not been established [2]. Anthropic did not immediately respond to a request for comment, according to [1].

OpenAI says ChatGPT will be able to end a chat on its own when a conversation shows signs that someone is fixating on violence or on seriously harming another person, and that if it ends several chats for that reason it may temporarily pause the account [1]. The company is also tightening rules for every user on questions about past mass attacks: ChatGPT will give less detail about the weapons and equipment used, how they were obtained, and comparisons of scale, whatever the user's age or reason for asking [1].

For users under 18, ChatGPT will restrict practical information about weapons and security systems that could be misused, even when there is no sign of violent intent [1]. OpenAI says its age prediction now keeps assessing new signals and moves teens into the under-18 experience; adults placed there by mistake can confirm their age through Persona [1]. Parents who have linked accounts through parental controls are to be notified if a teen's account is paused for repeatedly discussing violence, a feature the company says it is working on [1]. OpenAI says it made over 200 law enforcement referrals in Q3 2026 [1]. The safeguards begin rolling out in the next few weeks [1][2].

OpenAI also commits to a Community Safety Report on violence prevention and the effectiveness of its safeguards; the first, covering the second half of 2026, is due in early 2027, with updates every six months after that [1]. Reuters notes that a Common Sense Media report earlier this month found ChatGPT's teen version often alerted parents late or not at all about conversations on suicide, self-harm or eating disorders [2]. OpenAI said earlier this month that teens spend under 15 minutes a day on ChatGPT on average, according to Reuters [2].

Prime Minister Mark Carney has announced that the Government of Canada will make an equity investment of up to $1.6 billion in Cohere, the Toronto company that builds secure AI systems for businesses and governments [1]. The money will be paid in stages, with regular reporting against Cohere's commitments [1]. According to BetaKit, the stake is part of a planned Series E that Cohere hopes will reach as much as C$7 billion and would value it at nearly $36 billion post-money [2]. Schwarz Group is leading, with the Government of Canada, Bell Ventures and Bullhound Capital as new investors and Nvidia, Inovia and Prosperity7 returning [2].

In return, the government says Cohere will create at least 1,000 new Canadian technical jobs by 2030, commit at least $1.7 billion to more computing infrastructure in Canada by 2030, keep its Canadian incorporation and headquarters, and keep working with the Canadian AI Safety Institute [1]. AI minister Evan Solomon told BetaKit that the investment runs through the Canada Development Investment Corporation and that jobs and revenue targets are key to the stages; he did not share the commercial terms [2].

On October 30 Cohere set out its own wider plan: more than C$4 billion in research, development and AI infrastructure in Canada between 2024 and 2031, more than 1,500 new roles by 2031, and more than 250 paid student roles by 2029 [3]. It also points to a C$309 million GPU cloud partnership with Bell AI Fabric that runs its models on Canadian infrastructure [3]. The selling point for buyers is control of data: the Prime Minister's office says Cohere's technology gives organisations more control over where sensitive data is stored, how it is used and who can access it [1].

Thrive Holdings has agreed to buy ADT, the US home and small-business security company, in an all-cash deal that values it at about $7.6 billion in equity and $15.3 billion in enterprise value [1]. ADT stockholders get $10.00 a share, a 45.6% premium to the unaffected close of $6.87 on October 27 [1]. Funds managed by Apollo affiliates provide all the financing, and the deal is expected to close in the first quarter of 2027, subject to a stockholder vote and US antitrust approval [1]. ADT may seek better offers until 11:59 p.m. New York time on November 28 [1].

Thrive Holdings is the holding company spun out of Josh Kushner's Thrive Capital, and OpenAI is both a partner and an investor, supplying models, technology and forward-deployed engineers to its portfolio companies, according to TechCrunch [2]. More than 75 businesses in accounting, IT services and the built environment already belong to Thrive Holdings, and ADT will become the base of its smart home security business [1]. Thrive's engineering teams will work with ADT staff on where technology can improve its products and services [1]. TechCrunch says no specific AI products have been disclosed [2].

The data question is the one ADT customers will ask first. The companies say ADT's data and privacy policies will remain unchanged and that no new data sharing will occur without customer permission [1]. ADT has more than 12,000 employees, and it says it will publish third-quarter results on November 3 but will not take questions on the call [1].

Reddit says it is shifting to a primarily logged-in experience, a change it announced on its third-quarter earnings call [1]. It will first test the change in select markets outside the US in the fourth quarter and has no timeline yet for a worldwide rollout [1]. Anonymous browsing through a rebuilt incognito mode stays, and the company says access to a logged-out front page still matters [1]. CEO Steve Huffman says the move is better for user experience and for the ads business, more in line with safety regulations, and "more protective of Reddit data" [2].

The cause is search. Reddit says search referrals in October dropped by more than 1 million a week on average [1][2], and it warned that daily active users could fall by a low-double-digit percentage next quarter if the trend continues, according to TechCrunch [1]. "The reality is, AI Mode does not drive traffic," Huffman said on the call, according to The Verge [2]. US daily active users fell from 53.2 million in the second quarter to 50.7 million in the third, while global daily users were flat at 130.3 million [1].

The money is still growing. Revenue rose 53% from a year earlier to $895 million and net income rose 74% to $283 million [1]. Non-advertising revenue, which includes AI data licensing, grew 35% to $48 million [1]. TechCrunch reads the logged-in move as a way to protect Reddit's data from AI scraping so that it can sell licences to model providers instead [1]. For anyone who relies on AI tools that quote Reddit threads, that is the part to watch.