AI News Roundup: November First - Capital Cools, Politics Warms

Overview: No frontier launch, no record round. Sunday's news was all scaffolding: OpenAI cut its raise to $20 billion, its policy chief floated "AI speed limits" and a data-center rebrand, Brooklyn argued over who profits from the buildout, DeepSeek gave away an always-on coding agent, and a backdoored Claude Code extension hit thousands of developers.

OpenAI pares its fundraising target to $20 billion

CNBC confirmed Saturday that OpenAI is seeking up to $20 billion in its latest round, down from roughly $30 billion, after investors trimmed allocations before a Friday deadline. The FT, which first reported the cut, puts the post-money valuation at $1.25 trillion. A UAE consortium including MGX is expected to lead alongside Coatue; the round has not closed and the first close should land below target. The direction matters more than the number. For two years the constraint on frontier labs was compute. This weekend it looked like investors' appetite for writing cheques at the old pace.

OpenAI wants to call its data centers "AI compute campuses"

Data centers are deeply unpopular, so OpenAI is preparing a public-relations push after Tuesday's midterms, per Axios reporting carried by TechCrunch. Global affairs chief Chris Lehane called the midterms "a bit of a movie trailer for what you're going to see in 2028," when he expects AI to define the presidential race. His proposals: AI "speed limits," a US role in global standards, and yes, rebranding data centers as "AI compute campuses." Lehane called the debate "good and healthy." Amazon and Microsoft have already dropped NDAs in local negotiations, a sign the buildout's political cost is being priced in.

Data centers are now a midterm issue, even in Brooklyn

At a Newsreel event in Brooklyn, a panel on the Democratic Party's future kept sliding back to data centers. NewsNation's Batya Ungar-Sargon noted unions back the projects for the jobs they promise, while reporting shows those jobs mostly end with construction. Strategist Morris Katz described the powers that hollowed out union work returning "to essentially finish the job." Organizer Ben Brewster told TechCrunch that AI came up in every on-stage conversation, and his framing is the cleanest version of the politics: "In rural communities, the backlash is about feeling replaced. In a place like Brooklyn, it's more about who gets rich from it."

DeepSeek open-sources an always-on coding agent

DeepSeek's Harness team published dsh-superagent, an MIT-licensed research prototype for a proactive coding agent scoped to one repository. It passed 7,000 stars within a day, a fair signal of how hungry teams are for agent architecture they can read. The design is Router-Worker: a long-running router watches GitHub and optionally Feishu, decides whether a message is a request, and turns accepted work into a Ticket with an immutable Mandate recording why it may proceed. Each Ticket runs in its own session and directory, then replies in the original thread, usually with a pull request. The interesting part is the permission model: unprompted work is off by default and starts in observe mode, recording only what the agent would have done. DeepSeek also states plainly that both presets run with full access as the operator's OS user, so isolation is the installer's problem.

A backdoored Claude Code extension reached up to 5,000 Cursor users

An official Claude Code VS Code extension was backdoored in Cursor's marketplace on Friday. Version 2.1.313 went up on Anthropic's official Cursor account, superseding the clean 2.1.312; Cursor says at most 5,000 users were affected and researcher Kevin Beaumont reported a clean 2.1.314 followed hours later. Per Cursor, the build harvested host details including environment variable names, Git email and public IP, then tried to add an attacker SSH key and open a persistent reverse tunnel. Bugs broke some steps, but reconnaissance and persistence still landed. Extensions auto-update by default in Cursor, which turned one compromised upload into thousands of machines. Cursor pulled the version and rotated keys; Anthropic had not warned customers publicly as of Ars Technica's reporting.

What to Watch Tomorrow

• Tuesday's midterms. Does "AI speed limits" become a proposal or stay a talking point?
• OpenAI's first close. A result below $20 billion sets the tone for Anthropic's listing and compute pricing.
• Forks of dsh-superagent. Expect harness builders to lift the Ticket and Mandate pattern within weeks.
• Cursor and Anthropic post-mortems. Developer-tool supply chains now carry npm-level risk; disclosure norms have not caught up.

Builder Impact

• Auto-update is an attack surface you own. This came through the vendor's own publishing account, not a typosquat. Pin versions in shared dev environments.
• These incidents hit credentials first. Stage one was inventory: env var names, Git config, IP. Plaintext env files make a five-minute window enough.
• Always-on agents need a written mandate. Copy DeepSeek's tickets, mandates and observe-only defaults before you copy the autonomy.
• Capital conditions reorder the roadmap. A smaller round at a flat valuation argues for optimising inference cost and shipping narrower agents.