AI stocks slide, OpenAI trims its raise, and a tampered coding tool hits Cursor users

Friday, October 30, picked up where the rest of the week left off. Investors kept selling technology stocks, and the question behind it hasn't changed: companies are spending enormous sums on AI, and nobody can yet say exactly when that spending pays off. Intel and Reddit had brutal days, and late in the evening a report said OpenAI is now raising less money than it had planned.

The rest of the day was about trust of a different kind. OpenAI, Google, Microsoft and Anthropic backed a single, shared way for websites to say they don't want their pages used to train AI. OpenAI announced new limits on what ChatGPT tells teenagers about weapons. And a tampered version of a popular AI coding tool slipped into a code editor's add-on store and tried to plant a backdoor on the computers of the people who installed it.

A rough Friday for AI stocks

The selling that followed Alphabet's results earlier in the week kept going on Friday. The Nasdaq, the US stock index packed with technology companies, fell 2.9%, according to Reuters. That left it about 8% below the record high it reached on October 6.

Chip makers took the worst of it. CNBC reported that Intel fell about 25% on Friday after giving a disappointing revenue forecast. A fund that tracks semiconductor companies is now down 29% from its recent high, which puts it deep in what traders call a bear market. That term simply means a fall of 20% or more from a recent peak. Nvidia was down about 4% on the day, and Alphabet, Google's parent company, slipped another 1% after having its worst trading day ever on Thursday.

Then there was Reddit. Its shares fell 29% on Friday, the steepest drop since the company went public in 2024. The results themselves weren't bad: sales grew 53% from a year earlier, and Reddit beat Wall Street's expectations for the quarter. But its forecast for the last three months of the year, $1 billion to $1.03 billion in sales, came in a little under the roughly $1.05 billion analysts were expecting.

Reddit's CEO, Steve Huffman, told CNBC that traffic coming to Reddit from Google searches went "down meaningfully in this quarter," and he put that down to AI. As Google shows more AI-written answers at the top of its results, fewer people click through to the sites those answers draw on. Reddit is planning to test making people log in to read its content, which it hopes will mean more signed-in users and more advertising. Several analysts downgraded the stock after the results.

Behind all of this is the same worry that has run through the whole week. Big tech companies and AI labs are pouring money into data centers and chips, and investors want to see it turn into profit. JJ Kinahan of Cboe Global Markets summed up the mood to CNBC: "You want to make sure that the reward is worth the risk." He added that he expects the reward to come, but with a lot of upfront cost.

OpenAI trims its funding round

Late on Friday, the Financial Times reported that OpenAI had cut the target for its latest funding round. According to the report, as summarized by Reuters, OpenAI now wants to raise about $20 billion instead of $30 billion. The valuation it is aiming for also came down, from $1.4 trillion to $1.25 trillion. A valuation is simply the price investors agree the whole company is worth when they buy a piece of it.

Investors had until Friday to commit. The report says the "first close," the first batch of money to come in, is expected to be under $20 billion, because some investors asked for smaller allocations than before. A group of investors from the United Arab Emirates, including the state-backed fund MGX, is expected to be the largest participant, and as part of the deal OpenAI would get the option to lease newly built computing capacity in the region. Founders Fund, Coatue, Sequoia Capital and Andreessen Horowitz are also expected to take part. Wealthy individuals will be able to invest later, at the same $1.25 trillion valuation.

There's a race in the background. Anthropic, the company behind Claude, plans to go public in November and, according to CoinDesk, is reportedly aiming to raise up to $100 billion at a $1.5 trillion valuation. Both companies are pitching to many of the same investors, and Reuters reported that OpenAI wanted to close its round partly to get ahead of Anthropic's listing. OpenAI itself plans to go public in 2027.

$20 billion is still an enormous amount of money for a private company to raise. But the cut shows that the nervous mood in the stock market is starting to reach even the biggest private AI companies.

One shared opt-out for websites

Meanwhile, there was some news for anyone who runs a website. OpenAI announced that it will honor a common signal that lets site owners say whether they want their content used to train AI. The Tech Buzz reported that Google, Microsoft and Anthropic are backing the same signal.

To see why that matters, it helps to know how this works today. Most websites have a small file called robots.txt. It's a set of instructions for crawlers, the automated programs that visit web pages and copy what's on them, whether for a search engine or to collect training data for AI. Until now, a site that didn't want its pages used for AI training had to list each company's crawler by name and block them one by one, and keep that list up to date as new crawlers appeared.

The new signal replaces that list with a single line. It defines one shared label, written __usage_ai-training, that every participating company reads the same way. According to Unite.AI, it started as a proposal by Kevin Kelley of Anthropic, published on October 30 and building on work in the IETF, the body behind many of the internet's technical standards. For now it's an individual draft, which means it doesn't yet have formal standing as a standard. People from news organizations, Cloudflare, Common Crawl and digital rights groups are among those thanked for their input.

OpenAI says it plans to start honoring the signal in the coming months and will share details when it does. It also says the new signal won't replace the robots.txt controls it already offers, so existing settings keep working.

There are real limits. The signal is voluntary, and as The Tech Buzz pointed out, there's no enforcement mechanism: it depends on companies choosing to respect it. It also only covers collecting data for AI training. It doesn't decide whether a site shows up in AI search answers, and it doesn't get anyone paid. Still, for a website owner, it means one line instead of a growing list.

New limits for teens on ChatGPT

Next, OpenAI announced a set of new safety measures for ChatGPT. The most visible one is for teenagers. For users it predicts are under 18, ChatGPT will hold back practical information about weapons and security systems that could be used to hurt someone, even when a question seems harmless and shows no sign of violent intent. Teens can still get help calming a situation down, finding support or reaching a trusted adult.

How does ChatGPT know someone is a teenager? OpenAI uses what it calls age prediction: an estimate based on signals from how an account is used. According to Unite.AI, the system started rolling out on consumer plans in January and reached the EU in August. Adults who are placed in the under-18 experience by mistake can verify their age through Persona, OpenAI's age verification partner.

Some changes apply to everyone. ChatGPT can now end a conversation automatically when someone appears to be fixating on violence or on seriously harming another person. If that happens several times, OpenAI may temporarily pause the account, and it says it's working on notifying parents when a teen's account is paused for repeatedly discussing violence. ChatGPT will also give less detail about past attacks and the people behind them, such as which weapons were used and how they were obtained, whatever the user's age or reason for asking. People can still ask about the impact on victims and communities, and about warning signs.

OpenAI also says it made more than 200 referrals to law enforcement in the third quarter of 2026. It plans to publish a community safety report every six months, with the first one due in early 2027 covering the second half of this year. The new safeguards roll out over the next few weeks.

A tampered Claude Code update hits Cursor users

And finally, a warning for people who write code. The Hacker News reported on Friday that a tampered version of Anthropic's Claude Code extension had been pushed out through the add-on store of Cursor, a popular code editor. An extension is an add-on that gives an app extra features. This one arrived as what looked like a normal update, version 2.1.313, under the real publisher name.

Hidden inside was a short piece of code that tried to open a backdoor, a secret way for attackers to get into a computer later. According to the report, it added the attackers' digital key to the computer's list of allowed remote logins, tried to switch on remote access, set itself up to survive restarts, and sent back details about the machine. Those details included the user name, the computer's name and the names, though not the contents, of settings that often hold passwords and access keys.

Cursor says at most 5,000 users installed the bad version, during a window of about 11 hours on October 29, and it temporarily shut its add-on store to pull the package. Turning on remote access needs administrator rights that the extension usually doesn't have on most Mac and Windows computers, but Cursor says the other steps still happen, so anyone affected needs to clean up regardless. In Cursor's words, "This malicious version of the extension was not developed by Anthropic."

How the attackers managed to publish the update is still unclear. There's no evidence that it reached Microsoft's own extension store or the open-source Open VSX store, and Anthropic has published a clean version, 2.1.314, on both. Cursor says it will contact affected users directly. The advice for them is to remove the unauthorized key and the pieces the extension set up, and to change their passwords and access keys.

Security people call this a supply chain attack: instead of going after you directly, someone tampers with a tool you already trust, so the harm arrives through a normal update. As more people install AI tools that can read and change their files, those tools become an attractive target.

The big picture

If there's one thread through Friday, it's trust. Investors want proof that the money pouring into AI will pay off, and until they see it, even companies with fast-growing sales, like Reddit, or giant fundraising plans, like OpenAI, are feeling the pressure. Website owners want a simple way to decide how their work is used, and the biggest AI companies have now agreed on at least one line they'll all read, voluntarily. OpenAI is tightening what ChatGPT will say to teenagers and to anyone fixated on violence, and promising regular reports on how it handles safety.

And the Cursor incident is a reminder that AI tools are software like any other. The more access they have to our computers, the more it matters that the updates we install are the real thing.