Backdoored Claude Code Extension Meets Enforcing Hooks, Plus Qwen3.8 Flash-Next Speed Records

Today's findings

1. #1 Official Claude Code VS Code extension compromised to install a persistent SSH backdoortip

   The official Claude Code VS Code extension was trojanized to plant a persistent SSH backdoor — treat your agent plugins as production supply chain.

   Supply-chain warning

   critical

   Official Claude Code VS Code extension trojanized into an SSH backdoor

   Vector

   Trusted official install channel abused

   Payload

   Persistent backdoor hiding in SSH, systemd, cron

   Exposure

   SSH keys, cloud tokens, repo access at risk

   affected scopeAny dev laptop with the extension installed — same path applies to every pasted MCP server or plugin

   critical severity — badge colour grades the risk

   Rotate keys & tokens · audit authorized_keys/cron · pin versions · allowlist installs

   Why it matters: Anyone who installed the extension on a dev laptop may have SSH keys, tokens and repo access exposed, and the same attack path applies to every MCP server or plugin you paste into a config.

   How to apply: Rotate SSH keys and cloud tokens for affected machines, grep ~/.ssh/authorized_keys and systemd/cron for unexpected entries and tunnels, pin and verify extension versions, and route agent tooling installs through a reviewed allowlist.

   securityclaudesupply-chain

   Read more: Anthropic hacked to deliver remote access trojan · Backdoors in official Claude Code extensions · Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor

2. #2 Ten Claude Code hooks, tested: start with the force-push and rm -rf blockertip

   Hooks run deterministically on every call, so a command-inspecting hook beats CLAUDE.md for anything you actually need enforced.

   Agent guardrails

   Request vs enforcement

   CLAUDE.md

   • A request, not a rule
   • The model can forget it
   • No hard failure path

   vs

   Hook

   • Deterministic, every call
   • Exit non-zero blocks the tool
   • Start: block force-push & rm -rf

   Anything you actually need enforced becomes a hook

   Then layer lint-and-test, banned paths, and secret scanning — test each in a throwaway repo.

   Why it matters: CLAUDE.md is a request the model can forget; a hook that parses tool_input.command and exits non-zero is a real guardrail against destructive commands in an agent session.

   How to apply: Add a bash hook that jq-reads tool_input.command and blocks `git push --force`/`rm -rf`, then layer hooks for lint-and-test before commit, banned paths, and secret scanning — and test each one in a throwaway repo first.

   claude-codehooksguardrails

   Read more: Tested 10 Claude Code hooks in a throwaway project. A few gotchas worth knowing before you copy any

3. #3 Qwen3.8 Flash-Next: 287 tok/s FP4 single-stream on one RTX PRO 6000, with prebuilt 1M-context FLARE imagestool

   A 27B-class open-weights model now serves coding traffic at 287 tok/s single-stream and 965 tok/s at 8 concurrent on a single card, with 1M-context images published for the FLARE engine.

   SELF-HOSTED CODING

   One card now carries a team's code assistant

   287

   tok/s single-stream · FP4 · one RTX PRO 6000

   965 tok/s at 8 concurrent

   1M

   token context, prebuilt FLARE image

   27B

   class open-weights model

   FP4

   quantized weights on a single card

   Throughput plus 1M context: self-hosting a coding agent goes from stall-prone toy to team tool.

   Why it matters: This is the throughput and context length that make a self-hosted coding assistant real for a team, instead of a toy that stalls on long agent loops.

   How to apply: Pull the single-GPU FLARE 1M image (or the TP2 build for two cards), run FP4 weights, then benchmark your own prompt mix at concurrency 1 and 8 before sizing a shared queue and context budget.

   local-llmquantizationqweninference

   Read more: Qwen 3.8 Flash Next 'Flare' images for 1M context · Qwen 3.8 Flash Next 'Flare' images for 1M context · Qwen3.8 Flash-Next (FP4) on a single RTX PRO 6000: 287 tok/s single-stream coding, 965 tok/s at 8 concurrent

4. #4 Soft-MTP fixes a flaw in standard multi-token prediction trainingpaper

   A soft-target/residual correction to MTP training keeps the downstream gains and the speculative-decoding speedup without the standard recipe's damage.

   Multi-token prediction training

   Soft-MTP: keep the wins, drop the damage

   Standard MTP

   • Spec-decode speedup
   • Downstream gains
   • Quality damage

   → Gains + speedup intact, flaw gone

   Soft-MTP

   • Speedup kept
   • Gains kept
   • Damage removed

   Soft targets plus a residual correction to the MTP training objective

   Why it matters: MTP is already in many pretraining stacks, so a cheap training-side fix that preserves fast decode matters for anyone fine-tuning models they then serve.

   How to apply: Read the paper, check whether your fine-tuning framework supports auxiliary MTP heads, and A/B decode throughput with speculative decoding on versus off using the corrected objective.

   paperinferencespeculative-decoding

   Read more: [Paper] Multi-Token Prediction Done Right - Soft-MTP

5. #5 Fine-tuning survived roughly 30% label noise before falling off a clifftip

   Across 4,000 pairs and three benchmarks, fine-tuning held its AUC gain up to ~30% flipped labels, then dropped sharply at 40%.

   Why it matters: Production feedback labels come from thumbs up/down and are inherently noisy; knowing the break-even point tells you when to ship versus when to re-collect data.

   How to apply: Sample-audit your feedback labels, estimate the flip rate, and if it lands under ~25% ship the fine-tune with confidence filtering rather than blocking on a perfect dataset.

   fine-tuningdata-qualityevals

   Read more: Fine tuning still helped with up to 30% label noise, on all 3 benchmarks we tested

6. #6 OXR: a 1.3B open document parser that returns typed Markdown/JSON with bounding boxespaper

   A small open-weights model that preserves reading order and types 13 element kinds — tables, formulas, code — instead of flattening two-column PDFs into word soup.

   DOCUMENT PARSING · OPEN WEIGHTS

   Word soup vs typed structure

   vs

   Classic PDF-to-text

   OXR (1.3B, open)

   Reading order

   Columns interleave

   Preserved

   Element types

   None — just text

   13 kinds typed

   Tables & formulas

   Flattened

   Markdown/JSON

   Layout

   Discarded

   Bounding boxes

   Downstream RAG

   Silently poisoned

   Clean chunks

   Classic PDF-to-text wins the row OXR (1.3B, open) wins the row

   The left side looks fine yet fails silently — judge chunks on a 20-question retrieval eval before swapping your ingestio

   Why it matters: Silent PDF extraction errors poison retrieval and NER forever downstream, and a small local parser is far cheaper than rearchitecting your chunking strategy to compensate.

   How to apply: Run OXR over your worst two-column and table-heavy PDFs, then compare chunk quality against your current extractor using a 20-question retrieval eval before swapping the ingestion stage.

   ragdocument-parsingopen-weights

   Read more: Reading order is the part of PDF parsing that quietly breaks downstream NLP

7. #7 LFM3-1.7B and LFM3-VL-2B run fully offline on iPhone and Android, with the ExecuTorch export open sourcedtool

   A 1.7B text model and 2B vision model run entirely on-device, and the team published the app plus what it took to export LFM3 to ExecuTorch.

   Why it matters: On-device inference removes per-token cost and keeps user data local, which is the only option for offline or privacy-sensitive features.

   How to apply: Fork the open-source app, swap in your own prompts and tool schema, then benchmark first-token latency and peak memory on your oldest supported phone before committing to an on-device feature.

   on-deviceexecutorchlocal-llm

   Read more: LFM3-1.7B and LFM3-VL-2B running fully offline on iPhone and Android, plus what it took to export LFM3 to ExecuTorch (open source app)

8. #8 M-Strata composes multiple inference engines to run bigger local models on limited VRAMrepo

   A community fork of Strata orchestrates several engines so a model that almost fits still serves from one machine, and users are reporting it working across dual B70 Pros.

   Why it matters: It is the practical escape hatch when a 27B-class quant is a few GB too large but buying another GPU is not on the table.

   How to apply: Try M-Strata with your existing GGUF and quant, measure prefill and decode against plain llama.cpp on the same prompts, and keep it only if the extra moving parts buy real throughput.

   local-llminferencerepo

   Read more: M-Strata (Multiengine Strata) · Strata on 2 B70 Pro's - Amazing!

9. #9 Cap per call when you write the calls; cap per key when the agent doestip

   Per-call price checks belong in your own wrapper, while autonomous agents need per-key budgets with reserve-then-settle accounting.

   Why it matters: Agent loops blow budgets through retries and step sprawl, not through any single expensive request, so call-level limits alone will not catch the spend.

   How to apply: Wrap scripted jobs in a client that refuses calls above a set price, and for agents set hourly/daily/per-tool key limits that reserve the maximum before each bounded call and settle after it returns.

   agentscostguardrails

   Read more: Per-call caps vs per-key caps: which spend guard fits agents better?

10. #10 A LangChain tool can validate False and still hand True to its handlertip

    Pydantic StrictBool validates the argument, but a handler that writes `value or True` silently flips a legitimate False back on.

    LangChain tool bug

    A validated False still arrives as True

    1

    Tool call

    flag = False

    2

    StrictBool

    False passes ✓

    3

    `value or True`

    truthiness flips it

    The silent flip

    4

    Handler

    receives True

    Schema tests stop at the validator — assert on the arguments the handler actually receives.

    Why it matters: Silent default coercion is exactly the class of bug agent tooling hides until it misroutes a production query, and schema tests will never catch it.

    How to apply: Grep tool handlers for `or` defaults and truthiness fallbacks, replace them with explicit None checks, and assert on the exact arguments the handler receives rather than only on schema validation.

    langchainagentstesting

    Read more: A LangChain tool can validate False and still discard it in its handler

11. #11 disable-model-invocation keeps a Claude Code skill manual-onlytip

    Setting `disable-model-invocation: true` in SKILL.md frontmatter leaves the skill invocable as /changelog without Claude auto-loading it mid-task.

    Why it matters: Model-chosen skill loading burns context and produces surprises; explicit invocation keeps occasional workflows predictable and cheap.

    How to apply: Add the flag to rarely needed skills like changelog, weekly report and release notes, and keep only broadly relevant skills model-invocable so they can still trigger automatically.

    claude-codeskillscontext

    Read more: How to stop Claude Code loading a skill automatically

12. #12 Rapid-H3 cuts MiniMax-H3 video+audio renders 3-5x on a single DGX Sparkrepo

    A ComfyUI node pack with two presets takes a 768x1344, 141-frame clip with audio from ~600s stock down to ~117s on one GB10.

    Why it matters: Fast enough local video generation turns iteration from overnight batches into something you can actually review and re-run in a session.

    How to apply: Install the node pack, start with the ts_h2 preset for first-frame clips and ts_s6 for camera moves or close-up faces, then diff motion, voice and lip sync against stock output on your own clips before adopting.

    comfyuivideoinference

    Read more: Rapid-H3: Super fast H3 video + audio in about 2 minutes on one DGX Spark · Rapid-H3: Super fast H3 video + audio in about 2 minutes on one DGX Spark