CodeMingle AI News Report - November 3, 2026
Executive Summary
SemiAnalysis has published GDPx, a benchmark of agents across eleven professional domains. OpenAI says a shared ChatGPT and Codex usage allowance is planned for December on Plus, Pro and Business. For developers, Cursor has also published guidance following a malicious Claude Code extension package in its marketplace. Today’s theme: look beyond headline scores, understand the meter, and check the software supply chain.
Editorial date: November 3, 2026, New Zealand time. GDPx was reported on November 2; the Cursor incident occurred October 29 and its advisory is dated that day. The OpenAI Help Center describes a planned December change; check current plan notices for updates. Benchmark scores are the publisher’s measurements, not independent replication.
Listen to the podcast edition
Top AI News Stories
1. GDPx tests agents across eleven domains — November 2
SemiAnalysis’s GDPx combines tasks from specialist partners in fields including chip design, software engineering, cybersecurity, biology and finance. Its leaderboard says the overall score weights each of eleven domains equally and averages three attempts per task. When checked for this issue, Claude Opus 5.5 led the published table at 12.0%, followed by Gemini 4 Carbon at 10.9% and GPT-6 Astra at 9.6%. These are the benchmark authors’ reported scores, not the percentage of all jobs that AI can automate. GDPx leaderboard · SemiAnalysis methodology.
Why it matters: A multi-domain test can expose gaps that a single coding score misses. Examine individual domains, grading, tools, access, cost and the selected tasks before deciding what a ranking means for your own work. Carbon’s wider availability should be checked separately.
2. OpenAI describes planned shared ChatGPT and Codex allowances — announced ahead of December
OpenAI’s Help Center says Plus, Pro and Business plans will share a token-based usage allowance across ChatGPT and Codex starting in December as Work’s agentic capabilities move into the main ChatGPT experience. It says Instant chat will not draw from the allowance, and model choice and task complexity affect consumption. The Help Center describes a planned change, not an already-completed migration; check the current plan and workspace notices for specifics. OpenAI Help Center.
Why it matters: If a team uses both products, usage patterns and reset times may need to be monitored together. API billing and managed workspace terms should be checked separately rather than inferred from this announcement.
3. Cursor warns about a malicious extension package — incident October 29
Cursor says a maliciously modified Anthropic.claude-code version 2.1.313 was available through its VS Code extension marketplace between approximately 2:27 a.m. and 1:35 p.m. Pacific time on October 29. Cursor says the package was not developed by Anthropic, was removed, and attempted to install a persistent SSH backdoor. Its advisory says uninstalling the extension alone may not remove persistence, and provides impact checks and remediation guidance. Cursor’s security notice.
Why it matters: Marketplace, version, installation time and platform all matter in deciding exposure. If the advisory applies, follow its current incident-response guidance; do not assume that an official-looking publisher name proves package integrity.
Technical Deep Dives (Architecture & Implementation)
Read the benchmark as a system, not a single number
GDPx combines results across domains, and its leaderboard says tasks use both binary and continuous grading, with three attempts averaged for the default score. The benchmark’s methodology describes the selected domains and specialist partners.
CodeMingle analysis: Before selecting a model, read the task definitions and per-domain results, inspect the agent harness and tool permissions, and compare model cost and completion quality. Build a small private evaluation from your own work; a benchmark designed around selected high-value domains is not a random sample of every workplace task.
Developer Tools & AI Agents
Scope an extension incident
Cursor’s advisory identifies a particular marketplace, package and time window. Cursor recommends inspecting endpoint and installation evidence, isolating hosts with signs of execution, removing unauthorized persistence, and rotating accessible credentials from a trusted system.
CodeMingle analysis: Preserve relevant evidence and coordinate with whoever owns the endpoint before changing it. Distinguish the tampered package from unrelated registries and from Anthropic’s model itself. Check the latest vendor advisory because details may be updated.
Hardware & Infrastructure
Measure an agent’s complete cost
The GDPx leaderboard includes reported cost-per-task estimates for some models. A benchmark estimate is not your bill: prompt length, retries, tools, concurrency and task mix can differ.
CodeMingle analysis: Track tokens, tool calls, time, successful outcomes and human review for representative jobs. For self-hosted components, include hardware, idle capacity and operations. Compare systems at the quality your task actually needs.
Detailed Trend Analysis
CodeMingle analysis: Agent adoption makes the whole workflow the unit of evaluation. A model score, a subscription allowance and a trusted extension each answer a different question: can the system complete the work, what does it cost, and can its execution environment be trusted? Teams need evidence for all three.
Future Outlook
Watch for further GDPx versions and independent evaluation, OpenAI’s detailed rollout notices, and any updates to Cursor’s security advisory. Start with a representative task set, a usage baseline and a clear incident owner before expanding agent access.