The rules you never see

Games and software News

Claude Code now declines to remake a specific game

Anthropic quietly added a rule to Claude Code: build original games, genre games and games from your own designs, but not a copy of a specific existing game, even renamed. Users cannot switch it off.

ContextOver the past weeks, AI tools have made it quick to clone a game from its demo, and some studios have cancelled public playtests for fear of fast copies.

What one Claude Code release (2.1.243) sent to the model before any reply, as captured in the Hidden in Plain Sight study. The new rule sits in the top layer.

An X user called Chasm spotted the new rule in Claude Code's instructions, pushed around October 27. It reads: do build original games, games in a genre and games from the user's own designs and assets; do not build a recreation of a specific existing game, even if it is renamed or called original.

Anthropic confirmed it to Game Developer through a post by Addy Osmani, who said the two sentences were added for Opus 5.5 because using Claude to infringe intellectual property is against its usage policy. Osmani said the team will keep adjusting the balance and asked developers to send him cases where Claude refuses their own work.

Game Developer notes the limits: rules like this are often talked around, it is unclear how a model can tell whether you own an idea or an asset, and cloners can switch to open-weight models with no such rule.

Technical details

The rule appears under the flag name tengu_heron_brook. It only steers the model; it is not a filter on output, so results will vary by wording and context.

The layer sizes come from arXiv 2610.37332, which captured the first model request of 1,886 releases of Claude Code, Codex, Gemini CLI, Qwen Code and OpenCode. Stacks can exceed 120,000 characters before the user's prompt.

Why it mattersIf you prototype games with an agent, expect refusals near famous titles and expect the line to move. Keep your own design docs and assets in the repo: the rule explicitly allows building from them.

For youKeep a short design doc in each game repo (ElementalBlades included) so requests read as building from your own designs; if a remake of one of your older prototypes is refused, that is the case Osmani asked to hear about.

Opus 5.5: Anthropic's current top model, the one Claude Code uses by default.
open-weight models: AI models whose files are published, so anyone can run them without the maker's rules.
System message: Standing instructions the tool sends to the model ahead of what you type.

Sources Game Developer: Anthropic tells Claude to stop remaking video games arXiv: Hidden in Plain Sight, the instruction stacks of coding agents

More like this Less like this

Inside your tools

What your agent and editor run that you never typed.

Software and AI Do this

A fake Claude Code extension planted a backdoor: check your machine

ContextCursor and similar editors run their own extension stores, separate from Microsoft's. Anthropic says its own systems and official channels were not compromised.

For about 11 hours on October 29, Cursor's extension store served a tampered Claude Code extension that tried to give an attacker remote access. Anthropic did not build it. Removing the extension is not enough.

Who is affected: anyone who installed or updated Anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor marketplace on macOS or Windows between 2:27am and 1:35pm Pacific on October 29. Cursor's steps:

Look for the key
The payload adds an SSH key labelled svc-telemetry. On macOS, search ~/.ssh/authorized_keys for that word; Cursor gives a one-line check for each platform.
No key, you are clear
If the label is not there, Cursor says the machine was not impacted.
Found it? Run the cleanup
Cursor's remediate scripts remove the extension, the startup entries, the tunnel processes and the key, and exit with an error if anything remains.
Rotate from a clean machine
Change tokens and passwords the machine could reach: source control, CI, cloud, package registries. Consider rebuilding it.
Update the extension
Install 2.1.314 or later, published after the incident.

Technical details

The injected code runs when the extension loads, before any user action. It reports the hostname, username, OS, public IP and environment variable names (not values), adds the key, tries to enable SSH and opens a reverse tunnel to 134.209.82.225, retrying every 60 seconds. Persistence: a LaunchAgent named com.apple.sysmond on macOS, a scheduled task or Startup script on Windows.

Enabling the SSH service needs admin rights, so on most machines the login step failed. Cursor took the attacker's server offline with its host, shut and rebuilt the marketplace, and rotated its keys. StepSecurity, relaying Anthropic, says only 2.1.313 was tampered with and it never reached Open VSX or Microsoft's store; Cursor's notice lists both 2.1.312 and 2.1.313.

Why it mattersEditor extensions run with your full user rights, and a store you trust can still serve a bad copy. Know which store each of your editors installs from.

For youRun the svc-telemetry check on any machine where Cursor has the Claude Code extension, then rotate the Supabase and GitHub tokens on it if the key turns up.

SSH key: A file that lets someone log in to a computer without a password; adding one to authorized_keys grants that access.
backdoor: A hidden way into a machine that bypasses normal login.
rotate: Replace a password or token with a new one so the old one stops working.

Sources Cursor: security notice Phorion: analysis of the backdoor StepSecurity: trojanized extension

More like this Less like this

Software and AI Release

Claude Code 2.1.316: cheaper subagents, and a deadline for fast mode

The new Claude Code release lets helper agents run at a lower effort than the main session, and the fast option for the older Opus 4.8 model stops working on November 30.

The changes most people will notice, from the release notes.

Subagent effort
CLAUDE_CODE_SUBAGENT_EFFORT sets the effort level subagents use when nothing else names one, instead of inheriting the session's.
Opus 4.8 fast mode ends
Deprecated October 30, removed November 30. After that, fast requests to Opus 4.8 return an error rather than falling back. Move to Opus 5.5.
Ultrathink switch
CLAUDE_CODE_DISABLE_ULTRATHINK turns the ultrathink keyword off; in VS Code the keyword now runs its turn at xhigh effort.
Fixes worth knowing
Subagents no longer jump to the main model when a background job wakes them, and shell commands are no longer left running after Claude Code exits.

Technical details

Also new: pooled_budget on the Claude apps gateway spend-limits admin API gives a group one shared monthly budget on top of each member's limit; managed.policy_mode: layered makes every matching policy apply. PowerShell hooks now block on exit code 2 when the command starts with a type cast, param, using or an attribute.

The sonnet, opus and haiku aliases on Vertex and Bedrock now fall back to an older model instead of erroring when the newest is not available in the account or region.

Why it mattersSubagents often do the bulk of the reading in an agent run; letting them run lower while the main session thinks harder is a direct cost lever.

For youSet CLAUDE_CODE_SUBAGENT_EFFORT for the routines that fan out reading desks, and grep scripts for Opus 4.8 with fast mode before November 30.

subagents: Helper agents the main session starts for side tasks, each with its own context.
effort: How much reasoning the model spends on a turn; higher costs more and takes longer.
ultrathink: A keyword you can type in a prompt to ask for maximum reasoning on that turn.

Sources Claude Code v2.1.316 release notes Claude Platform release notes

More like this Less like this

Software and AI News

One startup cut its AI bill per developer by almost two thirds

incident.io, a company that makes on-call and incident tools, spent about $4,500 per developer per month on AI in August. It now spends about $1,600.

$4,500AI spend per developer per month, August

$1,600the same, now

The figures come from The Pragmatic Engineer, whose full breakdown of how they did it is for paid subscribers.

Why it mattersIt is a rare real number for what heavy agent use costs a team, and a sign that the first months of spend have a lot of slack in them.

Sources The Pragmatic Engineer: The Pulse

More like this Less like this

Who is making games now

AI-built games fill the long tail, and the tools for small teams get better.

Game dev Trend

Vibe-coded demos flooded Next Fest, but not its top 100

ContextSteam's AI disclosures miss code written with AI help, so the newsletter looked at which engine each demo was built with instead.

GameDiscoverCo scanned the files of almost every demo in October's Steam Next Fest. Games with no recognisable engine, often web-tech projects made with AI, jumped to second place overall but barely show among the most played.

Stacked bars of engines in October 2026 Next Fest demos for the top 100, 500, 1,000 and all. Unity leads; Unreal is 28% of the top 100 but 12% of all; no engine and Godot grow down the list. — Image: GameDiscoverCo

Engine share of demos, by GameDiscoverCo's file scan. Top 100 is ranked by peak concurrent players.

	All demos	Top 100 demos
Unity	45.9%	53%
Unreal	12.3%	28%
No engine detected	17.7% (12.9% in June)	7%
Godot	17.4% (12.6% in June)	6%

Quick AI-assisted games are filling the long tail; the games people actually play still mostly come from established engines. The real threat, the newsletter argues, is skilled small teams using AI to ship good games faster.

Technical details

The festival had over 7,000 demos against about 5,000 expected. Further down the list the share grows: in the top 1,000, no engine detected is 14% and Godot 12%. Readers suggested two reasons: web frameworks like three.js are not picked up by the scanner, and Godot is open source and has an MCP interface for agents.

Steam releases are climbing too: September was up 76% year on year to 2,875 games, October 53% so far to 3,114. At those rates the newsletter projects about 35,000 games on Steam in 2027, against 21,000 in 2025.

Why it mattersThe middle of Steam is getting more crowded with very cheap games; standing out now depends even more on craft, wishlists and a demo people stay with.

For youBrowser and three.js games land in the no-engine bucket that is filling fastest with low-effort entries; a Steam release of one needs a clearly crafted hook to escape that crowd.

vibe-coded: Built mostly by describing what you want to an AI and accepting the code it writes.
concurrent players: How many people are playing at the same moment.
Next Fest: Steam's recurring festival of free demos for upcoming games.

Sources GameDiscoverCo: The hidden AI signifier in Next Fest

More like this Less like this

Game dev News

Roblox players dipped while its creators leaned on AI

Roblox missed its player target this quarter, and says most of its biggest games are now made with help from AI tools.

138Mdaily players, down 9% on a year ago

80%+of the quarter's top 100 games used AI tools (Roblox-reported)

Analysts expected 145 million daily users. Payouts to creators fell 6% to $403 million, while revenue rose 16% to $1.57 billion. The company's chief executive called AI a step change in how fast content gets made.

Why it mattersOn the biggest user-generated platform, AI help is already the norm among top creators, and it has not stopped engagement from falling.

Sources Game Developer: Roblox growth slumps GameDiscoverCo: weekly roundup

More like this Less like this

Game dev Release

Ucupaint 3.0

Layer-based texture painting add-on for Blender, free and open source

Ucupaint lets you paint game textures in layers inside Blender, the way paid tools like Substance Painter do. Version 3.0 adds separate height channels, smarter adjustment layers and automatic bake targets.

Two models painted in Blender: a cluster of spiky red mushrooms on a rock, and a cartoon elf head with yellow hair. — Image: 80 Level, Ucupaint

The developer skipped 2.5 after about a year of work. Height and vector displacement get their own channels, adjustment layers can reuse the layer below, decals gain spherical and cylindrical shapes, and bakes can now target packed ORM maps. Older files convert on load.

Price: Free
Blender: Tested on 2.76 to 5.3
Released: October 23

Why it mattersA no-cost route to layered PBR texturing for small teams, now with output that drops into common engine texture layouts.

For youWorth testing for Fab asset textures: ORM bake targets map straight onto Unreal's packed texture slots.

ORM maps: One texture that packs ambient occlusion, roughness and metalness into its three color channels, the layout Unreal uses.
bake: Render a material's look into an image file a game engine can load.

Sources Ucupaint 3.0.0 release 80 Level: Ucupaint 3.0

More like this Less like this

Old habits, new pressure

Shipping, hiring, writing and even string checks get rethought.

Software and AI Lesson

Firefox races cheap models through the patch gap

When a security fix appears in public code, attackers can work backwards to the bug and hit users who have not updated yet. Mozilla says cheap AI models now make that easy, so Firefox changed how it ships.

Since February, Firefox has used early access to frontier models to find bugs and shipped over seven times the security fixes of the same period in 2025 (Mozilla-reported). But it has seen GLM 5.3, a cheaper open model, turn some of those public fixes into working attacks.

Mozilla shrinks the gap: weekly releases (the cycle was halved), regression tests kept private until the fix ships, and a scan of every new commit. Next, fixes for different defence layers are timed so their gaps never overlap.

Why it mattersAny project that publishes fixes before users update has this gap. Shorter release cycles and holding back the test that reveals the bug are moves any team can copy.

For youFor SaaS security fixes, merge the regression test after the deploy rather than with the fix when the repo is public.

regression tests: Tests added with a fix that fail if the bug ever comes back; they also point straight at the bug.
frontier models: The most capable AI models from the leading labs.
GLM 5.3: An open-weight model from the Chinese lab Zhipu AI.

Sources Mozilla: Defending the patch gap against automated attackers

More like this Less like this

Software and AI News

An Anthropic hiring manager drops the coding interview

Felix Rieseberg, who hires engineers at Anthropic, has stopped giving candidates coding tests, saying they no longer predict who does well.

Our most impactful builders are successful regardless of how good they are at these tests.

Felix Rieseberg, Hiring manager, Anthropic

He says Claude is now better than candidates at small React or assembly exercises. It is his team's change, not a company-wide policy.

Why it mattersIf small coding exercises stop telling candidates apart, hiring has to look at judgement, initiative and shipped work instead.

Sources Felix Rieseberg: Hunger beats tenure The Pragmatic Engineer: Anthropic kills the coding interview

More like this Less like this

Software and AI Lesson

JavaScript and Python disagree on what counts as a space

A short investigation shows there is no single answer to whether a character is whitespace: Unicode lists 25, Python accepts 29, and Java and JavaScript each draw the line somewhere else.

Sergey Tselovalnikov's examples. Same characters, different answers:

/\s/.test("\u00A0");   // true   (JavaScript)
/\s/.test("\u0085");   // false
/\s/.test("\uFEFF");   // true

"\u00A0".isspace()      # True    (Python)
"\u0085".isspace()      # True
"\uFEFF".isspace()      # False

Character.isWhitespace('\u00A0'); // false (Java)

U+00A0 is the no-break space, U+0085 is next line, U+FEFF is the invisible byte-order mark. Java leaves out the non-breaking spaces on purpose; JavaScript counts U+FEFF, which Unicode does not.

If a TypeScript front end trims input and a Python service validates it, the two can disagree on the same string.

Why it mattersValidation, trimming and search behave differently across languages; a username or tag that looks empty in one service can pass in another.

Unicode: The standard that gives every character in every writing system a number.

Sources SerCe: How hard is it to check for whitespace?

More like this Less like this

Software and AI Lesson

Do not let the model write your first draft

Martin Fowler argues that text drafted by an AI keeps a recognisable voice even after a person edits it, and readers lose trust when they hear it.

Authors should fill the prose themselves.

Martin Fowler, Chief scientist, Thoughtworks

He allows AI for outlines, search and translation, and for writing nobody will read closely. He calls writing a tool for thinking.

Why it mattersDocs, store pages and release notes are read by people deciding whether to trust you. A drafting shortcut can cost more than it saves.

Sources Martin Fowler: LLM Voice

More like this Less like this

See what your coding agent sends before your prompt

In half an hour you see the hidden instructions and tool descriptions your agent sends with every request, and how small your own words are next to them.

You needNode 18 or later and Claude Code (other agents with a configurable API address work the same way).

Start a local listener

Save the script below and run it with node. It saves each request body it receives and answers with an error, so nothing reaches the real API.

Point the agent at it

In a scratch folder, run Claude Code with ANTHROPIC_BASE_URL set to the listener, and a one-line prompt.

Measure the layers

The script prints the size of the system text, the tool definitions and the messages for each request. Open the saved JSON to read them.

Repeat after updates

Keep the files and diff them after the next release to see what changed in the instructions.

// listen.mjs: node listen.mjs, then in another shell:
// ANTHROPIC_BASE_URL=http://localhost:8787 claude -p "say hi"
import { createServer } from 'node:http';
import { writeFileSync } from 'node:fs';
let n = 0;
createServer((req, res) => {
  let body = '';
  req.on('data', (c) => (body += c));
  req.on('end', () => {
    writeFileSync(`request-${++n}.json`, body);
    const r = JSON.parse(body || '{}');
    const len = (x) => JSON.stringify(x ?? '').length;
    console.log(n, r.model, { system: len(r.system), tools: len(r.tools), messages: len(r.messages) });
    res.writeHead(400).end();
  });
}).listen(8787);

You know it worked whenThe tools and system numbers run to tens of thousands of characters while messages is a few hundred. In the study's capture of Claude Code 2.1.243, tool definitions were 57,346 characters and the prompt 0.03% of the request.

For youCapture the first request in the radar repo and in a plugin repo to see how much of each CLAUDE.md lands in context, then trim what the agent never needs.

ANTHROPIC_BASE_URL

An environment variable that tells Claude Code which address to send its model requests to.

Overview figure: a single image and camera path feed a latent 3D Gaussian memory that alternates with a generator to produce an endless walk, with charts of flat memory use and steady frame rate against other methods. — Image: Choi et al., arXiv

The problem: Video world models that generate a scene as you move forget what they showed earlier, so walking back reveals a different place. Fixes so far either keep every past frame or re-render a 3D memory to images, which grows without limit or is too slow for real time.
The idea: Keep a compact 3D memory of blobs (Gaussians) that only grows where the camera sees something new, and store in each blob the video model's own internal features, so the memory feeds the generator directly without rendering pictures first.
The result: Against the leanest earlier 3D-memory method on each measure: up to 38.6 times fewer primitives, 3.2 times faster memory updates and 359 times faster memory rendering. A distilled version generates at 9 frames per second on one H100, with steady memory where Yume 1.5 used 66.7 GB at 1.4 fps. Static scenes only.
Use it: Watch this design for generated levels and previs: a persistent spatial memory beats replaying frame history. Code is released; expect a data-center GPU for real time.

The problem: Coding agents wrap your prompt in system instructions, tool definitions and context, and change that wrapping every release, but nobody documents it.
The idea: Install every stable release of five agents, send the same one-sentence prompt in a fresh sandbox, catch the first request with a local server, and classify every sentence of the hidden text. For the open-source agents, trace each change back to its commit.
The result: First requests captured for 1,886 releases of five agents. Stacks can pass 120,000 characters before the prompt; in one Claude Code capture the user sentence was 0.03%. Changes come in bursts that alter tool use, attribution and style rules, and only 48% say why. Two agents put instructions in user messages and insert an assistant line the model never wrote.
Use it: Record the agent version next to the model name in any eval or bug report; behaviour can shift between releases with no model change.

The problem: Files like CLAUDE.md are loaded as trusted guidance, so anyone who can edit one, for example through a pull request, can steer an agent without touching the prompt.
The idea: Write two malicious memory files per weakness class, one polite and one forceful, telling the agent to drop safety checks, and run 36 C and C++ tasks across 12 weakness classes with Claude Code (Sonnet 5.5) and OpenCode (Qwen 3.8 and DeepSeek V4.1 Flash).
The result: Secure completions moved between minus 8 and plus 6 points with no consistent direction, inside the range chance alone explains. Claude Code named the file in about two thirds of its final messages; OpenCode mostly mentioned it only in its hidden reasoning. Spotting the file as an attack did not reliably keep the code secure. One run per task, so this shows no measurable effect, not safety.
Use it: Review changes to CLAUDE.md and AGENTS.md in pull requests the way you review CI config, and read the agent's final message for mentions of them.

Claude Code now declines to remake a specific game

A fake Claude Code extension planted a backdoor: check your machine

Look for the key

No key, you are clear

Found it? Run the cleanup

Rotate from a clean machine

Update the extension

Claude Code 2.1.316: cheaper subagents, and a deadline for fast mode

One startup cut its AI bill per developer by almost two thirds

Vibe-coded demos flooded Next Fest, but not its top 100

Roblox players dipped while its creators leaned on AI

Ucupaint 3.0

Firefox races cheap models through the patch gap

An Anthropic hiring manager drops the coding interview

JavaScript and Python disagree on what counts as a space

Do not let the model write your first draft

See what your coding agent sends before your prompt

Start a local listener

Point the agent at it

Measure the layers

Repeat after updates

AI-generated worlds you can walk through that remember the map

Your prompt is a rounding error in what coding agents send

A hostile CLAUDE.md barely moved security, which is not safety

Also moving

This week on Toa Radar