Yesterday's Trend Watch looked at state that breaks when an agent session moves. This week's sources show a related problem: systems that trust a label instead of checking what the label points to. Four incidents and fixes from October 29 to 31, 2026 follow the same pattern.
A publisher name in a marketplace
Cursor's October 29 notice describes versions of Anthropic.claude-code that "were not developed by Anthropic." The extension's identity in the marketplace was correct; its contents were not. Cursor's response was to check the contents: published hashes for each modified VSIX, a search for the planted svc-telemetry key, and an audit confirming no other extensions were tampered with.
A provider name in a framework
Pydantic AI's PR #11774 explains that server-side state "can only be looked up at the endpoint that created it, but it was sent back to any provider with the same name." The fix compares the stored provider_url with the provider's base URL. The PR adds that "nothing is derived from credentials" when deciding whether two endpoints share state. The same release's ArtifactScanner keeps a flagged skill's name reserved, so "an unscanned same-named copy cannot replace it." A name is held so that it cannot be reused by something unchecked.
A path that names a file differently
Gemini CLI's PR #30042 fixes GlobTool when a workspace root or entry is a symlink, as /tmp is on macOS. Raw paths and resolved paths did not match, so the tool dropped valid matches or returned paths the read and edit tools did not expect. The fix compares canonical real paths and deduplicates entries that resolve to the same file.
Text that is not conversation
ADK Python's fix for FirestoreMemoryService, merged October 31, separates parts by what they are. A part marked as a thought is no longer indexed or stored as memory, even though it is text in the same event.
What remains uncertain. These are four sources, and they come from different layers: distribution, model routing, file tools and memory. None of the release notes says how often the old behaviour caused harm, and the Cursor incident remains unexplained at its root.
Analysis: When an agent system decides whom to trust, check the thing itself: a hash for a package, an endpoint for stored state, a canonical path for a file, and a part type for text. Names are useful for finding things and weak for proving what they are. At Belgavi's Book Store, Jenya could apply this to the help-desk agent's skills folder: record each skill's hash when it is reviewed, refuse a skill whose name matches a reviewed one but whose hash does not, and resolve every file path before the agent's write rules are checked.
Sources and evidence
- Malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace (Cursor, October 29)
- Send server-side state back only to the endpoint that created it (pydantic/pydantic-ai #11774)
- Add agent artifact security scanning for Memory and Skills (pydantic/pydantic-ai #11470)
- fix(core): resolve symlinked paths canonically in GlobTool (google-gemini/gemini-cli #30042)
- fix: keep thought parts out of FirestoreMemoryService (google/adk-python, October 31)
Releases and incidents from October 29 to 31 show identity checks moving from names to substance: Cursor answered a tampered extension published under Anthropic's name with hashes and key checks, Pydantic AI scoped server state to the stored endpoint URL rather than the provider name and reserved flagged skill names, Gemini CLI compared canonical paths for symlinked files, and ADK Python stopped storing thought parts as memory.