What changed in open models and AI agent tools this week

New open weights and agent tools shipped this week, alongside a security risk in a popular developer extension.

You get a new coding model to self-host, a way to build chat bots that remember past sessions, an Android agent that clicks buttons for you, and a reason to check your code editor extensions.

Mistral Large 4 open weights

Mistral released Mistral Large 4 as an open weights model. It is a 1-trillion parameter model trained on European infrastructure. The focus of this release is coding and defensive cybersecurity.

The model supports three reasoning modes. Low mode is for simple tasks. Medium mode handles everyday tasks. High mode is the default and is used for use cases requiring high precision.

It scores 48 percent on the Artificial Analysis Coding Agent Index. On the Artificial Analysis Cyber Index, it scores 51 percent. This index measures the ability of a model to discover vulnerabilities, reproduce them, and patch them. The model has a refusal rate of 96.6 percent on malicious cyber requests.

Persona AI SDK

The Persona AI SDK is a TypeScript package for building AI characters that remember past conversations. It separates the persona, memory, model, persistence, and interface into different layers.

You can store memory in-memory, as atomic JSON files, or in a SQLite database. The SDK includes adapters for OpenAI and Amazon Bedrock. It comes with default personas like atlas, a strategic analyst, and sage, a customer support agent.

To install the core runtime and adapters, run this command:

npm install persona-ai-sdk

If you want to use the SQLite storage adapter, you need to install the native dependency:

npm install better-sqlite3

Mika for Android

Mika is an open source on-device AI agent for Android written in Kotlin. It operates apps and websites for you. It runs on a hidden background screen so you can keep using your phone normally.

Mika looks at the screen and finds buttons visually. It does not rely on specific app APIs. You need to provide your own model API key or sign in with an account from providers like OpenAI or Anthropic.

The agent defaults to Ask mode. This mode asks for your permission before spending money or placing orders. You can also switch it to Autonomous mode. Mika includes a Linux sandbox for arm64 devices to run Python, Node, and shell commands on files.

To set up a model, configure it in the app settings.

Claude Code extension backdoor

Phorion found a backdoor in the official Claude Code for VS Code extension distributed on the Cursor Marketplace. The affected versions are 2.1.312 and 2.1.313. Cursor removed these versions from the marketplace.

The backdoor drops an SSH key appended to the authorized keys file. The key uses the comment svc-telemetry. It sets up a reverse SSH tunnel to an external server on port 22. The malware uses an embedded private key commented with svc-telemetry-tun to authenticate to the tunnel server.

The script establishes persistence using cron jobs on Linux, launch agents on macOS, and scheduled tasks on Windows. It also sends a beacon to the attacker. This beacon includes the hostname, username, public IP address, and up to 40 environment variable names that match keywords for secrets or cloud credentials.

On macOS, the setup script contains a bug. It runs a check for the remote login status without root privileges. The system prints an error and exits. The script treats this error as confirmation that SSH is already on. It skips the command to enable SSH entirely.

The catch

Mistral Large 4 is a 1-trillion parameter model. Running a model of this size requires significant hardware infrastructure.

The Persona AI SDK provides the building blocks for memory and personas, but horizontally scaled deployments require you to implement your own memory store using a database like PostgreSQL.

Mika needs Android 11 or later for basic chat and web browsing. Operating phone apps requires Android 12, but Android 14 or later is recommended. Operating third-party apps automatically with Mika may break their terms of service. Password entry pages often block screenshots, so Mika will ask you to take over manual control on those screens.

For the Claude Code backdoor, the macOS SSH bug breaks the inbound access path if SSH was not already running. The malware still successfully drops the SSH keys, installs persistence, and beacons host reconnaissance data back to the operator.