This is the workflow I recommend now. It's built from free tools, and it has four steps:

1. Capture: get all your material into one place.
2. Summarise: turn it into short notes you can actually read.
3. Active recall: test yourself instead of re-reading.
4. Spaced review: come back to the hard parts at the right time.

AI helps with steps 1–3. Step 4 is where you do the remembering.

Step 1: Capture everything in one notebook

I use Gemini Notebook for this. Until July it was called NotebookLM; Google renamed it on July 16, 2026, and it's the same standalone product, now also available inside the Gemini app.

Create one notebook per subject (or per unit) and add your sources. It accepts a lot of formats:

• PDF, Word (docx), PowerPoint (pptx), text and Markdown files
• Google Docs and Slides
• web URLs
• public YouTube videos that have captions (it imports the transcript)
• audio files, which it transcribes on import (Sinhala and Tamil are both on the supported list)

Free users can add up to 50 sources per notebook, and each source can be up to 500,000 words or 200 MB.

Tip: one notebook per unit works better than one giant notebook for the whole year. Answers stay focused, and it's easier to see what's missing.

Step 2: Summarise, but ask specific questions

Each source gets an automatic summary in the Source Guide. That's a good start, but the real value comes from asking narrow questions in the chat, for example:

• "List the 10 key definitions in the 'Unit 3 lecture' source."
• "Explain the difference between X and Y using only my sources."
• "What topics in this unit appear in more than one source?"

Because the answers are grounded in your own files, you can check every claim against the page it came from. Do that. AI summaries can miss things or get them wrong, and your exam is based on your syllabus, not on what the model thinks is important.

Write the final short notes yourself, even if you copy most of the structure from the chat. Rewriting is part of learning.

If you study in Sinhala or Tamil: this is a gap I kept running into with my own students, so my team and I built shortme.lk. You upload a lecture PDF and get short notes (or a practice question paper) in English, Sinhala or Tamil. The free plan covers 3 AI documents a day, up to 10 pages per PDF. Use whichever tool fits your language. The workflow is the same.

Step 3: Active recall with flashcards and quizzes

Reading your notes tells you what's on the page. Testing yourself tells you what's in your head. That's the whole idea of active recall.

In Gemini Notebook, open the Studio panel and choose Flashcards or Quizzes. Before generating, you can:

• pick the difficulty (easy, medium or hard)
• add a prompt, e.g. "focus on definitions and formulas from Unit 3"

While you study, you can mark each card "Got it!" or "Missed it!", ask for an explanation, and at the end practise again with only the cards you missed. Quizzes give you hints and explanations too.

Then do one more thing: download the flashcards as a CSV file. That's the bridge to step 4.

Step 4: Spaced review in Anki

Anki is a free, open-source flashcard program. When you review a card, you rate how well you remembered it, and Anki schedules the next review for around the time you're most likely to forget it. Easy cards come back rarely and hard cards come back often.

• The desktop app (Windows, macOS, Linux) is free.
• AnkiDroid for Android is free.
• AnkiMobile for iOS is a paid app (the purchase funds Anki's development).
• AnkiWeb sync between devices is free.

Anki can import any plain-text file where fields are separated by commas, semicolons or tabs, as long as it's saved as UTF-8. So the flashcard CSV from step 3 goes straight in: File → Import, choose the CSV, map the columns to Front and Back, and pick a deck.

Tip: don't import 300 cards the night before an exam. Import a unit at a time, and do your reviews every day, even if it's only 15 minutes on the bus.

The weekly routine I suggest

A few honest warnings

• Check everything against your textbook or lecturer's notes. AI tools make mistakes, especially with local syllabus content and non-English terms.
• Only upload material you're allowed to use. Google's own help page says to avoid uploading documents you don't have rights to.
• The tools are the easy part. The improvement comes from testing yourself and reviewing regularly, not from having the perfect app.

If you try this, I'd like to know which step you skip most often. For most of my students it's step 4.

— KD Jayakody

Here is what happened, what the official advice is, and the simple habits I'm asking my students to build.

What happened

On October 29, 2026, Cursor published a security notice. For a few hours that day, from about 2:27am to 1:35pm Pacific Time, a maliciously modified version of the Claude Code extension (Anthropic.claude-code, versions 2.1.312 and 2.1.313, for Windows and macOS) was available in the Cursor VS Code Extension Marketplace.

Those versions were not developed by Anthropic. According to Cursor, the modified extension ran code that attempted to install a persistent SSH backdoor. In plain words, it tried to add an attacker's SSH key to the computer, open a remote tunnel, and set itself up to keep running in the background.

Cursor says it removed the malicious version, shut down and rebuilt the marketplace as a precaution, and worked with the hosting provider to take the attacker's server offline.

The next day, Microsoft published its own analysis. Microsoft confirmed that the malicious packages were never published or distributed through the official Visual Studio Marketplace or through the npm package @anthropic-ai/claude-code. Those were not affected. All the evidence they had pointed to the incident being limited to the Cursor marketplace.

So this was a specific problem, in a specific place, for a specific window of time. That matters. It's not a reason to stop using AI tools or extensions. It's a reason to check, clean up if needed, and learn from it.

If this could affect you

The official advice applies if you installed or updated Anthropic.claude-code to 2.1.312 or 2.1.313 from the Cursor marketplace, on macOS or Windows, during that window on October 29.

If that's you, here is the short version of what Cursor recommends:

1. Run the check provided in Cursor's security notice to see whether you are impacted.
2. If you are, remove the unauthorized SSH key, the persistence it set up, and any running tunnel processes. Cursor provides remediation scripts for this.
3. Rotate credentials and sessions that were accessible from that machine, and do it from a trusted system.

One point I want beginners to really notice: uninstalling the extension may not be enough. Cursor explains that the payload drops separate scripts that keep running. So please don't just remove the extension and move on. Run the check.

If you're in Sri Lanka like me, remember the window was in Pacific Time. For us that's roughly from the afternoon of October 29 to early morning on October 30.

I'm not going to repeat the technical details here. Please read the official notices directly. They are linked at the end.

Habits worth building anyway

Even if you were not affected, this is a good moment to set up a few simple habits. None of these are claims about this incident. They're just good practice that I try to follow myself.

Check the publisher and version before you install. Take five seconds to look at who published an extension and what version you're getting. It's a small habit, but it makes you pay attention.

Keep fewer extensions. Every extension is code running inside your editor. If you installed something for one project months ago and never used it again, remove it. Fewer extensions means less risk.

If auto-update is on, keep an eye on security news. Auto-update is convenient, and I'm not telling you to turn it off. Just know that updates can come in without you doing anything, so it helps to follow the official blogs of the tools you rely on.

Rotate keys when in doubt. SSH keys, API keys, tokens in your .env files. If you ever suspect a machine was exposed, rotating them is a calm, sensible step, not a panic move.

Separate important work. For serious projects, consider a separate user account or a separate machine. That way, one bad install has less to reach.

Why I'm sharing this calmly

When news like this comes out, it's easy to make it sound scary. I don't want to do that. AI tools are not the enemy. They're tools, and like any tool, we get the most out of them when we use them with a bit of care.

What I liked here is that the official notices were clear: what happened, who was affected, and what to do. That's the kind of information beginners need. Not fear, just steps.

So if you use Cursor, take two minutes and check. If you teach or mentor others, share the official advice with them. And whatever editor you use, build the small habits now, while things are calm.

Learn safely, build boldly.

— KD Jayakody

Sources: Cursor security notice (Oct 29, 2026): https://cursor.com/blog/claude-code-extension-security-notice

Microsoft Security Blog (Oct 30, 2026): https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/

1. 21st.dev

What it is: A large library of React + Tailwind CSS components, templates and shadcn themes made by design engineers, with a CLI (npx @21st-dev/cli add) and an MCP server so your AI agent can find and install components. Use it when: You want polished, real-world sections (heroes, AI chat UIs, pricing, sign-ins) and you're working with Cursor, Claude Code or another MCP client. Free vs paid: A free account can copy 2 components a day. Paid plans remove the limit.

2. React Bits (reactbits.dev)

What it is: Free animated React components: text animations, backgrounds and micro-interactions. Pick JavaScript or TypeScript, with plain CSS or Tailwind, then copy the source or install it with the CLI. Use it when: Your UI works but feels flat and you want a bit of motion that you fully own and can tweak. Free vs paid: The main library is free. React Bits Pro (pro.reactbits.dev) is a paid one-time purchase that adds blocks, app UI and templates.

3. Magic UI (magicui.design)

What it is: 150+ free, open-source animated components built with React, TypeScript, Tailwind CSS and Motion, designed as a companion to shadcn/ui. Use it when: You're building a landing page and already use shadcn/ui. Free vs paid: The components are free. Magic UI Pro (pro.magicui.design) sells landing-page templates and sections for a one-time fee.

4. Uiverse (uiverse.io)

What it is: A community-made, open-source library of UI elements such as buttons, cards, loaders and inputs. Copy them as HTML/CSS, Tailwind, React or Figma. Use it when: You need one small element that looks hand-made, even without React. Free vs paid: The site says it's 100% free for personal and commercial use.

5. Mobbin (mobbin.com)

What it is: Not a component library. It's a UI/UX reference library of screens from real, shipped mobile and web apps. Use it when: You need to see how real products design onboarding, paywalls or settings before you prompt your AI. Free vs paid: Joining is free, with limited access to apps and sites. Flows, animations and search need a paid plan, and there's a student/educator discount.

Quick tip

Don't ask your AI for "a modern UI". Pick one real reference screen from Mobbin, choose one component library (mixing five libraries is how apps start looking generic), and give the AI your brand colours, font and spacing scale. Consistency is what makes an app look designed.

What's on your list? Drop it in the comments.

— KD Jayakody