A tampered Claude Code extension and nine breached platforms: October's attacks went after the agent toolchain
On October 29, for about eleven hours, anyone who installed or updated the Claude Code extension through Cursor's extension marketplace could have received a tampered build. Cursor says versions 2.1.312 and 2.1.313 were live from roughly 2:27am to 1:35pm Pacific on Windows and macOS, that the code tried to set up persistent remote access, and that at most 5,000 users were affected. Cursor took the whole marketplace down, worked with providers to neutralize the attacker's server, and asked everyone to move to 2.1.314. Uninstalling alone is not enough: Cursor published check and cleanup steps.
Who let it in is disputed. Felix Rieseberg of Anthropic says "it wasn't a compromise of Anthropic's systems or employee laptops. A malicious actor used access to Cursor's marketplace to publish a tampered copy," and that official channels are unaffected. An independent write-up by Phorion, revised twice, reads the evidence differently on how the publish happened. Neither company has explained the access path yet. What is not in dispute: the extension runs inside the editor with the developer's own permissions, which is exactly what makes a coding agent useful and exactly what an attacker wants.
The next day Wiz published "Black October," which puts this in context. At least nine AI developer platforms disclosed incidents in October: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. Fireworks, OpenCode and Warp reported signs of an "agent swarm" attack, and the common target was stored environment variables, above all AI API keys. Wiz followed two stolen cloud keys downstream. Both were first tested within 30 minutes of the vendor breach. One key, allowed to route through global cross-region profiles, ran about 800,000 model calls in 30 hours with roughly 90% succeeding. The other, restricted to a single region, stalled the abusers for hours until they found the model IDs that worked. Northflank's status page tells customers to "assume all environment variables have been compromised."
The lesson is plain. Agent tooling is now worth attacking for two reasons: it runs with your permissions, and it holds the keys that pay for models. The defenses are plain too. Pin and verify extension versions instead of trusting a mirror. Keep model keys out of platform environment variables where you can. Scope every key to the regions and models you actually use, because in Wiz's data that single restriction was the difference between a bad night and a costly one.
Cursor notice: https://cursor.com/blog/claude-code-extension-security-notice Phorion analysis: https://phorion.io/blog/offical-claude-code-vsx-compromise/ Wiz: https://www.wiz.io/blog/black-october-for-ai-developer-platforms
← Back to all articles
Who let it in is disputed. Felix Rieseberg of Anthropic says "it wasn't a compromise of Anthropic's systems or employee laptops. A malicious actor used access to Cursor's marketplace to publish a tampered copy," and that official channels are unaffected. An independent write-up by Phorion, revised twice, reads the evidence differently on how the publish happened. Neither company has explained the access path yet. What is not in dispute: the extension runs inside the editor with the developer's own permissions, which is exactly what makes a coding agent useful and exactly what an attacker wants.
The next day Wiz published "Black October," which puts this in context. At least nine AI developer platforms disclosed incidents in October: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. Fireworks, OpenCode and Warp reported signs of an "agent swarm" attack, and the common target was stored environment variables, above all AI API keys. Wiz followed two stolen cloud keys downstream. Both were first tested within 30 minutes of the vendor breach. One key, allowed to route through global cross-region profiles, ran about 800,000 model calls in 30 hours with roughly 90% succeeding. The other, restricted to a single region, stalled the abusers for hours until they found the model IDs that worked. Northflank's status page tells customers to "assume all environment variables have been compromised."
The lesson is plain. Agent tooling is now worth attacking for two reasons: it runs with your permissions, and it holds the keys that pay for models. The defenses are plain too. Pin and verify extension versions instead of trusting a mirror. Keep model keys out of platform environment variables where you can. Scope every key to the regions and models you actually use, because in Wiz's data that single restriction was the difference between a bad night and a costly one.
Cursor notice: https://cursor.com/blog/claude-code-extension-security-notice Phorion analysis: https://phorion.io/blog/offical-claude-code-vsx-compromise/ Wiz: https://www.wiz.io/blog/black-october-for-ai-developer-platforms
Comments