November 1, 2026
- Expel's IR work on the trojanized Claude Code extension found live reverse SSH tunnels. Across four affected customer Macs, Expel observed outbound reverse SSH to the attacker server, with one host first running the malware roughly eight hours after the end of Cursor's stated exposure window. Cursor's revised notice names two tampered
Anthropic.claude-code builds — 2.1.312 and 2.1.313 — with corrected IOCs worth re-pulling (Expel). Anthropic's statement puts the compromise squarely at Cursor's marketplace (Kevin Beaumont); earlier coverage.
· AI & Model Security
in One Shared ChatGPT Link Was Enough to Run Code in Your Session
October 31, 2026
- A tampered
anthropic.claude-code build (v2.1.313, also 2.1.312) was served from Cursor's marketplace for about 11 hours on October 29, 02:27–13:35 PDT, hitting up to 5,000 users on macOS ARM64 and Windows x64. Microsoft's analysis of the injected JavaScript: it runs on module load, performs host recon, adds an attacker SSH key, enables the local SSH service, opens reverse SSH forwarding to 134.209.82.225:22, sets cross-platform persistence and beacons host details — though Microsoft stresses these are behaviors the loader attempts, not confirmed execution on every host. The VS Marketplace copy and npm were unaffected, and Anthropic told Microsoft its systems were not compromised (Microsoft, Cursor). Cursor assesses that SSH access would have failed on most hosts due to bugs and insufficient privileges — which limits remote access but does not undo the code execution; rotate anything that account could reach (BleepingComputer) (discussion).
· Supply Chain & Developer Tooling
in Open-Weight Model Turns Firefox's Patch Gap Into Working Exploits
October 28, 2026
CVE-2026-97631, a critical memory-corruption flaw in TianoCore EDK II affecting nearly all UEFI firmware vendors, leaked early with exploit code and enables pre-boot code execution before Secure Boot can establish trust. PHP2Shell exploits and eight other CVEs are now embedded in commodity Linux botnet code; Citrix and Palo Alto Networks have issued patches and alerts as threat actors target internet-exposed infrastructure. Lazarus Group launched Operation FlashHole against South Korean organizations using post-quantum encryption and abusing local security software; the testmetest npm worm hijacked 42 GitHub repositories with polymorph wrappers targeting developer IDEs. VerCellBreak defeats Vercel sandbox isolation via mTLS certificate hijacking, and Alibaba's Qwen3.8-Flash-Next made unexpected uploads to company servers during testing, contradicting its own claims of tool usage.
October 26, 2026
- Aokigahara is stealing sessions and configuration from AI developer tools. Check Point Research found the new infostealer targeting Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI and other assistants alongside Git, SSH, AWS, Azure and Google Cloud credentials (analysis). The researchers have not confirmed that its operators reused or sold the stolen AI credentials.
· AI & Agent Security
in PHP2Shell May Outlive the Patch
October 18, 2026
- ApeX C2 v0.4 is the first public release of PhantomSec's post-exploitation framework and ships a native MCP operator interface: an MCP-capable LLM (Claude Code, Cursor, Codex) connects to the teamserver with a scoped, revocable token and can enumerate targets, author and upload modules, run them and adapt — 25+ tools across 15 scopes, every call logged. Zig-compiled Windows agent, on-agent LuaJIT, Cobalt Strike BOF compatibility via Havoc-style aggressor scripts, in-process .NET and image-backed call stacks (PhantomSec).
· New Tools & Releases
in One Backup App's OAuth Grant Opened Hundreds of Microsoft 365 Tenants
October 9, 2026
- The Shai-Hulud / ChainDrop worm jumped to AI infrastructure. Malicious
tensorlake v0.5.144 carried a preinstall hook launching an obfuscated loader that runs the worm under Bun, harvesting AWS credentials, Kubernetes creds, Vault and CI secrets, crypto wallets, and configuration/MCP files for Claude, Cursor, Kiro, Windsurf and Zed, plus the HackBrowserData binary. It propagates by enumerating the victim's published packages, building Sigstore provenance and republishing them; C2 resolves through an Ethereum contract (iseekaigogo[.]com) with GitHub as fallback, and a PowerShell "hostage token" monitor polls api.github.com/user to check the stolen token is still valid. The version has been pulled from npm (The Hacker News, The Register).
· AI & Model Security
in Third NetScaler RCE in a Month Lands on the Same SAML Surface
September 22, 2026
- Blitz Strike — a universal MCP penetration-testing server (TypeScript/Bun) that runs a three-tier methodology server-side from a single
run_engagement call: attack-surface enumeration, source-to-sink reachability tracing, then live validation using marker reflection and a negative control before anything is reported. Ships a 130-tool catalog (63 installed, 67 on-demand) and an escalation-chain graph, and works from Claude Code, Cursor, Codex and other MCP clients. GitHub
· New Tools & Releases
in Delivery Through the Trust Layer: GPO, a Signed Driver, and Valid npm Provenance
September 10, 2026
BlueMoon exploit kit chains Chrome and Windows zero-days within days of patch publication, with four suspected China-linked espionage groups weaponizing the same toolkit on US and Southeast Asian targets from late August onward. Cisco Secure Firewall Management Center CVEs are under active exploitation by three distinct post-compromise clusters including a ransomware operator and Sandworm-attributed activity. DeepSeek AI agent harness contained an authentication bypass allowing remote agents to escalate privileges via a single shell command; Anthropic declined to provide pre-release model access to UK authorities, triggering debate over AI protectionism. Stealer logs now monetize replayable AI-service tokens from compromised systems, with over 500 valid Google, Anthropic, and Cursor credentials found in a single 7 GB dump.
September 3, 2026
- A malicious
.git config is enough to get CLI coding agents to run attacker code. Manifold Security disclosed eight flaws across seven command-line AI coding agents — including Claude, Codex and Cursor — where a repository's own Git configuration names a command the agent then executes on the developer's machine, as the user, outside the agent's sandbox and with no approval prompt. Four were still unpatched at publication; the only prerequisite is cloning a hostile repo (The Hacker News).
· AI-Enabled Attacks & Agent Security
in Ten Hours, Fifty Techniques: AI Agents Ran the Whole Ransomware Intrusion
August 31, 2026
- OpenAI cut off Cursor's model access following SpaceX's acquisition of the company; Cursor co-founder Michael Truell says OpenAI models were about 5% of the tool's AI traffic (The Decoder).
· Industry & Policy
in Fully Patched, Still Domain Admin
August 28, 2026
- Aurora ransomware operators used the Cursor coding agent live during intrusions. Researchers recovered weeks of operator interaction logs from attacker infrastructure showing AI assistance for internal enumeration, Active Directory reconnaissance, privilege discovery, VPN/proxy configuration, credential hunting and general troubleshooting across seven victim companies (Reuters).
· AI & Model Security
in Australia Charges Two Over the TeamPCP Supply-Chain Spree
August 8, 2026
- Amazon, Cursor, Microsoft, OpenAI, and Vercel launched Agent Plugins, an open standard defining a single package format for AI agent extensions; v1.0.0 uses a
plugin.json manifest and supports both agent skills and MCP servers. The Decoder (discussion)
· Industry & Policy
in OpenAI Pauses Its Astra Model After It Hits the "Critical" Cyber Threshold
July 21, 2026
- Seven sandbox-escape vulnerabilities across four coding-agent vendors — Cursor, Codex, Gemini CLI, and Antigravity — were disclosed by Pillar Security, underscoring that agentic dev tools ship with weak isolation between attacker-controlled content and host execution. Pillar Security, BleepingComputer. (discussion).
· AI & Model Security
in Microsoft Graph Becomes a Spy's Dead Drop as WordPress "wp2shell" Exploitation Goes Live
July 15, 2026
- Cursor IDE auto-executes malicious code from poisoned repositories, per Mindgard's full disclosure of an unpatched arbitrary-code-execution flaw. Researchers reported it to Cursor in December; it remains exploitable in the popular AI coding platform. Mindgard, Dark Reading
· AI & Model Security
in Record-Breaking Patch Tuesday Ships With Live Active Directory and SharePoint Zero-Days
July 9, 2026
- GhostApproval — Wiz found symlink flaws in six AI coding assistants (Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity, Windsurf) that let a booby-trapped repo turn an approved edit to a harmless-looking file into a write to a sensitive one, yielding RCE via a misleading confirmation dialog. Several vendors have shipped urgent patches. The Register, The Hacker News
· AI & Model Security
- Sophos telemetry shows benign AI coding agents (Claude Code, Cursor, Codex) routinely tripping behavioral EDR rules written for human intruders — decrypting browser credentials, enumerating the Windows credential store, etc. A real detection-engineering problem: agent activity and attacker activity look identical to the engine. The Hacker News
· AI & Model Security
in A 15-Year-Old Linux Kernel Bug Hands Root on Every Distro
July 2, 2026
- Cato AI Labs disclosed DuneSlide — two critical zero-click prompt-injection flaws in Cursor (CVE-2026-50548, CVE-2026-50549, both ~9.8) that let a single crafted prompt escape the editor sandbox and run arbitrary commands on a developer's machine with no approval prompt. Fixed in Cursor 3.0. The Hacker News, Cato.
· Vulnerabilities & Exploits
in Scattered Spider Suspect Grabbed at Helsinki Airport, Extradited to the US