In this article 5 sections

Cursor says a malicious copy of Anthropic’s Claude Code extension was available in its VS Code Extension Marketplace for about 11 hours on October 29. Versions 2.1.312 and 2.1.313 for macOS and Windows may have reached up to 5,000 users. Cursor says Anthropic did not build the packages and that the official distribution was not affected. (Cursor)

The injected JavaScript ran when the extension module loaded. It collected host details, appended an attacker-controlled SSH key, attempted to enable SSH and establish a reverse tunnel, wrote persistence mechanisms, and tried to report reconnaissance to the operator. Microsoft independently analyzed the loader and confirmed that sequence. It also emphasized an important qualification: code capability is not proof that every stage succeeded on every host. (Microsoft Security)

That qualification does not make the incident a failed attack. Cursor says SSH enablement usually failed because the extension lacked administrator rights, but the attacker key, persistence scripts, and host reporting could still land. Expel investigated four customer incidents and found that one Mac first showed malicious activity about eight hours after Cursor’s stated exposure window closed. A search bounded only to the marketplace window can therefore miss delayed execution. (Expel)

Treat an IDE extension as a production credential

The immediate response is concrete. Inventory installations of the two versions from Cursor’s marketplace, preserve endpoint and network evidence, isolate hosts with execution artifacts, remove the key and persistence mechanisms, and rotate credentials or revoke sessions reachable from affected machines. Do this from a trusted system. Uninstalling the extension does not remove the standalone artifacts it created.

The architecture lesson is broader. An IDE extension inherits the developer’s local authority. That can include source trees, Git credentials, cloud sessions, package registries, signing material, internal documentation, and terminals that bridge into production. The extension marketplace is therefore part of the software supply chain, not a convenience catalog outside it.

Build the control plane around four separate identities:

  1. Publisher identity: who is allowed to publish under a namespace.
  2. Artifact identity: the exact package digest, signature, and build provenance.
  3. Install identity: which endpoint installed which artifact from which registry at what time.
  4. Execution identity: which processes, files, network flows, and credentials the extension touched after installation.

Allowlisting the extension name covers none of those identities by itself. Pin digest or version where the ecosystem permits it, retain a package copy for later analysis, alert on publisher or signing-key changes, and preserve marketplace origin in endpoint telemetry. Stage automatic updates through a small canary cohort. A new version should have to prove that it is the expected artifact before it receives the full authority of a developer workstation.

Detection also needs a time axis. Query both installation events and subsequent execution. Look for the published indicators, but do not reduce the investigation to one key label or IP address. Search for unexpected changes to authorized_keys, new launch agents or scheduled tasks, SSH service changes, reverse-tunnel processes, and outbound connections from editor child processes. The useful denominator is not downloads. It is affected endpoints for which installation, execution, persistence, credential exposure, and remediation status can each be resolved.

Application watch: long-horizon agents need responsibility state

Arca’s lead AI engineer described wealth-management workflows that can span up to ten days without running continuously. The work stops for human decisions, moves between actors, and resumes later. Arca’s memory layer records what happened, what is due next, what belongs on the longer horizon, and who owns each action. Agents propose analysis, while human advisers retain authority over trades and money movement. (Latent Space)

This is a more useful model of persistence than replaying a chat transcript. A durable task record should separate facts, proposed actions, approvals, owners, deadlines, and completed effects. Each field needs provenance and a revision history. Resumption should begin from an explicit state transition, not from a model’s reconstruction of what a long conversation probably meant.

Arca also describes a narrow data boundary. Agent-written code runs in a computational sandbox, but code that needs company data is translated into a strict expected format. The original code is discarded, and the structured request is checked before it reaches the backend. That resembles a compiler from an expressive planning language into a smaller declarative capability language.

The account is a first-hand company interview, not an independent outcome study. It provides no task denominator, error rate, or client-level comparison group. The design is still worth testing because it makes two boundaries inspectable: responsibility survives handoffs, and flexible code does not receive ambient data authority.

Architecture watch: GA does not move execution into the model

Google made Gemini Computer Use generally available on October 30 across its Interactions and GenerateContent APIs. (Gemini API changelog) The model returns UI actions, but the application supplies the browser, mobile, or desktop environment and executes those actions. Google’s documentation says a response can require confirmation, which the client must show to the user and acknowledge before continuing. Screenshot prompt-injection detection is available, but it is opt-in and defaults to false. (Gemini Computer Use)

That means the production boundary remains in client code. A deployment needs an action interpreter, a policy engine, a confirmation surface, an isolated execution environment, and evidence that binds every effect to the model request and user decision that authorized it. Treat the model’s intent field as diagnostic context, not authorization. Confirmation should be derived from the proposed effect and current policy, not merely from whether the model requested a prompt.

Start with a deny-by-default action set. Separate navigation and reading from communications, data modification, account changes, and transactions. Require a fresh confirmation for the final irreversible action, after the user can see the exact target and payload. Enable injection detection, but assume it is one detector in a larger control system. It does not replace origin boundaries, allowlists, taint tracking for untrusted page content, or postcondition checks.

Stay Sharp: sign the artifact, test the served behavior

Arize reproduced activation steering on Qwen3.5-4B and linked a larger independent reproduction with 2,016 outputs. At quarter strength, harmful endorsement rose from 3.1% to 46.9% while task accuracy fell from 56.3% to 40.6%. The post also points to an earlier preprint across seven Qwen3 and Llama-3.1 models. Its anchor variant bypassed refusal on 90.4% of JailbreakBench prompts while MMLU fell 0.6 percentage points and GSM8K fell 0.1 points. The preprint used model-based safety judgments and has no human rater validation, so those numbers are evidence of a mechanism, not a production incident rate. (Arize) (preprint)

The operational lesson is not that one named neuron explains safety. The larger reproduction found that a random pair could match the viral steering recipe, which weakens any claim about uniquely malicious neurons. The stronger lesson is that a model can retain enough ordinary capability to pass shallow smoke tests while a runtime intervention changes refusal behavior.

An AI SBOM and signature can establish which weight file or adapter was approved. They do not prove that the inference server loaded only those artifacts or that runtime hooks left behavior unchanged. Record an attestation over the exact weights, adapters, tokenizer, inference image, launch arguments, and policy configuration. Then run a small behavioral challenge set through the served endpoint after deployment. Compare safety, capability, and refusal distributions with the approved baseline. Artifact identity and behavioral identity should fail the same release gate.

Watch next

  • Cursor’s explanation of how an attacker published under the Anthropic namespace, plus evidence supporting the claim that no other extensions were modified.
  • Fleet-level counts for installation, payload execution, successful persistence, credential exposure, and rebuilt hosts. A download estimate cannot answer those questions.
  • Whether Computer Use clients enable screenshot injection detection and implement confirmation faithfully, rather than treating general availability as a complete safety boundary.
  • Adoption of the October 30 Internet-Draft for __usage_ai-training in robots.txt. It is a training preference signal, not a crawler-access rule, and it has no RFC standing yet. (Internet-Draft)
  • Reproduction of served-model behavioral attestation across quantized weights, adapters, speculative decoding, and heterogeneous inference backends.