Cursor pulls backdoored Claude Code extension, Google finds attackers using AI agent frameworks, and more - Cybersecurity AI Weekly #78

In this edition, covering 25 October to 1 November:

• Cursor removed a version of Anthropic's Claude Code extension from its marketplace after finding code that tried to install a persistent SSH backdoor; up to 5,000 users may have been affected.
• Google Threat Intelligence Group and Mandiant report that financially motivated and suspected espionage actors are using ARTEX and other agentic frameworks in intrusions in the United States, Europe and Asia.
• Anthropic says an unreleased internal model found and chained flaws in Chrome, Safari, Android, Windows and Linux into proof of concept exploits.

This spot is open for 2027. One company puts its name on every Cybersecurity AI Weekly, which has 1,100+ subscribers. See what's included

Anthropic

Anthropic says an unreleased internal AI model found security flaws in Chrome, Safari, Android, Windows and Linux and chained them into proof of concept exploits. The flaws were tested in laboratories, reported to vendors and patched; Anthropic did not disclose how much human help the model received. Exploit chains

Researchers at Cathedral, a start up founded by former DOGE staff, used AI agents to reach Anthropic meeting transcripts, salary details and Slack messages in under 12 hours under Anthropic's security testing program, The Washington Post reported. Anthropic confirmed limited access to sales, HR and IT systems and briefed federal officials. Cathedral

Anthropic introduced self assessment, in which Claude reviews each conversation after responding and flags potentially harmful activity. On Claude Fable 5 it identified 78% of potentially harmful conversations and 94% of high priority cases found by a stronger classifier, with a 1% false positive rate, and Anthropic says it adds less than 2% to inference compute. Anthropic's IPO filing shows it spent $2.75 million protecting CEO Dario Amodei in 2025 and $1.29 million on security for president Daniela Amodei, and discloses multiple threats against executives and employees. Self assessment · Security costs

Supply chain and AI platforms

Cursor removed version 2.1.313 of Anthropic's Claude Code extension from its VS Code Marketplace after finding code that collected host details and tried to install a persistent SSH backdoor. Up to 5,000 users may have been affected. Cursor shut down and rebuilt the marketplace, took the attacker's server offline and says no other extensions were tampered with. Cursor

Pluto Security reports that an operator used 28 Hugging Face repositories and a ModelScope mirror to spread cryptocurrency miners and backdoors disguised as Qwen2 models, with more than 21,000 downloads by 25 October. After Hugging Face and ModelScope removed the first repositories, the campaign came back under new accounts, with 31 repositories across seven accounts, 19 of them uploaded within days. Check Point Research found Yoba malware spread through fake GitHub repositories and download pages for ChatGPT and Claude, sideloaded next to signed OpenAI and Anthropic executables to install an XMRig miner. Hugging Face · Resurfaced · Yoba

Symantec says an unauthorized relay service installs genuine OpenAI Codex and Claude Code tools at organizations mainly in mainland China, and also in South Korea, Taiwan and Malaysia, routing requests through its own servers, disabling security sandboxes and replacing user credentials with its own tokens. Symantec has seen no malicious activity, but the setup could expose prompts, files and secrets to the relay operators. Relay service

Cloud hosting platform Northflank told customers to rotate all secrets after a breach flagged by Wiz on 30 October, and later said users reported unauthorised use of AI API keys stored on the platform. Wiz counts at least nine AI developer platforms that disclosed security incidents in October. Cloudflare disclosed that 155 responses from its GLM-5.3 Workers AI model between 27 August and 9 September contained data from other customers' requests, caused by a KV cache misconfiguration and an SGLang bug; it found no deliberate exploitation. Northflank · Cloudflare

Attacks using AI

Google Threat Intelligence Group and Mandiant report that financially motivated and suspected cyber espionage actors are using ARTEX, PentAGI, CAIRN and other agentic frameworks for reconnaissance, lateral movement, privilege escalation and preparing exfiltration, sometimes moving from account compromise to deep system access within minutes or hours. Trend Micro details three attacks on organizations in Japan, one of them using CyberStrikeAI and 44 agents for reconnaissance, exploitation, persistence, data theft and reporting. Google · Trend Micro

Seoul police arrested seven people accused of using generative AI to hack about 90 Korean organizations, steal 8.2 million records and demand 360 million won from 38 of them. SOCRadar found that the n0n ransomware group, which targeted 23 organizations in 14 countries, spent more than $7,216 on AI services and left a server exposed with attack scripts, ransomware code and hardcoded encryption keys. South Korea · n0n

Cisco Talos identified Volta-Autodoxer, an infostealer that sends stolen victim data to commercial AI models through OpenRouter to profile victims; Talos has not confirmed its use in real attacks. Talos also reports NIK C2, a Windows command and control framework seen in the wild that uses the OpenAI Chat Completions API to analyze stolen data. Cequence tracked one actor posing as about 32 AI bots from OpenAI, Anthropic, Meta, Perplexity and others to request files with passwords and cloud credentials, and Cofense says fake invitations to a private Anthropic AI preview have been used since September to steal Google and Microsoft logins. Volta-Autodoxer · NIK C2 · Cequence · Cofense

Models tested for attacks

Z.AI's open weight GLM-5.3 completed three of 13 multi stage cyberattack scenarios in tests by Irregular and did not refuse any offensive tasks, Reuters reports. Epoch AI found the model could use public Firefox security fixes to build webpages that read and exfiltrated files from visitors' computers, compromising Firefox versions released from 17 September to 26 October at about $1,000 per version; Mozilla released Firefox 159.0 on 27 October to patch an additional flaw found during the tests. Irregular · Epoch AI

Palisade Research found that several Alibaba Qwen 3.8 models sometimes routed web requests through Alibaba Cloud proxy servers; it found no signs of data theft but warns the proxy could log requests or deliver prompt injections. Eclypsium showed that attackers with access to certain NVIDIA data center hardware could change memory and model weights so chatbots give altered answers; NVIDIA says memory access protections can block the attack. Google DeepMind announced Gemini 4 Carbon, which it says leads cybersecurity benchmarks and goes first to cyber defenders and trusted partners. Qwen proxies · Eclypsium · Gemini 4 Carbon

AI that finds vulnerabilities

Causal Security's Cipher agent found four previously unknown vulnerabilities in EPICS Base, software used in particle accelerator and fusion research facilities, in three hours and 49 minutes; one is critical and could allow remote code execution, and EPICS Base 7.0.11 fixes them. Oracle launched AI Security Mesh, which uses OpenAI cyber models to find, investigate and fix vulnerabilities across on premises systems and clouds, and Orange Cyberdefense gets early access to a security variant of Mistral Large 4 as Mistral AI's first European MSSP design partner. Veracode says the average security pass rate for AI generated code rose from 56% to 62%, with Claude Opus 5.5 and GPT-6-Sol tied at the top at 73%. EPICS · Oracle · Orange and Mistral · Veracode

Securing AI agents

Cisco open sourced Project Quarry, a rule language and detection engine that analyzes whole AI agent sessions, including tool calls and MCP interactions, for multi step attacks. Reco describes a risk it calls Confused Trigger, in which unauthenticated forms, emails or low privilege API requests make AI agents run with elevated identities; in tests with Salesforce and ServiceNow, agents could reach or change data this way. Canada's RBC is blocking third party personal AI agents from online banking, and TD, CIBC and Bank of Montreal said they also block such access. Project Quarry · Reco · RBC

Governments

Virginia Gov. Abigail Spanberger ordered a statewide cybersecurity strategy and a Cyber Consortium to address AI risks, after AI agents submitted unauthorized Freedom of Information Act requests through a state education portal. The European Cybersecurity Competence Centre launched a €42 million cluster of three Horizon Europe projects with more than 70 partners in 14 EU member states and the UK, developing generative AI tools for threat intelligence, incident response and critical infrastructure defence over 36 months. Virginia · ECCC

Funding

Infisical raised $40 million in a Series B led by Elad Gil at a $600 million valuation to help enterprises control AI agents' access to sensitive systems. Northstar Security came out of stealth with $7 million in seed funding led by Wing Venture Capital, and AvalonX launched a continuous AI penetration testing platform for small and midsize businesses, backed by up to $10 million from Ridown Capital. Infisical · Northstar · AvalonX

Also

Check Point launched the Maestro Hyperscale Orchestrator MHO 200, with up to 12.8 Tbps of fabric capacity and inspection of encrypted AI traffic. US intelligence agencies reportedly surveilled Alice Huang, an executive at Nvidia customer Megaspeed, over suspected ties to China, The New York Times reports citing anonymous sources; Nvidia denied the concerns. Check Point · Megaspeed