Two AI incidents, one trust problem
The latest security lesson from AI tooling is not that developers should stop using assistants. It is that the trust model around assistants is lagging behind their access model. Cursor disclosed that malicious versions 2.1.312 and 2.1.313 of Anthropic.claude-code were available in its VS Code Extension Marketplace for Windows and macOS on October 29, 2026, between about 2:27 a.m. and 1:35 p.m. Pacific time . In parallel, researchers at Parameter disclosed a ChatGPT shared-link vulnerability that let attacker-controlled JavaScript run in a victim’s signed-in ChatGPT session and read private conversations; OpenAI fixed it on October 26 and classified the report as P1 .
The two cases are technically different. One is a software-supply-chain compromise in an editor extension. The other is a browser-session isolation failure in a conversational web interface. But they converge on the same governance gap: AI tools are often treated as trusted productivity software while operating in places where trust should be narrow, monitored and constantly revalidated.
What happened in Cursor
Cursor’s own notice says the malicious Claude Code builds were not developed by Anthropic and were limited to a specific extension in the Cursor VS Code Extension Marketplace . The tampered extension attempted to install a persistent SSH backdoor, collect host and user information, add an attacker-controlled SSH key to authorized_keys, enable local SSH service and open a reverse SSH tunnel . It also attempted persistence through a macOS LaunchAgent or a Windows scheduled task with a startup-script fallback, retrying the tunnel roughly every 60 seconds .
Microsoft’s analysis confirmed that the injected JavaScript ran before the extension’s expected code, using Node.js APIs to collect host data, alter files and execute operating-system commands . Microsoft also said the malicious packages were not published or distributed from the Microsoft Visual Studio Marketplace or npm package channel, and that Anthropic confirmed to Microsoft that its systems were not compromised and it did not develop the malicious Cursor package . That correction matters: the confirmed blast radius points to Cursor’s marketplace distribution path, not every Claude Code distribution channel.
Still, the risk to developer endpoints was serious. Cursor said users who installed or updated to versions 2.1.312 or 2.1.313 during the exposure window should check for the svc-telemetry SSH key, isolate affected hosts, remove persistence and tunnel processes, and rotate credentials and sessions accessible from those machines . BleepingComputer reported that up to 5,000 developers may have been exposed, and that even where the SSH setup failed, the malware could still install keys, establish persistence and send reconnaissance data such as username, hostname, public IP, Git email and sensitive environment-variable names .
There is one grimly reassuring detail: coding mistakes and missing privileges likely reduced the number of machines where full remote SSH access worked. Cursor said enabling the local SSH service required administrator rights that the malicious extension generally did not have, and BleepingComputer cited analysis indicating that flawed SSH setup routines likely prevented access on many Windows and macOS systems . But “failed backdoor” is not the same as “safe host.” A developer workstation that ran the package may still hold source code, deploy keys, cloud tokens and session material.
Why the extension story became board-level
Morphisec framed the incident bluntly: the tool was real, the publisher identity looked real, and the install came from an official marketplace; the only thing wrong was what the build did after it ran . That is precisely why the event belongs in board-level software-supply-chain discussions rather than only in endpoint-cleanup tickets.
Most organizations approve tools by name: Cursor, Claude Code, VS Code-compatible extensions, GitHub integrations, terminal helpers. But AI coding assistants are not ordinary desktop utilities. They live beside repositories, package managers, local shells, CI/CD secrets and production access. A poisoned extension in that environment does not merely threaten one application profile. It can become a bridge to the organization’s code, build pipeline and deployment credentials.
This incident also exposes the weakness of reputation-only allowlisting. If a malicious build arrives under a legitimate extension name, a policy that says “Claude Code is allowed” may not be enough. Enterprises need controls that ask what the tool is doing at runtime. An AI coding extension should not silently write to SSH authorization files, create a task named like a system monitor, or open a reverse tunnel to an unknown server. Those are behavioral signals, not brand signals.
The ChatGPT shared-link flaw
The ChatGPT vulnerability shows the same lesson from the browser side. According to The Hacker News, Parameter showed that an ordinary public ChatGPT shared conversation could run attacker code inside the logged-in session of the person who opened it, list recent conversations, open a private chat that had never been shared, and send a small portion to a researcher-controlled server . The attack did not require the victim to install software, join a workspace or authenticate through the attacker .
Parameter’s chain, as reported, crossed the boundary between a sandboxed HTML Preview and the trusted ChatGPT page through another feature in the same conversation: an interactive graph that loaded MathLive into the main page . A MathLive message listener accepted state-changing messages without properly checking the sender, allowed raw HTML as keyboard-layout data, and let that HTML create a frame that inherited the chatgpt.com identity . ChatGPT’s content security policy blocked inline code, but a YouTube script route supplied the final execution step .
OpenAI reproduced the JavaScript execution and private-chat proof, raised severity from P2 to P1, and rolled a fix across two versions of ChatGPT’s web frontend; by October 26, both versions rejected the messages the attack relied on . DigitBin’s summary of the same disclosure says no real-world abuse was reported, the fix was server-side, and users did not need to install anything or reset anything .
A harmless-looking link wanted root privileges
The useful joke is obvious: apparently the marketplace needed a stronger CAPTCHA for the Trojan horse, and the harmless-looking link wanted root privileges. The serious point is that AI interfaces now combine old security domains that used to be easier to separate. A chat share is not just text if it can render previews, graphs, frames and scripts. A coding extension is not just an editor convenience if it can touch SSH keys and spawn system commands.
For enterprises, the response should be practical. First, verify provenance at package, version and source level, not merely by tool name. Second, log and monitor extension installation events, especially auto-updates. Third, restrict what coding assistants and extensions can do to credential stores, SSH configuration, shell execution and network egress. Fourth, treat shared AI conversation links as untrusted web content until the platform proves isolation across every feature boundary.
The Cursor and ChatGPT incidents were patched or disrupted quickly, but the trust gap they exposed remains open. AI assistants are becoming browsers, terminals, code reviewers and automation layers at once. That makes them valuable. It also makes every marketplace listing, preview pane and shared link part of the enterprise attack surface.
Comments
Be the first to comment.