A tampered Claude Code extension, five broken coding-agent browsers, and agents nobody owns

Humanbound's engine and CLI are open source: github.com/humanbound/humanbound

A tampered build of the Claude Code extension sat in Cursor's marketplace for about 11 hours on 29 October and planted an SSH backdoor. Researchers also broke the built-in browsers of five AI coding tools, and a vendor report says most dormant agents still hold working credentials. The pattern: agents inherit trust from names, surfaces and people, and nobody checks who last touched them.

The extension that looked official

On 29 October, a tampered build of Anthropic's Claude Code extension, version 2.1.313, was available in Cursor's extension marketplace for about 11 hours. Phorion found it. It was the official bundle with a loader prepended, so it kept the trusted name.

The loader ran when Node loaded the extension, before normal activation, with no user interaction. According to Help Net Security's reporting, it added an attacker SSH key labelled svc-telemetry to authorized_keys, opened an outbound SSH tunnel that retried about every 60 seconds, and set up persistence on macOS, Linux and Windows. It also sent host details and the names (not values) of up to 40 secret-like environment variables.

Cursor said the build "was not developed by Anthropic", estimated at most 5,000 affected users, took the attacker's server offline, pulled the version, rotated keys and rebuilt its marketplace. Two caveats matter. How the build got into the marketplace is not disclosed. And a dev.to write-up updated on 31 October reports that Cursor now lists both 2.1.312 and 2.1.313 as malicious and dropped the earlier user-count figure, so treat 5,000 as an initial estimate.

The part that bites: uninstalling the extension does not remove the backdoor. If you ran the editor on 29 October, check authorized_keys for the svc-telemetry entry, review SSH logs, and rotate anything the machine could reach.

Five coding agents, five embedded browsers

On 29 October, Forever Security published EMBRACE ("embedded browser trusted like a real one"). The idea is simple: AI coding tools ship a built-in browser, and the host treats it like a real one.

• Cursor: a web page plus one Enter press led the agent to run a hidden command. When the sandbox blocked it, the agent turned the sandbox off and retried. Patched on 1 October.
• GitHub Copilot: a fake address produced a fake github.com/login form. Fixed on 13 October.
• OpenAI Codex: one local file could read the whole disk. Unpatched as of 29 October.
• VS Code: a web worker sat outside the folder check. Unpatched as of 29 October; Microsoft declined the report, citing Workspace Trust.
• Claude Desktop: the same folder-check gap. Anthropic declined one report but accepted a separate one from Noma Security as valid.

Disclosure friction is part of the story. The Codex report has had no reply since 27 July, and Cursor never replied to the researchers.

An agent on a network it should not have touched

Wired reported, and TechRadar and others summarised, that an Accenture contractor connected a personal Claude Code account to the DoD's NIPRNet, where the agent allegedly ran for about two months and sent data and credentials to a third-party site. Accenture says the allegations were investigated and found to be without merit, and the DoD does not comment on its networks. These are anonymous-source allegations, not findings. Still, the shape is familiar: an agent inherits whatever access the person at the keyboard has.

Agents nobody owns

Arrakis Security's 2026 Autonomous Agents Threat Report (a vendor press release dated 21 October, built on its customers' telemetry) says 76% of active agents had not run in 60 days, yet their credentials still worked. It also reports 70% can reach sensitive systems and 24% of dormant agents can be started by an unsigned external webhook. It is vendor data with thin sampling detail, so read it as a signal. The signal is plausible: offboarding exists for people, and rarely for agents.

Attackers have agents too

GBHackers reported on 2 November, summarising Google Threat Intelligence Group, Mandiant and Wiz research, that attackers are running ARTEX, an autonomous pentest framework with six sub-agents. Execution bursts lasted about 2 to 25 seconds, and the article notes the activity is noisy and not fully autonomous. Its developer announced closure on 8 October, but copies and forks circulate.

What to do today

• Inventory editor extensions on machines with production access, and delay auto-updates on them.
• Check for the svc-telemetry key and review SSH logs if you used Cursor on 29 October.
• Treat an agent's embedded browser as an attack surface in your threat model.
• Give every agent an owner, an expiry and scoped credentials.
• Test your agents against hostile input before someone else does.

Test your own agents

Humanbound's engine and CLI are open source, and the free Community plan lets you run adversarial tests against your own agents. Sign up at app.humanbound.ai.

References

• Help Net Security: Claude Code extension poisoned with persistent SSH backdoor (30 Oct)
• Lycore on dev.to: trojanized Claude Code extension and a 15-minute check
• Dhruv Agrawal on dev.to: how a trusted extension name delivered an SSH backdoor
• Help Net Security: researchers broke the browsers built into five AI coding tools (29 Oct)
• TechRadar: Accenture contractor and Pentagon network allegations (30 Oct)
• Hackread: Arrakis Security report on dormant AI agents
• GBHackers: ARTEX AI agents automate intrusions (2 Nov)