A tampered Claude Code extension, five broken coding-agent browsers, and agents nobody owns

Humanbound's engine and CLI are open source: github.com/humanbound/humanbound

A tampered build of the Claude Code extension sat in Cursor's marketplace for about 11 hours on 29 October and planted an SSH backdoor. Researchers also broke the built-in browsers of five AI coding tools, and a vendor report says most dormant agents still hold working credentials. The pattern: agents inherit trust from names, surfaces and people, and nobody checks who last touched them.

On 29 October, a tampered build of Anthropic's Claude Code extension, version 2.1.313, was available in Cursor's extension marketplace for about 11 hours. Phorion found it. It was the official bundle with a loader prepended, so it kept the trusted name.

The loader ran when Node loaded the extension, before normal activation, with no user interaction. According to Help Net Security's reporting, it added an attacker SSH key labelled svc-telemetry to authorized_keys, opened an outbound SSH tunnel that retried about every 60 seconds, and set up persistence on macOS, Linux and Windows. It also sent host details and the names (not values) of up to 40 secret-like environment variables.

Cursor said the build "was not developed by Anthropic", estimated at most 5,000 affected users, took the attacker's server offline, pulled the version, rotated keys and rebuilt its marketplace. Two caveats matter. How the build got into the marketplace is not disclosed. And a dev.to write-up updated on 31 October reports that Cursor now lists both 2.1.312 and 2.1.313 as malicious and dropped the earlier user-count figure, so treat 5,000 as an initial estimate.

The part that bites: uninstalling the extension does not remove the backdoor. If you ran the editor on 29 October, check authorized_keys for the svc-telemetry entry, review SSH logs, and rotate anything the machine could reach.

On 29 October, Forever Security published EMBRACE ("embedded browser trusted like a real one"). The idea is simple: AI coding tools ship a built-in browser, and the host treats it like a real one.

Disclosure friction is part of the story. The Codex report has had no reply since 27 July, and Cursor never replied to the researchers.

Wired reported, and TechRadar and others summarised, that an Accenture contractor connected a personal Claude Code account to the DoD's NIPRNet, where the agent allegedly ran for about two months and sent data and credentials to a third-party site. Accenture says the allegations were investigated and found to be without merit, and the DoD does not comment on its networks. These are anonymous-source allegations, not findings. Still, the shape is familiar: an agent inherits whatever access the person at the keyboard has.

Arrakis Security's 2026 Autonomous Agents Threat Report (a vendor press release dated 21 October, built on its customers' telemetry) says 76% of active agents had not run in 60 days, yet their credentials still worked. It also reports 70% can reach sensitive systems and 24% of dormant agents can be started by an unsigned external webhook. It is vendor data with thin sampling detail, so read it as a signal. The signal is plausible: offboarding exists for people, and rarely for agents.

GBHackers reported on 2 November, summarising Google Threat Intelligence Group, Mandiant and Wiz research, that attackers are running ARTEX, an autonomous pentest framework with six sub-agents. Execution bursts lasted about 2 to 25 seconds, and the article notes the activity is noisy and not fully autonomous. Its developer announced closure on 8 October, but copies and forks circulate.

Humanbound's engine and CLI are open source, and the free Community plan lets you run adversarial tests against your own agents. Sign up at app.humanbound.ai.