A malicious copy of Anthropic’s Claude Code extension, versions 2.1.312 and 2.1.313, was available in Cursor’s extension marketplace on October 29, 2026, from about 2:27 a.m. to 1:35 p.m. Pacific time. The incident appears limited to Cursor: the packages were not distributed through Microsoft’s Visual Studio Marketplace or npm, and Anthropic’s systems were not compromised. Injected JavaScript ran before the extension’s normal startup, using built-in system tools rather than downloading another executable. It quietly collected basic host and user details, then attempted to install SSH access, create an outbound reverse tunnel, establish persistence, and report information to attacker infrastructure.
The code tried to add an attacker-controlled public key to the user’s SSH authorization file and use a separate identity to forward connections to the workstation’s local SSH port 22. It set up restart mechanisms for macOS, Linux, and Windows, including LaunchAgent, cron, and scheduled-task or Startup-folder artifacts. A delayed callback attempted to send host details and names of up to 40 environment variables matching sensitive terms such as KEY, TOKEN, or SECRET; it did not collect their values, so this does not establish that secrets were stolen. Successful remote access depended on permissions and SSH settings, and Cursor reported that these blocked access on most macOS and Windows systems, though keys or persistence files could still have been planted. Organizations should investigate affected installations, preserve evidence, review endpoint and network activity, remove confirmed artifacts, and rotate credentials or revoke sessions if exposure is indicated.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Trigger.dev disclosed a security incident in which an attacker accessed environment variables belonging to a subset of organizations. The company blocked the exploit and emailed affected account owners with mitigation steps. (trigger.dev)
A security researcher avoids LLMs because hands-on investigation is enjoyable, and using AI makes it hard to claim authorship when it produces confidently wrong results. They recognize LLMs’ power but argue that finding vulnerabilities still depends on skilled researchers guiding them. (eva.ac)
A buyer wants a 60-80-inch 4K TV that functions only as a display for an Apple TV, without using its built-in smart features. They’re seeking models that offer strong privacy and pair well with Apple TV. (news.ycombinator.com)
Meta’s Muse AI assistant is accused of accessing private messages, financial accounts, contacts, and other data to build behavioral profiles, including of people who never installed it. The account also alleges that Muse data is used for AI training by default and that internal warnings about privacy and security risks were overridden. (paulfwalsh.substack.com)
The title alleges that Frontier Airlines was likely breached. The page only displays a Reddit network-security block and gives no details to verify the claim. (reddit.com)
Researchers chained a flaw in ChatGPT’s sandboxed HTML previews with a JavaScript injection path to access private user data or act on users’ behalf through a malicious share link. OpenAI fixed the vulnerability and paid a $5,000 bug bounty. (simonwillison.net)
Today's best Hacker News stories, summarized and screenshotted, one email a day.