Your coding agent had a backdoor

Hey there 👋

Saturdays are supposed to be slow, and this one looked the part. I opened the tab this morning expecting a model launch to write up, some new weights or a leaderboard reshuffle, the usual weekend nothing. What I found instead was a coding-agent extension that had been quietly turned into a backdoor and shipped to real machines. My bias, up front: I spend more time worrying about where my tools come from than where my models rank, and today paid that worry back. The agentic web is getting built faster than anyone is bothering to lock the doors behind it.

- Ron

The Big Thing

A branded Claude Code extension on Cursor's marketplace was trojanized to plant an SSH backdoor

[AUDIT NOW]

A branded build of the Claude Code extension on Cursor's marketplace was swapped for a malicious one this week, and the version it replaced opened an SSH backdoor on the machines that installed it. Start with what this is not. It is not an Anthropic breach. Anthropic's systems were clean, and Anthropic did not build the tampered package. Microsoft's security team, which published the teardown on October 30, confirmed the bad copies lived only on Cursor's extension marketplace, not the Visual Studio Marketplace and not npm.

What the malicious versions did once installed, 2.1.312 and 2.1.313: they appended an attacker's SSH public key, labeled 'svc-telemetry', to your authorized_keys file. They opened a reverse SSH tunnel back out. They set persistence that survives a reboot, a LaunchAgent on macOS, an @reboot crontab line on Linux, a scheduled task on Windows. Then they scraped your hostname and the names of any environment variables containing KEY, TOKEN, or SECRET and sent them to a server at 134.209.82.225.

Now the honest part, the blast radius. Cursor disclosed the tampered build on October 29 and says it was live for about eleven hours, from roughly 2:27 AM to 1:35 PM Pacific. Cursor also reports that the operating system's own permission prompt blocked the SSH step on most macOS and Windows hosts. So the full backdoor did not land everywhere. But the loader still planted keys and persistence on the way in, which means a blocked SSH step is not the same as a clean machine. Nobody has published an install or victim count, so do not assume one.

The lesson is not that coding agents are dangerous. The agent was fine. The door nobody was watching was the marketplace that distributes its extensions, the same soft spot npm has had for years, now wired to the tools you let write your code.

Why it matters: every team installing coding-agent IDE extensions needs a publisher allowlist and an install cooldown today. The distribution layer is the new attack surface, and most shops have no policy for it at all.

Ship it? AUDIT NOW. Check authorized_keys for 'svc-telemetry', grep your crontab and LaunchAgents, and rotate any key that sat in a scraped env var. Then set a house rule: no new extension version installs for 48 hours, and no clicking through an SSH prompt you did not expect.

Sources: Microsoft Security (primary), The Hacker News, Help Net Security, BleepingComputer.

Tour de Headlines

🛒 [WATCH / CALIBRATE]

DoorDash CEO Tony Xu put a hard number on agentic commerce this week, and it is small. On the company's Q3 2026 earnings call, as reported by TechCrunch, Xu said third-party AI agents have placed "maybe several hundred orders in total." For scale, DoorDash averaged around three million deliveries a day in 2025. Several hundred, ever, against three million a day. That figure rests on one outlet's account of the call, so hold it loosely, but the direction is clear enough. The telling move is what DoorDash did about it. Rather than wait on outside agents, it shipped its own: a text-to-order agent, a command-line agent, the Ask DoorDash chatbot, and an MCP connector for ordering through other tools. Calibrate your roadmap to that gap, not to the hype around it. TechCrunch

🌐 [NOTE]

The four biggest model makers, OpenAI, Google, Microsoft and Anthropic, all pointed at one robots.txt signal this week for opting out of AI training. You add a policy token, __usage_ai-training, on a User-Agent line, and it states one preference about training on your content. Read the fine print before you celebrate. This is an individual IETF Internet-Draft, not a ratified standard. It governs use, meaning training, not whether a crawler can reach the page, and private deals can override it. A wildcard User-Agent: * block does not count as the token. The dates differ too: Microsoft honors it from February 1, 2027, while OpenAI and Anthropic have given no firm date. "Industry agreement" here is four blog posts aimed at one draft. OpenAI (primary), PPC Land

🔓 [WATCH]

The fun one, framed carefully. Anthropic disclosed this week that an internal, unreleased Claude model found and chained five high-impact exploits in real production software, including a remote code execution bug in Chrome and a zero-click RCE on Linux. A model that writes working exploit chains against shipping software is a real capability, not a demo. The part worth copying is the discipline around it. Anthropic ran the finds through a 90-day vendor window plus a 45-day embargo before saying anything, which is how responsible disclosure is supposed to work. Frontier models are now credible offensive-security tools, and that cuts both ways. The same capability that lets your AppSec team pre-empt a bug helps whoever else is pointing it at you. Anthropic (primary)

Tool of the Day

📘 Anthropic's Managed Agents guidance

[READ / TRY]

What it's for: keeping your agent's behavior stable when you swap the model underneath it.

Anthropic published fresh engineering guidance this week in its Managed Agents series, and the core idea is a small, stable interface that separates planning from execution. Put that boundary in, and a model upgrade stops silently rewriting how your agent behaves. The worked example earns the whole post. A failure they call "context anxiety," where agents quit early as the context window shrank, vanished when they moved from Claude Sonnet 4.5 to Opus 4.5. The lesson cuts against "just upgrade the model." Without a stable interface, every upgrade is a behavioral gamble. No benchmark numbers in the post, and the pattern is model-agnostic, so anyone can copy it. Read the writeup, then put one stable interface between your agent's planner and its tools this week.

Read the Managed Agents writeup →

Source: Anthropic (primary).

Worth a Click

• The IETF draft behind the opt-out token. draft-kelley-aipref-training-preference-signal-00 is the actual spec. Read it before you trust __usage_ai-training as anything enforceable, because right now it is a proposal, not a rule. [READ]
• "AI isn't replacing SREs, it's deskilling them." This week's contrarian read, around 512 points and 385 comments on Hacker News. The claim, and it is an argument rather than a finding: leaning on AI ops automation quietly erodes the human expertise you still need the day the automation fails. Good to chew on if you are staffing agent-heavy ops. [READ / THINK]
• Microsoft's full teardown of the Cursor backdoor. The technical writeup and the complete IOC list behind today's Big Thing, for anyone who wants to hunt their own machines this weekend. [READ]

Three stories, one week, one shape. The tooling that writes your code got a backdoor shipped through a marketplace nobody was guarding. The commerce layer everyone keeps calling the future took a few hundred agent orders against three million deliveries a day. And the four biggest labs agreed on a web signal that none of them enforces yet. The agentic web is being built faster than it is secured, and faster than it is used. Every one of these hands more control to the operator, which sounds like a win until you read the invoice. You own the keys now. You also own rotating them, allowlisting what you install, and checking the door the vendor left open. Start with your extensions this weekend. That is the one with a live attacker key attached to it.

Most of this weekend's list is a chore, not a launch. Audit your coding-agent extensions, drop the opt-out token in robots.txt if you care about training, and read the Managed Agents post before your next model bump. The one I would not put off is the first one. A planted SSH key does not care that it is Saturday.

- Ron