Fake Claude Code extension backdoors Cursor and 5 more

What people are saying

Cisco Talos published research on its blog on Saturday, October 31, 2026. It describes an infostealer, VOLTA, that sends stolen data to a large language model (LLM) to rank each victim's assets by monetization value. WIRED carried the finding from research shared with its Kernel Panic newsletter. Reposts on X shortened it to "Malware uses LLMs to rank victims by how much they're worth," and a Hacker News thread drew a long discussion.

What holds up

Talos says that after stealing credentials, sessions and cryptocurrency wallets, VOLTA sends a structured evidence bundle to an LLM to rank the victim's assets. The bundle includes geolocation, home address, employer and employer domain. Talos says the malware then uses stolen session access to enrich that bundle further.

If a model refuses the task, VOLTA fails over to a chain of up to three models. Talos reads that as evidence the author expected to hit model guardrails. WIRED reported that the default model is Anthropic's Claude Opus 4.6. Talos says the stealer deletes itself and uses no attacker-owned infrastructure. It also says the design suggests a builder model, in which the author sells access to other criminals.

The sources do not establish that anyone has been harmed. Talos did not track whether VOLTA has been used in the wild. Ryan Fetterman, a security researcher at Cisco Talos, told WIRED the malware still works without the AI step. Our verdict: confirmed, on Talos's own analysis.

Inside the threads

One camp on Hacker News said the threat is old wine in a new bottle: "Nothing significant has changed for anyone in the know." Another commenter asked why the model call runs on the victim's machine and exposes the operator's API key. That commenter guessed the design keeps the tool simple for buyers. A commenter claimed AI labs already screen outputs and that hackers are probably using open-source models. In our reading, Talos's analysis points the other way, since the default is a commercial model. One prediction that most banks will be offline by 2027 drew pushback from a commenter who works in security. Others said they would keep separate machines for banking and other tasks.

Our take

In our reading, the AI step is less a new capability than a faster triage desk. The underrated part is the enrichment. Talos says VOLTA records an employer's domain and harvests Microsoft OAuth tokens, Slack workspaces, and SSH and cloud-provider keys. That puts your staff on the shortlist when they use a personal device for work. Speed matters here because, as Fetterman noted, tokens expire and passwords can be changed. We think the hype about "AI malware" is overblown, but cheaper triage for buyers of a commodity kit is a real shift. Fetterman put it this way: "We're seeing more advanced capabilities accessible to lower-level sophistication attackers."

What to do

• Treat any infostealer hit on a device that touches corporate single sign-on as an identity incident. Revoke sessions and OAuth tokens, rotate keys, and reset passwords.
• Review whether unmanaged personal devices can reach corporate email, Slack and cloud consoles. Tighten device trust where they can.
• Watch for endpoints calling LLM API gateways without a business reason, and fold that into your AI governance policy.
• Ask your endpoint provider whether its detections cover the VOLTA behaviors Talos describes.

What people are saying

A Jetstream Security post saying a Brazilian labor court censured and fined two lawyers for embedding a hidden prompt-injection command in a court filing set off a busy thread on Hacker News.

What holds up

The core event is solid. The command was set in white font on a white background to hide it from human readers.

The fine was 10% of the R$842,500.87 claim value. He held that only the lawyers, not their client, were responsible.

One detail matters for defenders. In the Portuguese wording JOTA published, the instruction told the AI to contest the petition superficially, and the judge said the aim was a weak defense or a compromised draft ruling from AI used by the opposing party or the court. Jetstream said Galileu flagged the attempt and blocked the suspicious content, citing Brazilian outlet G1. The lawyers told JOTA they used the hidden prompt to "protect the client" from the AI, not to manipulate it.

Jetstream said the two law firms were fined, about $16,000; JOTA describes the fine as imposed on the two lawyers. Our verdict: confirmed.

It is not isolated. In our reading, A Connecticut judge cited the Brazilian case when sanctioning a self-represented litigant for hidden AI instructions, revoking his electronic filing privileges. In our reading, a lawyer there blamed "residue" from an AI drafting tool.

Inside the threads

One camp on Hacker News said courts using AI to review filings is the bigger problem. A self-described lawyer argued that if a judge outsources judgment to AI, counsel should be able to influence it, and another commenter framed the injection as a legitimate test of a court shirking its duties. Others pushed back that the text fits any reasonable definition of prompt injection, though one worried the term is hard to define and could chill ordinary argument. A long side debate compared the tactic to advertising. A claim that the fine equals one to two weeks of a judge's pay went unsupported.

Our take

We think the courtroom angle is the least interesting part. The pattern applies to any workflow where AI reads documents written by someone with a stake in the outcome: contracts, vendor questionnaires, résumés, claims, invoices. The Brazilian instruction targeted the other side's AI, which is a reminder that your adversary's documents reach your tools too. The STJ minister's point is the right one for policy: the offense is the hidden instruction, whether or not it works. The debate over whether courts should use AI at all is real but overblown here; detection at ingestion did its job. What is underrated is the contract and policy side, since most organizations have no rule against hidden machine-directed text in submissions.

What to do

• Inventory AI workflows that ingest third-party documents and confirm each surfaces hidden or invisible text before a model acts on it.
• In our reading, keep a human decision-maker on outcomes that affect money, hiring or legal positions, as our AI governance guide outlines.
• Add a clause to supplier and submission terms prohibiting concealed instructions to automated systems, aligned with your third-party risk program.
• Route detections to legal and security as incidents, not as parsing errors.

What people are saying

The Organization for Transformative Works (OTW), which runs Archive of Our Own (AO3), posted an update saying it had detected evidence of a security incident on AO3. The OTW describes itself as a fan-run nonprofit dedicated to the preservation of fanworks. A post on Reddit's r/cybersecurity argued that calling it a security incident rather than an outage points to a suspected intrusion over a distributed denial-of-service (DDoS) attack. The same post said the two-to-four-week estimate is probably less alarming than it sounds.

What holds up

The core claim is confirmed by the OTW itself. Its status page first described maintenance expected to take at least 12 hours. A later update estimated that restoration would take around two weeks but could take up to four. The security incident language came in an update posted October 30 at 01:27 UTC.

The OTW says it does not currently believe the user database was stolen, but it cannot rule that out. The OTW says no AO3 data has been deleted, that AO3 does not collect real names, and that donor information sits in a separate system that was not exposed. It recommends that users change their passwords on any other site where they reuse their AO3 password. It also says the site may return in a degraded or read-only state before full recovery.

In our reading, the intrusion theory is the commenters' inference. The notice confirms an incident and the possible exposure, not a specific attack type.

Inside the threads

One commenter said two to four weeks is about what they would expect from a volunteer-run organization doing forensics. Another blamed tech debt. A reply rejected that, saying AO3 wasn't the first site the volunteers had coded. One commenter credited the separate donor system as a "boring design decision" that pays off in an incident. A different commenter recalled an earlier DDoS attack from years back, which is memory, not evidence about this incident. Others pushed back on the guessing, saying nobody knows anything beyond what the OTW has published.

Our take

We think the disclosure is a reasonable model for a small organization: it names the data at risk, admits what it cannot yet rule out, and gives users one clear action. The long downtime estimate reads to us as a team choosing to rebuild with care rather than patch and reopen, which we would rather see. The attack-type speculation is overblown until the OTW says more. The underrated part is credential reuse. Hashed passwords from a large consumer site are a classic feed for password-spraying against corporate logins, and employees use hobby sites with work-adjacent passwords more than leaders assume. The segregated donor system is also a useful reminder for your own architecture: data that never touches the main system cannot leak with it.

What to do

• Remind staff to change any password they reused on AO3 or similar hobby sites, and to stop reusing passwords between personal and work accounts.
• Confirm that phishing-resistant multifactor authentication covers your externally reachable logins, so reused passwords alone are not enough.
• Watch for any follow-up OTW notice that confirms database theft, and add affected employee email addresses to your credential monitoring if it does.

What people are saying

A story that an AI startup broke into Anthropic in under 12 hours is circulating again, this time through an India Today report built on Washington Post reporting. Its headline frames the event as a hack that reached employee details and internal messages. On a Hacker News thread about the repost, one commenter noted that the original story drew 12 points and 3 comments five days earlier.

What holds up

The startup, Cathedral, was working inside Anthropic's own program. India Today reports the access happened during a test run under Anthropic's program for outside researchers. TechRadar says Cathedral shared its results through the bug bounty program. It says AI agents found a way in by exploiting flaws in third-party business software.

Anthropic confirmed that the researchers reached a limited set of its sales, human resources and IT systems. The exposed data included business contact details for some customers and partners and basic user account records. Anthropic said the researchers could not reach customer conversations with Claude, model responses, source code or model weights.

Our monitoring flagged some of Cathedral's activity before they reported it to us, and we shut off their access the same day, Anthropic said. Anthropic took the affected business software offline and restored it only after the vendors confirmed the flaws were fixed. It said it found no evidence of anyone other than Cathedral exploiting the vulnerabilities.

Anthropic also said Cathedral overstated the national security implications. It said Cathedral did not fully follow its testing program's rules because it failed to disclose all of its activity. Cathedral said it kept data access to the minimum its research required. Alex Stamos, chief information security officer at Cognition, said: "This is a really hard problem, but Anthropic could have done a lot better."

In plain words, the access is confirmed. The "hack" framing and the national security stakes are not.

Inside the threads

The thread was small and split between market speculation and jokes. One commenter wondered whether the episode would weigh on investors ahead of an initial public offering (IPO). Another said the headline should describe an agent going rogue. A practitioner-minded commenter asked which business software was the entry point.

One commenter worried that a future breach could expose user chats tied to phone numbers, and called the company a grow-fast startup with "security likely as a secondary concern." That is speculation. Anthropic's statement says customer conversations were not reached in this case.

Our take

In our reading, this is a third-party software story, not an AI lab story. The agents went through the administrative and sales tools that every company runs, and most security teams watch those tools less closely than their own production systems. We think the 12-hour figure matters less than the fact that agents found a path that human testers missed over several days. Anthropic's detection and same-day cutoff count in its favor. The dispute over program rules is a reminder that bounty scope and disclosure terms need to anticipate autonomous tooling. The national security angle looks overblown on what has been confirmed. The underrated lesson is that a researcher running autonomous agents can move further and faster than your rules of engagement assumed.

What to do

• Inventory the software-as-a-service (SaaS) tools that hold HR, sales and meeting data, and confirm which of them feed logs into your monitoring.
• Update bug bounty and penetration test rules of engagement to cover AI agents: scope, data minimization and full activity disclosure.
• After a vendor reports a fix, ask for independent verification before you restore access.

What people are saying

Posts on Bluesky repeated a claim that Phorion had detected a backdoor in what they called the official Claude Code extension bundle on the Cursor Marketplace. A post on X said the malicious versions spent roughly 11 hours in Cursor's marketplace. In a Reddit r/cybersecurity thread, the one commenter warned that uninstalling the extension does not remove the SSH key or startup persistence.

What holds up

Cursor's security notice says a maliciously modified version of Anthropic's Claude Code extension was available in its marketplace between about 2:27am and 1:35pm Pacific time. The affected builds are versions 2.1.312 and 2.1.313 for Windows and macOS. Cursor says the extension runs malicious code that attempts to install a persistent SSH backdoor.

Microsoft's analysis dates Cursor's report to October 29, 2026. Microsoft says the packages were never published or distributed through the Visual Studio Marketplace or the official npm package. Microsoft also says Anthropic confirmed its systems were not compromised and that it did not develop the malicious package. Microsoft says all evidence so far suggests the incident is limited to the Cursor marketplace.

The impact is narrower than the word "backdoor" suggests, but it is not zero. Cursor says errors in the malicious code meant the remote access step would fail unless Cursor had been started with administrator privileges. The extension still added the attacker's SSH key, installed persistence and sent host details to the attacker. Cursor warns that uninstalling the extension may not be sufficient, and says the attacker server no longer functions.

In our reading, the core claim is confirmed by the affected marketplace operator and by Microsoft's independent analysis.

Inside the threads

The Reddit commenter added that the key and persistence "can be written even if the tunnel fails." A post on X stated that neither Microsoft's VS Code Marketplace extension nor Anthropic's npm package was affected. Another X post told Cursor users to check their Claude Code extension. We think the Bluesky wording about an official extension bundle fed early talk that Anthropic itself had been breached. Anthropic's statement to Microsoft contradicts that reading.

Our take

In our reading, the weak point was a third-party marketplace that served a tampered build to editors that update automatically. Cursor's note that the tunnel usually failed is reassuring, but we would not let it shorten an investigation, because the key and persistence were still written. Our take is that the underrated lesson concerns developer extensions as a supply chain: they run on machines that hold source code, cloud credentials and SSH access. We think few security programs inventory editor extensions the way they inventory software packages. In our reading, this incident is a good reason to start, and our third-party risk guide covers the governance side.

What to do

• Identify devices where users installed or auto-updated the Claude Code extension, versions 2.1.312 or 2.1.313, through the Cursor marketplace.
• Preserve the extension package, modified SSH files, scripts and startup configuration before cleanup, then remove the unauthorized key and persistence.
• Rotate credentials and sessions reachable from affected hosts, working from a trusted system.
• Restrict Cursor extensions to approved publishers and set an installation cooldown for newly published versions.