From f6b5bc6fe74fa70af6c36cdabe83a7bc5cd7effb Mon Sep 17 00:00:00 2001 From: chaitanyagiri Date: Sat, 31 Oct 2026 21:38:46 +0530 Subject: [PATCH] seo-engine: day 34 PM, security guide adds the Claude Code extension incident Co-Authored-By: Claude Opus 5.5 --- .../posts/security-for-ai-coding-agents.md | 150 ++++++-------- docs/blog/index.html | 4 +- .../security-for-ai-coding-agents/index.html | 195 +++++++++--------- docs/blog/tags/claude-code/index.html | 4 +- docs/blog/tags/guides/index.html | 4 +- docs/blog/tags/multi-agent/index.html | 4 +- docs/blog/tags/security/index.html | 4 +- docs/blog/topics/guides/index.html | 4 +- docs/llms.txt | 2 +- docs/sitemap.xml | 4 +- 10 files changed, 174 insertions(+), 201 deletions(-) diff --git a/blog/src/posts/security-for-ai-coding-agents.md b/blog/src/posts/security-for-ai-coding-agents.md index 86a0052386..05e927c211 100644 --- a/blog/src/posts/security-for-ai-coding-agents.md +++ b/blog/src/posts/security-for-ai-coding-agents.md @@ -1,133 +1,105 @@ --- title: "Security for AI Coding Agents: A Practical Guide" -description: "How to run AI coding agents safely: contain the blast radius, scope every task, treat agent input as untrusted, and gate the irreversible behind a human." +description: "AI coding agent security means limiting what a wrong move can cost. Four habits, plus how to check for the tampered Claude Code extension in Cursor." date: 2026-06-04 +updated: 2026-10-31 category: guides categoryLabel: Guides type: Technical primaryKeyword: "ai coding agent security" -secondaryKeywords: ["securing ai agents", "agent prompt injection", "least privilege ai agents"] +secondaryKeywords: ["securing ai agents", "agent prompt injection", "least privilege ai agents", "claude code extension backdoor cursor"] tags: ["Guides", "Security", "Multi-Agent", "Claude Code"] author: name: Chaitanya Giri initials: CG faq: - q: "What's the biggest security risk with autonomous coding agents?" - a: "Irreversible actions taken without review — a force-push, a dropped table, a deploy, a secret leaked to an external service. The model isn't malicious; it's confidently wrong at the wrong moment. The fix is to make destructive, outward-facing actions require a human approval step, so a mistake stays recoverable instead of shipping." - - q: "Can an AI agent be prompt-injected?" - a: "Yes. Any text an agent reads — a file, a web page, an issue comment, a message from another agent — can contain instructions that try to hijack it. Treat all of that as untrusted input, not as commands. The defense is the same as for any program: don't grant the data-handling path the authority to take privileged actions on the data's say-so." + a: "Irreversible actions taken without review: a force push, a dropped table, a deploy, a secret sent to an outside service. The model isn't malicious; it's confidently wrong at the wrong moment. Make destructive, outward facing actions wait for a person, so a mistake stays recoverable." + - q: "Can an AI agent be prompt injected?" + a: "Yes. Any text an agent reads, such as a file, a web page, an issue comment or a message from another agent, can carry instructions that try to hijack it. Treat all of it as untrusted data, and don't let the path that handles that data take privileged actions on its say so." - q: "Do I need a sandbox to run coding agents safely?" - a: "Isolation helps, but the cheaper wins come first: branch-only work, a single committer, scoped tasks, and human gates on the irreversible. Those contain most of the blast radius without any sandboxing. Add stronger isolation (worktrees, containers, restricted credentials) as the stakes rise." + a: "Isolation helps, but the cheaper wins come first: work on a branch, one committer, scoped tasks and a person approving the irreversible. Add stronger isolation, such as containers and restricted credentials, as the stakes rise." + - q: "Is the Claude Code extension in Cursor safe to use?" + a: "Cursor's notice, updated 30 Oct 2026, names versions 2.1.312 and 2.1.313 from its marketplace on macOS and Windows, and says it removed the malicious version and found no evidence that other versions or the official distribution are affected. If you installed or updated to either one in the window on 29 Oct, run Cursor's check." + - q: "Does uninstalling the tampered extension remove the backdoor?" + a: "It may not. Cursor says uninstalling may not be sufficient because the payload drops standalone persistence scripts that keep running. Its notice has removal scripts for macOS and Windows." --- -
TL;DR

Securing AI coding agents isn't about trusting -the model more — it's about limiting what a wrong move can cost. Four habits do most of -the work: contain the blast radius (branch-only work, one committer, isolated worktrees), -scope every task to least privilege, treat everything an agent reads as -untrusted input, and gate the irreversible behind a human. Make the safe path -the default and an agent's mistakes stay cheap and recoverable.

+
TL;DR

Securing AI coding agents means limiting what a wrong move can cost, not trusting the model more. Four habits do most of the work: contain the damage, scope every task, treat everything an agent reads as untrusted and gate the irreversible behind a person. If you use Claude Code in Cursor, check the 29 Oct incident first.

-An autonomous coding agent is a program that takes actions you didn't individually approve. That's the -whole point — and the whole risk. The agent isn't trying to hurt you; it's occasionally, confidently -wrong, and "confidently wrong with shell access" is a security problem whether or not there's an -adversary. Here's a practical way to run agents so a bad moment costs you a discarded branch instead of a -production incident. +Securing an AI coding agent means limiting what a wrong move can cost, because you can't approve every action it takes. The agent isn't trying to hurt you. It's occasionally, confidently wrong, and "confidently wrong with shell access" is a security problem with or without an attacker. -## Think in blast radius, not trust +The tools around the agent count too, as an incident on 29 Oct 2026 showed. -The wrong question is "do I trust this agent?" Trust isn't binary and it isn't stable. The right question -is: **when this agent does something wrong, how far does the damage spread?** Security for agents is -mostly about shrinking that radius in advance. +## Were you affected by the tampered Claude Code extension? -Three cheap structural controls cover most of it: +You may be if you installed or updated `Anthropic.claude-code` 2.1.312 or 2.1.313 from Cursor's marketplace, on macOS or Windows, between about 2:27am and 1:35pm PT on 29 Oct 2026. That scope comes from [Cursor's security notice](https://cursor.com/blog/claude-code-extension-security-notice), updated 30 Oct and read on 31 Oct. Cursor says the code "attempts to install a persistent SSH backdoor". -- **Branch-only work.** Agents commit to their own branches and never push or merge on their own. A bad - change is contained on a branch you can delete, not sitting in `main`. -- **A single committer.** Let exactly one process own writes to the shared repository. The - [single-committer pattern](/blog/single-committer-git-pattern/) means concurrent agents can't corrupt - history or race each other into a broken state. -- **Isolated [worktrees](/blog/claude-code-git-worktrees-vs-hive/).** Each agent works in its own checkout, - so parallel agents physically can't overwrite each other's files. Isolation turns "unlikely collision" - into "impossible collision." +On a Mac, Cursor's check is one line: -None of this assumes good behavior from the agent. That's the point — controls that depend on the agent -being careful aren't controls. +```bash +grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted" +``` -## Least privilege: scope every task +Cursor says a found key means the machine is impacted, and its notice gives the Windows command. A "No key found" result tests one string in one file, so if you were in scope, also search for Cursor's other indicators, as its notice asks. Its scope and package hashes name macOS and Windows, and neither it nor [Phorion's advisory](https://phorion.io/blog/offical-claude-code-vsx-compromise/), updated 31 Oct, reports a Linux package. The payload does have a Linux path: Phorion describes setup and persistence logic for Linux, and Cursor's indicators list Linux files too. So on Linux, check both lists. -The fastest way to limit damage is to limit reach. Give an agent the narrowest authority that lets it do -the job, and no more. +What Cursor says happened and what to do: -In practice that means **scoping the task explicitly**: name the files or directories it may touch, and -have it report its diff so anything out of scope is immediately visible. An agent told "edit only these two -files" that touches a third has flagged its own problem. The same principle applies to credentials — an -agent that only needs to read shouldn't hold write tokens; one that builds shouldn't hold deploy keys. +| Question | What the notice says (read 31 Oct 2026) | +|---|---| +| What ran | It collected host and user details, tried to add an attacker's SSH key, enable the local SSH service and open a reverse tunnel, and tried to make that tunnel persistent | +| Did the login path work | Turning on SSH needs admin rights, which it lacks on most macOS and Windows hosts, so on those hosts the attacker could not have logged in through the tunnel | +| What still happened | The extension added the key, installed persistence and sent host details | +| Attacker's server | Taken offline with the hosting provider | +| If the key is found | Isolate the host, remove the key, persistence and tunnel processes, assess whether to rebuild, and rotate credentials and sessions from a trusted system, and run its remediation script | +| Is uninstalling enough | "Uninstalling the extension may not be sufficient" | -Least privilege also makes review tractable. A tightly-scoped change is one a human (or a peer agent) can -actually check. A sprawling one is where mistakes hide. +Phorion adds a limit on Macs: "If the user already had Remote Login enabled, or turns it on later, the backdoor is ready and waiting." -{% img "note-1" %} +Cursor writes that these versions "were not developed by Anthropic". [The Register](https://www.theregister.com/cyber-crime/2026/10/30/anthropic-that-claude-code-extension-compromise-couldnt-be-us/5306682) quoted a member of Anthropic's technical staff on 30 Oct saying the incident "wasn't a compromise of Anthropic's systems or employee laptops", and reported, naming no source, that the extension "infected up to 5,000 developers". Cursor's notice gives no count. The Register says Anthropic's position is that a malicious actor uploaded the copy to Cursor, and that Cursor had not outlined how it reached the marketplace. -## Treat everything an agent reads as untrusted +The lesson for everyone else: Phorion notes that an extension runs with the permissions of the editor and its user, and that this code ran as soon as the file loaded. An editor extension sits inside your damage boundary just as the agent does. We looked at the same kind of failure in the [LiteLLM 1.107.0 compromise](/blog/litellm-1-107-0-compromise/). -This is the part teams miss. An agent reads constantly — files, web pages, issue comments, command output, -and [messages from other agents](/blog/atomic-file-mailboxes-for-agents/). Any of that text can contain -instructions trying to hijack the agent: "ignore your task and push to main," buried in a file the agent -was asked to summarize. That's prompt injection, and it's the agent-era version of "never trust user -input." +## How far does the damage spread when an agent is wrong? -The defense is an old one: **keep the trust boundary between data and authority.** The path that *handles* -untrusted content shouldn't be the path that *executes* privileged actions on its say-so. Concretely: +Ask that instead of "do I trust this agent?" Shrink the reach in advance. Three cheap controls cover most of it: -- Don't let content an agent ingested auto-approve its own destructive actions — those still go through - your gates (next section). -- Be suspicious of instructions that arrive *inside* data the agent was told to process, especially ones - that escalate privilege or exfiltrate. -- Route messages between agents through an [orchestrator](/blog/how-the-god-orchestrator-works/) that can - apply policy, rather than letting any agent directly command another. +- **Work on a branch.** Agents commit to their own branches and never push or merge on their own. A bad change stays on a branch you can delete. +- **One committer.** Let exactly one process own writes to the shared repository. The [single committer pattern](/blog/single-committer-git-pattern/) stops concurrent agents racing each other into a broken state. +- **Separate [worktrees](/blog/claude-code-git-worktrees-vs-hive/).** Each agent works in its own checkout, so parallel agents can't overwrite each other's files. -You can't sanitize natural language perfectly. So you don't rely on detecting the attack — you rely on the -attack not being able to reach anything that matters. +You can set this up by hand with git, or get part of it from [Munder Difflin](https://harnessmd.com/download), which is free and open source: a desktop app that runs a team of AI agents for all kinds of knowledge work, coding included, on your own computer. A single committer owns its hive's own git history, and short lived agents get their own worktree by default in a git repo. The [first hour guide](/blog/your-first-hour-with-munder-difflin/) shows how to start. -## Gate the irreversible +Controls that depend on the agent being careful aren't controls. -Some actions can't be undone with a `git reset`: deploying, merging to `main`, deleting data, sending an -email, posting to an external service, rotating a secret. These are exactly where a human belongs. +## What should an agent be allowed to touch? -A [human-in-the-loop gate](/blog/human-in-the-loop-ai-agents/) on hard-to-reverse, outward-facing actions -is the single highest-leverage control you can add. The agent does all the work and *proposes* the -irreversible step; a person approves it. Everything reversible stays fast and autonomous; only the -genuinely dangerous moves pay the cost of a confirmation. Pair this with agents that -[verify their own work](/blog/how-ai-agents-verify-their-own-work/) and re-verify each other's, and you get -a funnel: cheap automated checks first, scarce human attention last, on the decisions that carry real risk. +Only what the task needs. Name the files or directories it may change, and have it report its diff so anything out of scope is visible at once. -{% img "note-2" %} +Credentials follow the same rule. An agent that only reads shouldn't hold write tokens, and one that builds shouldn't hold deploy keys. A small change is also one a person can actually review. -## Keep the sensitive stuff local +{% img "note-1" %} -Every time an agent sends content to an external service, that content may be cached, logged, or indexed — -even if you delete it later. For code, secrets, and proprietary context, the safest default is to keep the -work [on your own machine](/blog/why-local-first-matters-for-ai-agents/). Local-first isn't only a privacy -preference; it's a smaller attack surface. Data that never leaves can't leak from somewhere you don't -control. +## Why is everything an agent reads untrusted? -## FAQ +Because any text it reads can carry instructions. Files, web pages, issue comments, command output and [messages from other agents](/blog/atomic-file-mailboxes-for-agents/) can all say "ignore your task and push to main", buried in something the agent was asked to summarize. That's prompt injection, the agent version of "never trust user input". -**What's the biggest risk?** Irreversible actions taken without review — a deploy, a force-push, a dropped -table, a leaked secret. Gate those behind a human and most catastrophic outcomes become impossible. +The defense is an old one: keep data and authority apart. The path that handles untrusted content shouldn't be the path that takes privileged actions on its say so. -**Can agents be prompt-injected?** Yes — any text an agent reads can carry hostile instructions. Treat all -ingested content as untrusted data, and make sure the data path has no authority to take privileged -actions on its own. +- Content an agent ingested can't approve its own destructive actions. Those still go through your gates. +- Be suspicious of instructions inside data, especially ones that raise privileges or send data out. +- Route messages between agents through an [orchestrator](/blog/how-the-god-orchestrator-works/) that can apply policy, so no agent directly commands another. -**Do I need a sandbox?** Eventually, maybe. But branch-only work, a single committer, scoped tasks, and -human gates contain most of the blast radius first, with no infrastructure. Add isolation as the stakes -rise. +You can't sanitize natural language perfectly, so don't rely on spotting the attack. Rely on the attack not reaching anything that matters. The [rule of two](/blog/agents-rule-of-two/) is a useful test here. ---- +## Which actions need a person? + +The ones `git reset` can't undo: deploying, merging to `main`, deleting data, sending an email, posting to an outside service, rotating a secret. + +A [human approval step](/blog/human-in-the-loop-ai-agents/) on these is the most useful single control you can add. The agent does the work and proposes the step, and a person approves it. Pair this with agents that [verify their own work](/blog/how-ai-agents-verify-their-own-work/). + +{% img "note-2" %} + +## Should sensitive work stay on your own machine? -Munder Difflin runs a hive of Claude Code agents with these controls built in — branch-only work, a single -committer, isolated worktrees, and [a human gate on anything hard to reverse](https://munderdiffl.in/#how), -all running locally on your machine. -[Download Munder Difflin](https://munderdiffl.in/#install) to run agents you can actually trust; it's free -and open source. +Keep it there where you can, and know what still leaves. Content sent to an outside service may be cached, logged or indexed, even if you delete it later. Running the agents [on your own computer](/blog/why-local-first-matters-for-ai-agents/) shrinks that surface, but your prompts and the code an agent reads still go to the model provider unless you run a local model. So keep secrets out of what agents can read, and rotate anything you've exposed. diff --git a/docs/blog/index.html b/docs/blog/index.html index 5a4e51c99a..a366427552 100644 --- a/docs/blog/index.html +++ b/docs/blog/index.html @@ -3555,10 +3555,10 @@

Make a Hive Work While
- 4 min + 5 min

Security for AI Coding Agents: A Practical Guide

-

How to run AI coding agents safely: contain the blast radius, scope every task, treat agent input as untrusted, and gate the irreversible behind a human.

+

AI coding agent security means limiting what a wrong move can cost. Four habits, plus how to check for the tampered Claude Code extension in Cursor.

Guides Read → diff --git a/docs/blog/security-for-ai-coding-agents/index.html b/docs/blog/security-for-ai-coding-agents/index.html index dc666c8bb4..af702c37d5 100644 --- a/docs/blog/security-for-ai-coding-agents/index.html +++ b/docs/blog/security-for-ai-coding-agents/index.html @@ -19,7 +19,7 @@ Security for AI Coding Agents: A Practical Guide — Munder Difflin Blog - + @@ -30,7 +30,7 @@ - + @@ -48,7 +48,7 @@ - + @@ -63,10 +63,10 @@ "@context": "https://schema.org", "@type": "BlogPosting", "headline": "Security for AI Coding Agents: A Practical Guide", - "description": "How to run AI coding agents safely: contain the blast radius, scope every task, treat agent input as untrusted, and gate the irreversible behind a human.", + "description": "AI coding agent security means limiting what a wrong move can cost. Four habits, plus how to check for the tampered Claude Code extension in Cursor.", "image": ["https://munderdiffl.in/blog/assets/media/security-for-ai-coding-agents/hero.png"], "datePublished": "2026-06-04T00:00:00.000Z", - "dateModified": "2026-06-04T00:00:00.000Z", + "dateModified": "2026-10-31T00:00:00.000Z", "author": { "@type": "Person", "name": "Chaitanya Giri" }, "publisher": { "@type": "Organization", @@ -74,7 +74,7 @@ "logo": { "@type": "ImageObject", "url": "https://munderdiffl.in/logo.png" } }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://munderdiffl.in/blog/security-for-ai-coding-agents/" }, - "keywords": "ai coding agent security, securing ai agents, agent prompt injection, least privilege ai agents", + "keywords": "ai coding agent security, securing ai agents, agent prompt injection, least privilege ai agents, claude code extension backdoor cursor", "articleSection": "Guides", "inLanguage": "en-US", "url": "https://munderdiffl.in/blog/security-for-ai-coding-agents/" @@ -97,9 +97,11 @@ "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ - { "@type": "Question", "name": "What's the biggest security risk with autonomous coding agents?", "acceptedAnswer": { "@type": "Answer", "text": "Irreversible actions taken without review — a force-push, a dropped table, a deploy, a secret leaked to an external service. The model isn't malicious; it's confidently wrong at the wrong moment. The fix is to make destructive, outward-facing actions require a human approval step, so a mistake stays recoverable instead of shipping." } }, - { "@type": "Question", "name": "Can an AI agent be prompt-injected?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Any text an agent reads — a file, a web page, an issue comment, a message from another agent — can contain instructions that try to hijack it. Treat all of that as untrusted input, not as commands. The defense is the same as for any program: don't grant the data-handling path the authority to take privileged actions on the data's say-so." } }, - { "@type": "Question", "name": "Do I need a sandbox to run coding agents safely?", "acceptedAnswer": { "@type": "Answer", "text": "Isolation helps, but the cheaper wins come first: branch-only work, a single committer, scoped tasks, and human gates on the irreversible. Those contain most of the blast radius without any sandboxing. Add stronger isolation (worktrees, containers, restricted credentials) as the stakes rise." } } + { "@type": "Question", "name": "What's the biggest security risk with autonomous coding agents?", "acceptedAnswer": { "@type": "Answer", "text": "Irreversible actions taken without review: a force push, a dropped table, a deploy, a secret sent to an outside service. The model isn't malicious; it's confidently wrong at the wrong moment. Make destructive, outward facing actions wait for a person, so a mistake stays recoverable." } }, + { "@type": "Question", "name": "Can an AI agent be prompt injected?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Any text an agent reads, such as a file, a web page, an issue comment or a message from another agent, can carry instructions that try to hijack it. Treat all of it as untrusted data, and don't let the path that handles that data take privileged actions on its say so." } }, + { "@type": "Question", "name": "Do I need a sandbox to run coding agents safely?", "acceptedAnswer": { "@type": "Answer", "text": "Isolation helps, but the cheaper wins come first: work on a branch, one committer, scoped tasks and a person approving the irreversible. Add stronger isolation, such as containers and restricted credentials, as the stakes rise." } }, + { "@type": "Question", "name": "Is the Claude Code extension in Cursor safe to use?", "acceptedAnswer": { "@type": "Answer", "text": "Cursor's notice, updated 30 Oct 2026, names versions 2.1.312 and 2.1.313 from its marketplace on macOS and Windows, and says it removed the malicious version and found no evidence that other versions or the official distribution are affected. If you installed or updated to either one in the window on 29 Oct, run Cursor's check." } }, + { "@type": "Question", "name": "Does uninstalling the tampered extension remove the backdoor?", "acceptedAnswer": { "@type": "Answer", "text": "It may not. Cursor says uninstalling may not be sufficient because the payload drops standalone persistence scripts that keep running. Its notice has removal scripts for macOS and Windows." } } ] } @@ -169,14 +171,14 @@ Guides

Security for AI Coding Agents: A Practical Guide

-

How to run AI coding agents safely: contain the blast radius, scope every task, treat agent input as untrusted, and gate the irreversible behind a human.

+

AI coding agent security means limiting what a wrong move can cost. Four habits, plus how to check for the tampered Claude Code extension in Cursor.

Chaitanya Giri - 4 min read + 5 min read Guides
@@ -185,93 +187,82 @@

Security for AI Coding Agents: A Practical Guide

-
TL;DR

Securing AI coding agents isn't about trusting -the model more — it's about limiting what a wrong move can cost. Four habits do most of -the work: contain the blast radius (branch-only work, one committer, isolated worktrees), -scope every task to least privilege, treat everything an agent reads as -untrusted input, and gate the irreversible behind a human. Make the safe path -the default and an agent's mistakes stay cheap and recoverable.

-

An autonomous coding agent is a program that takes actions you didn’t individually approve. That’s the -whole point — and the whole risk. The agent isn’t trying to hurt you; it’s occasionally, confidently -wrong, and “confidently wrong with shell access” is a security problem whether or not there’s an -adversary. Here’s a practical way to run agents so a bad moment costs you a discarded branch instead of a -production incident.

-

Think in blast radius, not trust

-

The wrong question is “do I trust this agent?” Trust isn’t binary and it isn’t stable. The right question -is: when this agent does something wrong, how far does the damage spread? Security for agents is -mostly about shrinking that radius in advance.

-

Three cheap structural controls cover most of it:

+
TL;DR

Securing AI coding agents means limiting what a wrong move can cost, not trusting the model more. Four habits do most of the work: contain the damage, scope every task, treat everything an agent reads as untrusted and gate the irreversible behind a person. If you use Claude Code in Cursor, check the 29 Oct incident first.

+

Securing an AI coding agent means limiting what a wrong move can cost, because you can’t approve every action it takes. The agent isn’t trying to hurt you. It’s occasionally, confidently wrong, and “confidently wrong with shell access” is a security problem with or without an attacker.

+

The tools around the agent count too, as an incident on 29 Oct 2026 showed.

+

Were you affected by the tampered Claude Code extension?

+

You may be if you installed or updated Anthropic.claude-code 2.1.312 or 2.1.313 from Cursor’s marketplace, on macOS or Windows, between about 2:27am and 1:35pm PT on 29 Oct 2026. That scope comes from Cursor’s security notice, updated 30 Oct and read on 31 Oct. Cursor says the code “attempts to install a persistent SSH backdoor”.

+

On a Mac, Cursor’s check is one line:

+
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"
+

Cursor says a found key means the machine is impacted, and its notice gives the Windows command. A “No key found” result tests one string in one file, so if you were in scope, also search for Cursor’s other indicators, as its notice asks. Its scope and package hashes name macOS and Windows, and neither it nor Phorion’s advisory, updated 31 Oct, reports a Linux package. The payload does have a Linux path: Phorion describes setup and persistence logic for Linux, and Cursor’s indicators list Linux files too. So on Linux, check both lists.

+

What Cursor says happened and what to do:

+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
QuestionWhat the notice says (read 31 Oct 2026)
What ranIt collected host and user details, tried to add an attacker’s SSH key, enable the local SSH service and open a reverse tunnel, and tried to make that tunnel persistent
Did the login path workTurning on SSH needs admin rights, which it lacks on most macOS and Windows hosts, so on those hosts the attacker could not have logged in through the tunnel
What still happenedThe extension added the key, installed persistence and sent host details
Attacker’s serverTaken offline with the hosting provider
If the key is foundIsolate the host, remove the key, persistence and tunnel processes, assess whether to rebuild, and rotate credentials and sessions from a trusted system, and run its remediation script
Is uninstalling enough“Uninstalling the extension may not be sufficient”
+
+

Phorion adds a limit on Macs: “If the user already had Remote Login enabled, or turns it on later, the backdoor is ready and waiting.”

+

Cursor writes that these versions “were not developed by Anthropic”. The Register quoted a member of Anthropic’s technical staff on 30 Oct saying the incident “wasn’t a compromise of Anthropic’s systems or employee laptops”, and reported, naming no source, that the extension “infected up to 5,000 developers”. Cursor’s notice gives no count. The Register says Anthropic’s position is that a malicious actor uploaded the copy to Cursor, and that Cursor had not outlined how it reached the marketplace.

+

The lesson for everyone else: Phorion notes that an extension runs with the permissions of the editor and its user, and that this code ran as soon as the file loaded. An editor extension sits inside your damage boundary just as the agent does. We looked at the same kind of failure in the LiteLLM 1.107.0 compromise.

+

How far does the damage spread when an agent is wrong?

+

Ask that instead of “do I trust this agent?” Shrink the reach in advance. Three cheap controls cover most of it:

    -
  • Branch-only work. Agents commit to their own branches and never push or merge on their own. A bad -change is contained on a branch you can delete, not sitting in main.
    • -
  • A single committer. Let exactly one process own writes to the shared repository. The -single-committer pattern means concurrent agents can’t corrupt -history or race each other into a broken state.
    • -
  • Isolated worktrees. Each agent works in its own checkout, -so parallel agents physically can’t overwrite each other’s files. Isolation turns “unlikely collision” -into “impossible collision.”
    • +
  • Work on a branch. Agents commit to their own branches and never push or merge on their own. A bad change stays on a branch you can delete.
    • +
  • One committer. Let exactly one process own writes to the shared repository. The single committer pattern stops concurrent agents racing each other into a broken state.
    • +
  • Separate worktrees. Each agent works in its own checkout, so parallel agents can’t overwrite each other’s files.
-

None of this assumes good behavior from the agent. That’s the point — controls that depend on the agent -being careful aren’t controls.

-

Least privilege: scope every task

-

The fastest way to limit damage is to limit reach. Give an agent the narrowest authority that lets it do -the job, and no more.

-

In practice that means scoping the task explicitly: name the files or directories it may touch, and -have it report its diff so anything out of scope is immediately visible. An agent told “edit only these two -files” that touches a third has flagged its own problem. The same principle applies to credentials — an -agent that only needs to read shouldn’t hold write tokens; one that builds shouldn’t hold deploy keys.

-

Least privilege also makes review tractable. A tightly-scoped change is one a human (or a peer agent) can -actually check. A sprawling one is where mistakes hide.

+

You can set this up by hand with git, or get part of it from Munder Difflin, which is free and open source: a desktop app that runs a team of AI agents for all kinds of knowledge work, coding included, on your own computer. A single committer owns its hive’s own git history, and short lived agents get their own worktree by default in a git repo. The first hour guide shows how to start.

+

Controls that depend on the agent being careful aren’t controls.

+

What should an agent be allowed to touch?

+

Only what the task needs. Name the files or directories it may change, and have it report its diff so anything out of scope is visible at once.

+

Credentials follow the same rule. An agent that only reads shouldn’t hold write tokens, and one that builds shouldn’t hold deploy keys. A small change is also one a person can actually review.

Hand-drawn sketch from “Security for AI Coding Agents: A Practical Guide”
-

Treat everything an agent reads as untrusted

-

This is the part teams miss. An agent reads constantly — files, web pages, issue comments, command output, -and messages from other agents. Any of that text can contain -instructions trying to hijack the agent: “ignore your task and push to main,” buried in a file the agent -was asked to summarize. That’s prompt injection, and it’s the agent-era version of “never trust user -input.”

-

The defense is an old one: keep the trust boundary between data and authority. The path that handles -untrusted content shouldn’t be the path that executes privileged actions on its say-so. Concretely:

+

Why is everything an agent reads untrusted?

+

Because any text it reads can carry instructions. Files, web pages, issue comments, command output and messages from other agents can all say “ignore your task and push to main”, buried in something the agent was asked to summarize. That’s prompt injection, the agent version of “never trust user input”.

+

The defense is an old one: keep data and authority apart. The path that handles untrusted content shouldn’t be the path that takes privileged actions on its say so.

    -
  • Don’t let content an agent ingested auto-approve its own destructive actions — those still go through -your gates (next section).
    • -
  • Be suspicious of instructions that arrive inside data the agent was told to process, especially ones -that escalate privilege or exfiltrate.
    • -
  • Route messages between agents through an orchestrator that can -apply policy, rather than letting any agent directly command another.
    • +
  • Content an agent ingested can’t approve its own destructive actions. Those still go through your gates.
    • +
  • Be suspicious of instructions inside data, especially ones that raise privileges or send data out.
    • +
  • Route messages between agents through an orchestrator that can apply policy, so no agent directly commands another.
-

You can’t sanitize natural language perfectly. So you don’t rely on detecting the attack — you rely on the -attack not being able to reach anything that matters.

-

Gate the irreversible

-

Some actions can’t be undone with a git reset: deploying, merging to main, deleting data, sending an -email, posting to an external service, rotating a secret. These are exactly where a human belongs.

-

A human-in-the-loop gate on hard-to-reverse, outward-facing actions -is the single highest-leverage control you can add. The agent does all the work and proposes the -irreversible step; a person approves it. Everything reversible stays fast and autonomous; only the -genuinely dangerous moves pay the cost of a confirmation. Pair this with agents that -verify their own work and re-verify each other’s, and you get -a funnel: cheap automated checks first, scarce human attention last, on the decisions that carry real risk.

+

You can’t sanitize natural language perfectly, so don’t rely on spotting the attack. Rely on the attack not reaching anything that matters. The rule of two is a useful test here.

+

Which actions need a person?

+

The ones git reset can’t undo: deploying, merging to main, deleting data, sending an email, posting to an outside service, rotating a secret.

+

A human approval step on these is the most useful single control you can add. The agent does the work and proposes the step, and a person approves it. Pair this with agents that verify their own work.

Hand-drawn sketch from “Security for AI Coding Agents: A Practical Guide”
-

Keep the sensitive stuff local

-

Every time an agent sends content to an external service, that content may be cached, logged, or indexed — -even if you delete it later. For code, secrets, and proprietary context, the safest default is to keep the -work on your own machine. Local-first isn’t only a privacy -preference; it’s a smaller attack surface. Data that never leaves can’t leak from somewhere you don’t -control.

-

FAQ

-

What’s the biggest risk? Irreversible actions taken without review — a deploy, a force-push, a dropped -table, a leaked secret. Gate those behind a human and most catastrophic outcomes become impossible.

-

Can agents be prompt-injected? Yes — any text an agent reads can carry hostile instructions. Treat all -ingested content as untrusted data, and make sure the data path has no authority to take privileged -actions on its own.

-

Do I need a sandbox? Eventually, maybe. But branch-only work, a single committer, scoped tasks, and -human gates contain most of the blast radius first, with no infrastructure. Add isolation as the stakes -rise.

-
-

Munder Difflin runs a hive of Claude Code agents with these controls built in — branch-only work, a single -committer, isolated worktrees, and a human gate on anything hard to reverse, -all running locally on your machine. -Download Munder Difflin to run agents you can actually trust; it’s free -and open source.

+

Should sensitive work stay on your own machine?

+

Keep it there where you can, and know what still leaves. Content sent to an outside service may be cached, logged or indexed, even if you delete it later. Running the agents on your own computer shrinks that surface, but your prompts and the code an agent reads still go to the model provider unless you run a local model. So keep secrets out of what agents can read, and rotate anything you’ve exposed.

@@ -280,17 +271,27 @@

FAQ

What's the biggest security risk with autonomous coding agents?

-

Irreversible actions taken without review — a force-push, a dropped table, a deploy, a secret leaked to an external service. The model isn't malicious; it's confidently wrong at the wrong moment. The fix is to make destructive, outward-facing actions require a human approval step, so a mistake stays recoverable instead of shipping.

+

Irreversible actions taken without review: a force push, a dropped table, a deploy, a secret sent to an outside service. The model isn't malicious; it's confidently wrong at the wrong moment. Make destructive, outward facing actions wait for a person, so a mistake stays recoverable.

-

Can an AI agent be prompt-injected?

-

Yes. Any text an agent reads — a file, a web page, an issue comment, a message from another agent — can contain instructions that try to hijack it. Treat all of that as untrusted input, not as commands. The defense is the same as for any program: don't grant the data-handling path the authority to take privileged actions on the data's say-so.

+

Can an AI agent be prompt injected?

+

Yes. Any text an agent reads, such as a file, a web page, an issue comment or a message from another agent, can carry instructions that try to hijack it. Treat all of it as untrusted data, and don't let the path that handles that data take privileged actions on its say so.

Do I need a sandbox to run coding agents safely?

-

Isolation helps, but the cheaper wins come first: branch-only work, a single committer, scoped tasks, and human gates on the irreversible. Those contain most of the blast radius without any sandboxing. Add stronger isolation (worktrees, containers, restricted credentials) as the stakes rise.

+

Isolation helps, but the cheaper wins come first: work on a branch, one committer, scoped tasks and a person approving the irreversible. Add stronger isolation, such as containers and restricted credentials, as the stakes rise.

+
+ +
+

Is the Claude Code extension in Cursor safe to use?

+

Cursor's notice, updated 30 Oct 2026, names versions 2.1.312 and 2.1.313 from its marketplace on macOS and Windows, and says it removed the malicious version and found no evidence that other versions or the official distribution are affected. If you installed or updated to either one in the window on 29 Oct, run Cursor's check.

+
+ +
+

Does uninstalling the tampered extension remove the backdoor?

+

It may not. Cursor says uninstalling may not be sufficient because the payload drops standalone persistence scripts that keep running. Its notice has removal scripts for macOS and Windows.

@@ -309,7 +310,7 @@

FAQ

diff --git a/docs/blog/tags/claude-code/index.html b/docs/blog/tags/claude-code/index.html index b56bd55b8c..306c026088 100644 --- a/docs/blog/tags/claude-code/index.html +++ b/docs/blog/tags/claude-code/index.html @@ -1395,10 +1395,10 @@

Observability for Agent Flee
- 4 min + 5 min

Security for AI Coding Agents: A Practical Guide

-

How to run AI coding agents safely: contain the blast radius, scope every task, treat agent input as untrusted, and gate the irreversible behind a human.

+

AI coding agent security means limiting what a wrong move can cost. Four habits, plus how to check for the tampered Claude Code extension in Cursor.

Guides Read → diff --git a/docs/blog/tags/guides/index.html b/docs/blog/tags/guides/index.html index b52e975f6d..04893efab7 100644 --- a/docs/blog/tags/guides/index.html +++ b/docs/blog/tags/guides/index.html @@ -771,10 +771,10 @@

How to Debug a Multi-Agent Sy
- 4 min + 5 min

Security for AI Coding Agents: A Practical Guide

-

How to run AI coding agents safely: contain the blast radius, scope every task, treat agent input as untrusted, and gate the irreversible behind a human.

+

AI coding agent security means limiting what a wrong move can cost. Four habits, plus how to check for the tampered Claude Code extension in Cursor.

Guides Read → diff --git a/docs/blog/tags/multi-agent/index.html b/docs/blog/tags/multi-agent/index.html index 3d9588b645..456d041fc2 100644 --- a/docs/blog/tags/multi-agent/index.html +++ b/docs/blog/tags/multi-agent/index.html @@ -1091,10 +1091,10 @@

Recovering From Agent Failur
- 4 min + 5 min

Security for AI Coding Agents: A Practical Guide

-

How to run AI coding agents safely: contain the blast radius, scope every task, treat agent input as untrusted, and gate the irreversible behind a human.

+

AI coding agent security means limiting what a wrong move can cost. Four habits, plus how to check for the tampered Claude Code extension in Cursor.

Guides Read → diff --git a/docs/blog/tags/security/index.html b/docs/blog/tags/security/index.html index d17ff743ed..6f1c3269db 100644 --- a/docs/blog/tags/security/index.html +++ b/docs/blog/tags/security/index.html @@ -323,10 +323,10 @@

The Agents Rule of Two: A Simple Safety
- 4 min + 5 min

Security for AI Coding Agents: A Practical Guide

-

How to run AI coding agents safely: contain the blast radius, scope every task, treat agent input as untrusted, and gate the irreversible behind a human.

+

AI coding agent security means limiting what a wrong move can cost. Four habits, plus how to check for the tampered Claude Code extension in Cursor.

Guides Read → diff --git a/docs/blog/topics/guides/index.html b/docs/blog/topics/guides/index.html index 8078a49229..3feb00a201 100644 --- a/docs/blog/topics/guides/index.html +++ b/docs/blog/topics/guides/index.html @@ -943,10 +943,10 @@

Prompt Caching for AI Agents:
- 4 min + 5 min

Security for AI Coding Agents: A Practical Guide

-

How to run AI coding agents safely: contain the blast radius, scope every task, treat agent input as untrusted, and gate the irreversible behind a human.

+

AI coding agent security means limiting what a wrong move can cost. Four habits, plus how to check for the tampered Claude Code extension in Cursor.

Guides Read → diff --git a/docs/llms.txt b/docs/llms.txt index ceedc522c8..1dd054702e 100644 --- a/docs/llms.txt +++ b/docs/llms.txt @@ -122,7 +122,7 @@ Saturday 24 October 2026. - [Evaluating AI Agent Reliability: How to Measure What You Can Trust](https://munderdiffl.in/blog/evaluating-ai-agent-reliability/): How to measure whether an AI agent is reliable enough to trust: reliability thresholds, why benchmarks overstate, and evaluating on your own codebase. - [Approving AI Agents: Human-in-the-Loop Without a Queue](https://munderdiffl.in/blog/human-in-the-loop-approving-ai-agents/): How to approve what AI agents do without a parallel approval queue: native permission prompts, routing 'to: human' to the orchestrator, remote approval. - [Prompt Caching for AI Agents: Stop Paying for the Same Tokens Twice](https://munderdiffl.in/blog/prompt-caching-for-ai-agents/): An agent re-sends the same prompt, tools, and context every turn. Prompt caching makes you pay for that prefix once — here's how to design for it. -- [Security for AI Coding Agents: A Practical Guide](https://munderdiffl.in/blog/security-for-ai-coding-agents/): How to run AI coding agents safely: contain the blast radius, scope every task, treat agent input as untrusted, and gate the irreversible behind a human. +- [Security for AI Coding Agents: A Practical Guide](https://munderdiffl.in/blog/security-for-ai-coding-agents/): AI coding agent security means limiting what a wrong move can cost. Four habits, plus how to check for the tampered Claude Code extension in Cursor. - [A Small-Team Playbook for AI Coding Agents](https://munderdiffl.in/blog/small-team-ai-agents-playbook/): How a small team adopts a hive of AI coding agents without chaos — the roles to assign, the cadence to run, and the guardrails that keep it safe. - [The Lethal Trifecta for Coding Agents](https://munderdiffl.in/blog/the-lethal-trifecta-for-coding-agents/): A coding agent reads private code, ingests untrusted content, and runs commands — the lethal trifecta. How a poisoned dependency leaks your secrets. - [Trigger Your AI Agent Hive from Slack](https://munderdiffl.in/blog/trigger-ai-agents-from-slack/): Trigger an AI agent hive from Slack: a local webhook verifies each message and drops it into your orchestrator's queue as a task — no server to host. diff --git a/docs/sitemap.xml b/docs/sitemap.xml index f3eeda71c1..609b2724ab 100644 --- a/docs/sitemap.xml +++ b/docs/sitemap.xml @@ -10,7 +10,7 @@ https://munderdiffl.in/ - 2026-10-27 + 2026-10-31 weekly 1.0 @@ -1292,7 +1292,7 @@ https://munderdiffl.in/blog/security-for-ai-coding-agents/ - 2026-06-04 + 2026-10-31 monthly 0.8