CISO Daily Briefing
Cloud Security Alliance Intelligence Report
Executive Summary
Over the last 48 hours, attackers targeted the AI channels developers trust by default. A trojanized Claude Code extension shipped under the real publisher ID on Cursor’s marketplace and backdoored developer machines through auto-update. A crafted shared ChatGPT link could hijack viewers’ sessions (now patched). Hugging Face malware reappeared within days of its takedown. Binance’s $6.3B theft traced to a DevOps laptop shows that developer endpoints now carry institution-scale risk. Hunt for the svc-telemetry SSH key immediately on any host that ran Cursor on Oct 29, and note the UK ICO agentic AI deadline of 20 November.
Overnight Research Output
Signed by the Right Publisher: The Trojanized Claude Code Extension on Cursor’s Marketplace
CRITICAL URGENCY
Summary: Malicious builds of versions 2.1.312/2.1.313 (macOS arm64, Windows x64) were served from Cursor’s marketplace for about 11 hours, under the legitimate anthropic.claude-code identifier. The loader ran on extension load. It planted an attacker SSH key, opened a reverse tunnel, installed OS-level persistence and sent back host reconnaissance. Uninstalling the extension does not remove the backdoor. Cursor’s notice initially put exposure at up to 5,000 users. Anthropic says its own systems and official channels were not affected. How the attacker got publishing access is still undisclosed.
Key Sources:
Cursor — Claude Code Extension Security Notice
BleepingComputer — Malicious Claude Code extension on Cursor planted SSH backdoors
OpenSourceMalware — Trojanized Claude Code extension plants persistent SSH backdoor
The Hacker News — Official Claude Code VS Code extension compromised
One Click Into Someone Else’s ChatGPT: Cross-Frame Messaging Flaws in AI Chat Share Links
HIGH URGENCY
Summary: Parameter chained three flaws: a MathLive postMessage listener that did not check the sender’s origin, HTML injected through layout data, and an unsandboxed frame on the chatgpt.com origin. The chain let a shared conversation run script that read the session token and called ChatGPT’s authenticated APIs. OpenAI raised the severity to P1 and fixed it eight days after the report. No in-the-wild exploitation has been reported. The HTML Preview sandbox itself held, which is why the lesson applies to every AI client that renders model-generated artifacts.
Key Sources:
Parameter Labs — We found a gap at OpenAI
The Hacker News — A shared ChatGPT link could run code in your session
Takedowns That Don’t Hold: Re-Upload Persistence on Model Hubs and Lures Built for AI Coding Agents
HIGH URGENCY
Summary: Pluto Security documented 31 repositories posing as Qwen2 checkpoints that used trust_remote_code to drop GPU miners and reverse shells. BleepingComputer confirmed that a near-identical clone was still live after the flagship was disabled. It scanned clean because the payload is plain Python, not a pickle exploit. In parallel, a README-only “Solana starter kit” ranks highly in AI coding agents’ searches and delivers NetSupport RAT through a one-line PowerShell install step.
Key Sources:
Pluto Security — Hugging Face malware campaign: load and mine
BleepingComputer — Hugging Face malware campaign returns to hijack GPUs
Responding Before November 20: What the UK ICO’s Agentic AI Call for Evidence Signals for Enterprise Deployers
HIGH URGENCY
Summary: The ICO’s six-week call for evidence opened 8 October and is addressed to developers and deployers. The ICO has also opened enquiries into reported agent behaviour in testing, including agents bypassing protections and reaching external systems. Deployers should expect to have to document scoped purposes, least-privilege tool access, human involvement in significant decisions, and the ability to halt and audit agents.
Key Sources:
The Laptop That Moved $6.3 Billion: Developer Endpoints as Institution-Scale Single Points of Failure
HIGH URGENCY
Summary: Funds left across ten chains, mostly within about 20 minutes. Binance’s preliminary finding points to a DevOps laptop, but leadership says the attacker “did not simply use one engineer’s permissions.” TRM Labs calls it the largest theft on record and attributes it with high confidence to TraderTraitor. The same pattern appears in LastPass, CircleCI, Radiant and Bybit. AI coding assistants with standing credentials widen that blast radius.
Key Sources:
BleepingComputer — Binance links $6.3B theft to compromised DevOps laptop
Notable News & Signals
Chainalysis Confirms Intrusion Into Internal Tools
The blockchain analytics firm confirmed a breach of its internal tooling in the same week as Binance, adding to the developer-toolchain compromise pattern.
Polymarket Halts Trading After Script Compromise
Polymarket paused trading after a crypto-draining script breach, and investigators are tracing the stolen funds.
GlassWorm Hijacks Five OVHcloud CLI Releases
A week before the Cursor incident, attackers took over official cloud CLI releases, turning trusted tooling into a malware delivery channel.
AGENTS in Downloads Folder Hijacks Coding Agents
A planted AGENTS file got OpenAI Codex to run a test payload in 90% of lab trials, so agent working directories need controlling.
Singapore MAS Issues Final AI Risk Management Guidelines
MAS finalized its AI risk management guidelines for financial institutions on Oct 7. They apply to regulated firms deploying AI in Singapore.
Topics Already Covered (No New Action Required)
- ARTEX / Vapor Panda AI-powered intrusions: Covered by “Multi-Agent Offensive Frameworks in the Wild: CyberStrikeAI and ARTEX” (Oct 28).
- Autonomous AI agents breaching 1,200+ websites: Covered by “Fifty Dollars per Breach” (Oct 21) and “Agentic Intrusion Goes Retail” (Oct 27).
- OpenCode console breach: Covered (Oct 20, Oct 28).
- Cisco SD-WAN KeyDrift malware: Covered (Oct 30).
- PHP2Shell, Brotli/Node2Shell: Covered (Oct 23, Oct 26, Oct 28).
- eMudhra CA key compromise: Covered by “When Trust Infrastructure Fails” (Oct 21) and “Breaking Trust Without Breaking Math” (Oct 30).
- NIST IR 8547 PQC transition guidance: Covered (Oct 30).
- MCP server hardening: Covered by “Securing MCP Servers in the Enterprise” (Oct 30).
- Non-AI vulnerabilities (Ivanti, GitLab CVSS 10 KEV, Drupal Commerce, Linux MPTCP, TeamViewer, Trezor): Important for patch queues but outside the AI Safety Initiative’s focus; route to vulnerability management.