Two Claude Code versions in Cursor's marketplace carried a backdoor for 11 hours
Get the next issue in your inbox every Monday. Free.
Two versions of the Claude Code extension sat in Cursor's marketplace for about 11 hours with extra code inside, and Anthropic did not build them. This week was about cleaning up after that, limiting what AI agents are allowed to do, and making a shared ChatGPT allowance last.
If you use Claude Code in Cursor
Bad Claude Code extension versions ran in Cursor for 11 hours
Dev Branch reports that on October 29, from 2:27 a.m. to 1:35 p.m. Pacific, two versions of the official Claude Code extension in Cursor's marketplace contained extra malicious code. Cursor estimates at most 5,000 users got them, and the official VS Code Marketplace was not affected. If you installed or updated Claude Code inside Cursor that day on Mac or Windows, treat your machine as possibly compromised, even though Anthropic's own code was untouched.
"On October 29th, starting at 2:27 a.m. Pacific, two versions of the official Claude code extensions sat in that store with something extra inside." (Dev Branch)
▶ Watch at 0:52 · Claude Users Got Hacked. Were You One of Them?
How to check for and clean up the Claude Code backdoor
Educative says to run the grep command from the video on your SSH authorized keys file; any output means the key got in. Then delete the key, run Cursor's remediation script, check SSH logs for logins that used it, rotate secrets whose environment variable names were exfiltrated, and update to 2.1.314, the clean release. A folder named Anthropic Claude Code 2.1.312 is a red flag but not proof, since a clean 2.1.312 exists, so the grep is the real test.
"A 2.1.312 folder on its own doesn't prove anything, because there's a clean 2.1.312 out there, too. So, the grep is the real test." (Educative)
▶ Watch at 3:30 · A Tampered Claude Code Update Was Secretly Hacking Developers
A shorter cleanup checklist if you updated Claude Code in Cursor
Dev Branch suggests: look for svc-telemetry in your authorized keys, run Cursor's cleanup script, remove the startup items, and change any passwords and keys that machine could reach. The clean version is 2.1.314. Uninstalling the extension does not remove the backdoor, so do the full cleanup.
"look for svc-telemetry in your authorized keys, run Cursor's cleanup script, remove the startup items, and change any passwords and keys that machine could reach." (Dev Branch)
▶ Watch at 5:26 · Claude Users Got Hacked. Were You One of Them?
Uninstalling the bad extension leaves the backdoor behind
Mohammad Ebrahimi relays Sophos's warning that removing the extension alone leaves the backdoor artifacts behind. Its guidance covers the unauthorized SSH key, persistence mechanisms, tunnel processes and accessible credentials. The payload wrote a launch agent on macOS and scheduled task and startup folder logic on Windows, so check those places along with authorized keys and review which credentials were reachable.
"Sophos warns that removing the extension alone leaves the backdoor artifacts behind." (Mohammad Ebrahimi)
▶ Watch at 4:46 · This Fake Claude Code Update Hid a Backdoor in Cursor
Keeping agents from doing damage
Give agents permissions, not prompts
Stack Underflowed points out that the code freeze in this story existed only as a sentence in a chat window, so the agent treated it as a polite request, not a permission. If an agent shouldn't delete things, give it an account that cannot delete things. A rule it cannot break beats a rule it might remember.
"If the agent should not delete things, give it an account that cannot delete things. A rule it cannot break beats a rule it might remember." (Stack Underflowed)
▶ Watch at 8:56 · An AI Agent Deleted a Company's Entire Database, Then Lied About It
Require human approval before an agent does anything irreversible
Cost of Intelligence's rule: keep dev and production databases separate, make deletes slow, and keep a backup the AI can't reach. Crane's fix is that deleting something important must need a confirmation an agent can't click through, like typing the volume name or approving by SMS or email. Set this up before you hand an agent production data or infrastructure keys.
"Never give an AI the power to do something you can't undo without a human saying yes first. Keep the test kitchen apart from the real one." (Cost of Intelligence)
▶ Watch at 10:40 · This AI Deleted a Company's Entire Database. Then It Lied About It
Making your ChatGPT allowance last
ChatGPT Chat, Work and Codex will share one usage pool in December
Pocketful of AI reports that OpenAI says Plus, Pro and Business plans will share a single usage pool across Chat, Work and Codex starting in December. Instant chat will not draw from it. Pool size, reset timing, the exact date, and whether image creation or Pro reasoning limits fold in are not yet announced, so heavy chatting may eventually eat into your coding allowance.
"Starting in December, OpenAI has just announced that on Plus, Pro, and Business plans, Chat, Work, and Codex will all share one pool of shared usage." (Pocketful of AI)
▶ Watch at 11:09 · Free, Go, Plus or Pro? ChatGPT’s Plans Updated!
One Astra message costs about as much as 70 Luna messages
ProAI Clips uses OpenAI's published Plus estimates for a 5-hour window: GPT-6 Astra gets 5 to 45 messages, GPT-6.1 Sol about three times that, and GPT-6 Luna roughly 70 times more. These are today's work and Codex numbers, since OpenAI hasn't published December ones. In a shared pool, model choice is the biggest lever on how long your allowance lasts.
"by OpenAI's published plus estimates today, one Astra message costs about the same as 70 Luna messages." (ProAI Clips)
▶ Watch at 2:20 · ChatGPT + Codex Shared Limit: Your Chats Count Too From December
Five ways to stretch the shared ChatGPT and Codex allowance
ProAI Clips suggests Instant for quick questions, Luna for small repetitive edits, Astra for hard bugs, and starting on lower reasoning effort, since OpenAI says Astra on low can beat Sol on high. Before a big Codex job, check settings, then usage, for remaining allowance and reset times. At the cap you can wait, upgrade, or buy credits, which only apply after included usage runs out and are valid for 12 months.
"Luna for small repetitive edits, Astra for the really hard bug." (ProAI Clips)
▶ Watch at 2:47 · ChatGPT + Codex Shared Limit: Your Chats Count Too From December
New in Claude
Claude Dashboards arrive in beta, with Claude Motion
Julian Goldie SEO walks through Anthropic's new Claude Dashboards: you connect a data platform or CRM, ask in plain language, and Claude writes the query and builds a live dashboard that updates as data changes. Each chart shows its query and last refresh time, and you can comment on a chart and tag Claude for changes. Claude Motion turns a dashboard into a short animated video, and the visible query lets you verify each number before you present it.
"Every chart shows the query behind it and when it was last refreshed, so you can check exactly where each number came from." (Julian Goldie SEO)
▶ Watch at 1:03 · Claude's NEW Dashboards Are INSANE (Master Them in 11 Minutes)
Try this week
If you use Claude Code in Cursor, run Educative's authorized keys check today, and give any agent that touches production an account that cannot delete things.
Every week, the most useful things said about AI tools on YouTube, summed up. Forward this to a friend who builds with AI.