Also available as plain text · markdown source

Security Monitor 2026-10-30

Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

Executive Summary

Today's theme is that a trusted name doesn't vouch for the code behind it. On Thursday, malicious builds published under the name of Anthropic's Claude Code extension sat in Cursor's VS Code extension marketplace for about 11 hours. Cursor says they tried to plant an attacker's SSH key, open a reverse SSH tunnel and persist on macOS and Windows, and The Verge reports that around 5,000 people may have installed it. The same pattern shows up on model hubs and GitHub: Pluto Security found 31 Hugging Face repositories posing as small Qwen2 checkpoints that run a miner and, in some builds, a reverse shell at import time when loaded with trust_remote_code=True, before any weights load, and Check Point tracked fake ChatGPT and Claude desktop apps that sideload malware through genuine signed OpenAI and Anthropic executables.

The KEV clock moved too. CISA added two more Ivanti Connect Secure bugs, CVE-2026-111357 and CVE-2026-118527, today. They complete the exploit chain behind the October 13th zero-day, and Ivanti shipped their fixes yesterday. CVE-2026-111357 is due Monday, November 2nd. On the API side, AI credentials are now the prize: a Red Hat OpenShift AI gateway bug injected another tenant's LLM API keys, a new implant spends the victim's own OpenAI key, and one scanner posed as 32 AI bots to hunt for .env files.

Headline Developments

1. A malicious Claude Code extension build sat in Cursor's marketplace for about 11 hours HIGH

Source: Cursor: Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace (October 29th, updated October 30th). Also The Verge: Cursor says around 5,000 people may have installed a malicious Claude Code extension (October 30th).
- Cursor says modified versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension for Windows and macOS were available in its VS Code extension marketplace from about 5:27 AM to 4:35 PM ET on October 29th. Anthropic didn't build them. The Verge, citing Reuters, reports that Cursor says around 5,000 people may have installed the extension.
- Per Cursor, the payload reports the hostname, username, OS, home directory, environment variable names, working directories, Git email and public IP to the attacker. It then tries to add an attacker's SSH key (comment svc-telemetry) to authorized_keys, turn on the local SSH service, and open a reverse SSH tunnel that it retries about every 60 seconds through a LaunchAgent on macOS or a SysMon scheduled task on Windows.
- Cursor says turning on SSH needs admin rights the extension usually doesn't have, so on most hosts the attacker couldn't log in through the tunnel. But the key, the persistence and the host report could still land, and Cursor warns that uninstalling the extension may not be enough because the payload drops standalone persistence scripts. The attacker's server is offline. Cursor pulled the builds, shut the marketplace down, says no other extensions were tampered with, rotated its keys and rebuilt the marketplace. It hasn't said how the modified package got into the marketplace.

Why this matters: It's HIGH because an AI coding extension runs with the developer's own access to source, tokens and cloud sessions, and the name on the listing was the only check most people made. An extension marketplace is a software supply chain, so treat it like npm or PyPI: pin versions, allowlist publishers and watch for odd updates. A failed backdoor still leaves a planted key and a persistence script behind.

2. CISA adds Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to KEV; the October 13th chain is now fully patched CRITICAL

Source: CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 30th). Also CISA: CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure (updated October 30th), NVD: CVE-2026-111357, Volexity: A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days (updated October 29th) and The Stack: Ivanti patches two more CVEs amid highly unusual Connect Secure exploitation (October 29th).
- CVE-2026-111357 is the privilege escalation step: NVD's record says Ivanti Connect Secure mishandles how the root-run dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, and that it was exploited in the wild in October. NVD lists CVSS 3.1 7.0 from its CNA; The Stack reports Ivanti rates it 8.8. CISA's due date is Monday, November 2nd.
- CVE-2026-118527 is the file-write step: CISA's KEV entry says a predictable identifier lets a remote authenticated attacker upload files with attacker-controlled content to a known location on disk. The Stack reports Ivanti rates it 4.3. CISA added it today with a November 13th due date. There's no public NVD or CVE.org record for it yet.
- Volexity says the actor it tracks as UTA0576 chained these with the October 13th authentication bypass, CVE-2026-104935 (in KEV since October 13th), to get root on an appliance that was fully patched at the time (22.8R2.4), starting October 3rd. It captured LDAP traffic on the appliance to harvest plaintext credentials, searched Active Directory for LAPS passwords and BitLocker keys, and re-ran the whole chain for each command instead of leaving a web shell. The Stack lists the fixes as 25.1.1.3 and 22.8R2.6, released October 29th, for affected 25.1.1.2 and earlier and 22.8R2.5 and earlier. CISA notes that 22.8 reaches end of life January 31st, 2027.

Why this matters: It's CRITICAL because the chain gives unauthenticated root on a VPN gateway that holds domain credentials, and patching for the October 13th bug alone left the root step open for two more weeks. CISA warns that Ivanti's Integrity Checker Tool may not detect this activity because the commands run in memory, so confirming compromise means network and memory forensics, then resetting every credential the appliance held.

3. Model hubs and fake AI apps run the attacker's code before you see a model HIGH

Source: Pluto Security: Load/Mine: A Hugging Face Malware Campaign Returns After Takedown (October 29th). Also Check Point Research: Tricks from the Past deployed via signed ChatGPT and Claude binaries (October 27th).
- Pluto tracked 31 malicious Hugging Face repositories across seven accounts that pose as small Qwen2 test checkpoints. The payload sits in the Python file a model's config.json points to, so trust_remote_code=True runs it at import time, before any weights load. It installs a watchdog with shell startup hooks and a memory-backed miner disguised as a kernel worker, and three second-wave builds add reconnecting reverse shells. Pluto says Hugging Face and ModelScope took the first wave down after its report, a second wave of 19 repositories under four new accounts followed within days, and those were still live eight days after it reported them. Pluto counts more than 29,000 downloads of the second wave, which aren't confirmed infections. The flagship payload passed the Hub's antivirus and partner scanners.
- Check Point says the campaign it tracks as Yoba has spent about two months publishing fake GitHub projects named for AI desktop apps such as "GPT-6 Astra" and "Claude Opus," ranked high in Google results. Each ZIP pairs a genuine signed OpenAI or Anthropic executable with a malicious winmm.dll it loads from the same folder. The loader finds its next domain from a Telegram channel's profile picture, resolves it over DNS-over-HTTPS and pulls the payload from a file host. This campaign delivers a Monero miner, but the loader can run any program or PowerShell script. Check Point found no compromise of OpenAI or Anthropic.

Why this matters: It's HIGH because both lures target the machines that hold the most: GPU inference hosts, shared notebooks, CI runners and developer laptops. Model scanners look for poisoned weights, not ordinary Python, and a valid signature on the main EXE says nothing about the DLL next to it. The control that holds is to review and pin model code before you set trust_remote_code, and install AI tools only from the vendor's own download page.

4. AI credentials are the target: gateway key injection, borrowed OpenAI keys and fake AI bots MEDIUM

Source: Red Hat: CVE-2026-117574 and NVD: CVE-2026-117574 (October 28th). Also Cisco Talos: NIK C2: The new AI-enabled command-and-control framework (October 29th) and Cequence: Attackers Are Using AI Agent Impersonation to Hunt for Credentials (October 28th).
- Red Hat OpenShift AI gateway (CVE-2026-117574): Red Hat says ai-gateway-payload-processing picks credentials from a shared store using the model name in the request body or x-gateway-model-name header, with no authorization check, so an authenticated user who names another tenant's model gets that tenant's LLM API keys injected and spends its quota. Red Hat's CNA scores it CVSS 3.1 9.1 and rates it Important. It notes an earlier code change moved the lookup but didn't fix it, and NVD's record names no fixed version. It isn't on KEV.
- NIK C2: Talos says this Go-based Windows implant has more than 52 commands, from credential and wallet theft to keylogging and a screen locker. Its ai_generate command sends the operator's prompts to OpenAI's Chat Completions API from the victim's machine and, if the operator doesn't supply a key, uses the victim's OPENAI_API_KEY environment variable, so the victim pays and the logs point at the victim.
- Fake AI bots: Cequence says one actor rotated through about 32 AI crawler and assistant identities, including ChatGPT, Claude and Perplexity, to request about 90 paths that usually hold secrets, such as .env files and SSH keys. On one day in October it reached 48% of the Cequence-protected organizations that saw any AI bot traffic, and it used more than 300 cloud addresses in one day. Cequence says nearly all of its requests were blocked or failed. Treat the reach figures as a vendor claim.

Why this matters: It's MEDIUM because none of these is a mass compromise on its own, but together they show what attackers want from AI deployments: the provider keys. In a multi-tenant gateway, a model name works like an account ID, so authorization has to come before the credential lookup. A key in an environment variable is a key anyone on the host can spend, and a user-agent string isn't an identity.

Continuity Footnotes

  • GitLab CVE-2026-97229 and Cisco ASA / FTD CVE-2026-76418: covered October 29th. Both are on KEV with a federal due date of this Sunday, November 1st. Nothing new today.
  • Linux kernel CVE-2026-46300 (Fragnesia): covered October 28th and 29th. The KEV due date is tomorrow, Saturday, October 31st.
  • Linux kernel CVE-2026-98432: covered October 29th. New today: Red Hat rates it Critical (CVSS 3.1 9.8) and points to a security bulletin with mitigation steps (Red Hat: CVE-2026-98432), and Ubuntu lists its kernel updates as work in progress for 22.04 through 26.10, with no fixed package released yet (Ubuntu: CVE-2026-98432). It isn't on KEV.

Pattern Analysis

  1. The name on the package isn't the package (October 25th to 30th): a marketplace listing for Claude Code, a Qwen2 model card, a signed OpenAI or Anthropic EXE and an AI crawler's user-agent all carried attacker code or traffic today (Stories 1, 3 and 4). Verify what runs, not what it's called.
  2. AI tooling is where the credentials are (October 28th to 30th): developer extensions, GPU hosts, gateways holding provider keys and environment variables with API keys (Stories 1, 3 and 4). Attackers go where one foothold reaches source, cloud and model spend at once.
  3. Partial patches leave the chain open (October 13th to 30th): Ivanti fixed the entry bug on October 13th and the root step on October 29th (Story 2). An exploited chain isn't closed until every link is fixed, and forensics should cover the whole window.

Immediate (today):
1. Cursor users on macOS or Windows: if you installed or updated Anthropic.claude-code 2.1.312 or 2.1.313 from Cursor's marketplace on October 29th, run Cursor's svc-telemetry key check. If the key is there, isolate the host, remove the key, the LaunchAgent or SysMon task and the scripts using Cursor's remediation steps, and rotate credentials the host could reach from a clean machine.
2. Ivanti Connect Secure: upgrade to 25.1.1.3 or 22.8R2.6, or the fixed release for your line in Ivanti's advisory, before CVE-2026-111357's November 2nd due date. Run network and memory forensics back to early October, and reset the LDAP and AD service account credentials the appliance stored.
3. GitLab, Cisco ASA / FTD and Fragnesia: finish the October 29th actions before Saturday's and Sunday's KEV deadlines.

This week:
4. Model loading: block trust_remote_code=True by policy except for reviewed, pinned revisions from publishers you trust. Check GPU and inference hosts against Pluto's indicators.
5. OpenShift AI gateway: check Red Hat's CVE page for fix status, and review provider billing for cross-tenant use.
6. Editor extensions: allowlist extension publishers and pin versions for AI coding tools in managed IDEs. Alert on new authorized_keys entries and new LaunchAgents or scheduled tasks on developer machines.

Ongoing:
7. Keep model provider keys out of environment variables on endpoints. Use a secrets manager, cap spend per key and alert on calls from unexpected hosts.
8. Don't allowlist AI bots by user-agent. Verify crawlers by published IP ranges or signed requests, and make sure secret files are never served.

Relevant Risk Summary

Risk Severity Recommended Actions
Malicious Claude Code extension build in Cursor's marketplace (2.1.312 / 2.1.313) HIGH Check for svc-telemetry key; remove persistence; rotate credentials
Ivanti Connect Secure CVE-2026-111357 (KEV, due Nov 2) and CVE-2026-118527 (KEV, due Nov 13) CRITICAL Upgrade to 25.1.1.3 / 22.8R2.6; memory forensics; reset stored credentials
Malicious Hugging Face models via trust_remote_code; Yoba fake AI desktop apps HIGH Review and pin model code; vendor-only downloads
OpenShift AI gateway CVE-2026-117574 (9.1); NIK C2 OpenAI key abuse; fake AI bots MEDIUM Authorize before credential lookup; keys in a secrets manager; verify bots by IP or signature
GitLab CVE-2026-97229 and Cisco CVE-2026-76418 (KEV, due Nov 1); Fragnesia CVE-2026-46300 (KEV, due Oct 31) CRITICAL Finish patching before the weekend deadlines

Sources

Informational security guidance. Not certification.