Cursor Served Tampered Claude Code

If You Only Read One Thing

A coding agent can respect every instruction and still arrive carrying malware. Cursor's tampered Claude Code packages make the installation route part of the trust decision. DeepSeek's Super-agent tackles a different route: which incoming messages may start work. Together they expose how much happens before a model gets to decide whether a request is safe.

Cursor's Claude Code packages left persistence outside the extension

Removing a compromised coding extension doesn't necessarily remove what it installed. That's the recovery problem in Cursor's Claude Code incident: the malicious package could leave startup scripts and an unauthorized SSH key elsewhere on the computer.

Cursor says tampered versions 2.1.312 and 2.1.313 were available for Windows and macOS on October 29, from about 2:27 AM to 1:35 PM Pacific. That's roughly 11 hours in which an ordinary installation or automatic update could deliver the payload. Microsoft says the packages weren't distributed through Microsoft's Visual Studio Marketplace or the Claude Code npm package. The publisher name and version alone therefore don't establish exposure; the marketplace matters too.

The injected code ran when the extension loaded, before its normal initialization. Microsoft's forensic analysis found attempts to establish remote access through SSH and keep that access alive after restart. The extension could continue working normally. A successful coding session wasn't evidence that the installed package was clean.

Cursor says code errors and the need for administrator privileges prevented SSH access on most affected Windows and Mac hosts. It also took the attacker's server offline. Those are substantial limits on what the attack could accomplish. They don't establish that every exposed machine escaped modification, or that uninstalling the extension restored it.

The investigation has two separate questions: did the malicious loader run, and did anyone subsequently gain access? Microsoft distinguishes the host information the loader collected from proof of secret theft. Its recovery guidance also says a missing SSH-key marker cannot substitute for reviewing installation records, processes, network traffic and startup files. An attempted connection and a completed intrusion require different evidence.

That changes the unit of recovery. An extension directory is only one place the package could write. Cursor provides platform-specific cleanup scripts; the incident's published indicators let investigators look for effects beyond the editor. A version inventory identifies where to investigate, while those external traces establish what happened there.

October 30's briefing examined browser privileges inside coding assistants. This is a separate failure: altered software arrived through a distribution channel before any browser page or prompt entered the picture. Better model refusals wouldn't have prevented its loader from running. Recovery is incomplete if a confirmed malicious startup entry or SSH authorization survives a login or restart.

DeepSeek's Super-agent separates incoming context from permission

DeepSeek's Super-agent makes a persistent coding service inspectable, including the decision that comes before dispatch: is this message allowed to create work? An agent following team conversations all day must distinguish discussion from instructions.

The October 31 public prototype watches one GitHub repository and optionally Feishu conversations. Accepted work gets its own agent session and directory, and results return to the originating conversation. DeepSeek calls this research code, adapted from its internal system. Some proposed designs aren't implemented, and no controlled result shows productivity or reliability gains.

Ordinary orchestration starts with an assigned task and asks how to divide it. An always-on service has an earlier problem. A bug report, a passing complaint and a bot's CI message can all describe useful work. Treating each as an instruction would let the surrounding conversation continually expand the agent's assignment.

DeepSeek's authorization design separates those cases. Allowed senders and team-written rules govern admission. Once accepted, a work item carries a recorded scope of authority. Messages in a followed thread can supply context without granting additional permission. An out-of-scope follow-up goes back for routing instead of silently enlarging the existing task.

That separation has an operational benefit even before anyone measures faster delivery: the system can explain why it started work. A reviewer can inspect the originating request and authorized scope rather than reconstructing intent from a long transcript. A CI failure can inform a repair without becoming permission to change unrelated infrastructure. The distinction is between learning that something happened and acquiring the right to act on it.

The execution design also gives a human follow-up one extra worker slot when ordinary capacity is full. A queue of autonomous jobs therefore needn't prevent someone from continuing an existing task. That addresses a coordination failure that adding more parallel workers alone doesn't solve.

But a recorded scope isn't an operating-system sandbox. Workers run commands without approval as the operator's OS user. DeepSeek warns that its directories and command wrappers aren't security boundaries; a program can still be invoked by absolute path. The host controls who starts work, while actual containment still depends on the execution environment. Cursor's incident shows why that second layer matters.

DeepSeek hasn't shown how much work the service completes for each human interruption, or how often it acts outside its assignment. Fewer interruptions would be a poor bargain if they came with more unauthorized actions.

The Contrarian Take

Everyone says: Once an agent has its own worktree and a narrow assignment, it is isolated from the rest of the machine.

Here's why that's wrong: A worktree separates checkouts. It doesn't change the OS user's file permissions, credentials or ability to start programs. DeepSeek states that limitation explicitly, even though its prototype records task authority and gives workers separate directories. Cursor's loader illustrates the consequence of software executing with user access: effects can persist outside the component that launched them. A clean diff cannot establish a clean machine. Isolation has to be demonstrated by what the process cannot reach, not inferred from where its repository lives.

Under the Radar

Claude Code can give subagents a different default effort. Version 2.1.316, dated October 31, adds CLAUDE_CODE_SUBAGENT_EFFORT for workers without another explicit effort setting. They no longer have to inherit the session's setting. This makes a high-effort coordinator and cheaper routine workers configurable without changing every worker definition. The release supplies a control, not a measured saving: lower effort still needs comparison on completed work and retries. Release notes.
Provider fallback now accounts for where state lives. Pydantic AI 2.64.0, released October 30, sends stored response and conversation identifiers only to the endpoint that created them. It also exposes an exhausted transport retry as ModelHTTPError, allowing fallback to proceed. These changes address two different ways a supposedly portable request can fail: carrying another server's private state, or never reaching the fallback handler. Neither makes remote conversation state portable. Release notes.

Quick Takes

A ChatGPT share link crossed into the signed-in session. Parameter's October 28 disclosure, amplified by Simon Willison on October 31, describes a preview frame reaching a MathLive message listener and ultimately executing code with ChatGPT's web identity. Researchers retrieved private conversation data. OpenAI fixed the issue October 26. The design lesson is specific: isolating generated HTML doesn't help if a privileged listener accepts its state-changing messages without authenticating the sender. (Source)
Codex repairs what survives a resumed session. The October 29 release, 0.166.0, preserves acknowledged approval and permission settings across resume and fork. It also retains reasoning-token accounting to avoid premature compaction. Restoring the visible conversation isn't enough to restore the same working conditions; permissions and context accounting travel with it. These are shipped repairs, with no measured claim that long-running task completion improves. (Source)
The memory-file attack study found mixed effects. An October 28 experiment tested malicious project guidance across 36 coding tasks. Secure-completion rates changed by minus eight to plus six percentage points, without a consistent pattern across agents or attack variants. Recognizing the malicious guidance also didn't reliably protect the generated code. That supports inspecting actual output security; it doesn't establish a general attack-success rate or show that memory files uniformly make agents less secure. (Source)

The Thread

An always-on agent needs a record of why each action was allowed. DeepSeek records that authority when work starts; the Cursor incident shows that installed software can acquire machine access without any task being accepted at all. Put those together and the audit has to connect three things: the code that ran, the request that authorized the work, and the permissions the process actually held. Keeping only the conversation loses the first and third. Keeping only a diff loses almost everything about actions that didn't change the repository. This extends the recent discussion of agent boundaries into accountability: when something goes wrong, the system needs to distinguish an authorized task gone wrong from an action nobody authorized. More complete transcripts won't answer that question unless the installation and execution records can be joined to them.

Predictions

I predict: By November 30, the public DeepSeek Super-agent execution documentation will still describe workers as running under the operator's OS user, rather than making a dedicated container or VM mandatory for every task. The prototype currently treats directories as organization, and introducing mandatory containment would change its deployment requirements. (Confidence: medium; Check by: 2026-11-30)

Issue date: 2026-11-01 · Generated: 07:35 AM ET.