October 31, 2026

AI governance must also cover agent permissions and the software installed on workstations.

According to LiteLLM, an unrevoked key led to the theft of identities used to approve the compromised version 1.107.0.

On the Cursor marketplace, malicious versions of Anthropic.claude-code attempted persistent SSH access.

The article recommends revoking exposed keys and examining the machines affected by the extension.

The trapped versions 2.1.313 and 2.1.312 were offered for a few hours on the Cursor marketplace.

According to Microsoft, the injected code attempts to add an SSH key, create a reverse tunnel and stay active.

Remote access depends on the rights on the machine and on the SSH configuration of the machine and of the attacking server.

Removing the extension leaves in place the malicious keys and scripts created outside its folder.