Know Your AI Toolchain: Lessons from the Cursor Marketplace Incident
_A fake Claude Code extension sat in Cursor’s marketplace for 11 hours. Here’s what every engineering team should check now, and why it’s a good moment to rethink who controls your AI stack._
On October 29, a tampered build of Anthropic's Claude Code extension, version 2.1.313, appeared in Cursor's VS Code extension marketplace. Anthropic didn't build it. It was live from about 2:27am to 1:35pm PT, and up to 5,000 users may have installed it.
Cursor caught it, pulled it, shut down the marketplace, rotated keys and worked with the host to take the attacker's server offline. They also published a clear, detailed security notice. That's the right response, and they deserve credit for it.
But the attack itself is the part worth studying. It was simple. And it will happen again, to some tool, somewhere.
What the extension did
--------------------------
The malicious build tried to plant a persistent SSH backdoor. According to Cursor, it:
- Collected host details: hostname, username, OS, home directory, environment variable names, Git email and public IP.
- Added an attacker-controlled SSH key (labeled svc-telemetry) to authorized_keys.
- Tried to enable the local SSH service and open a reverse tunnel. This step failed on most machines, because it needs admin rights.
- Installed persistence through a LaunchAgent on macOS or a scheduled task on Windows, retrying the tunnel every 60 seconds.
- Reported back to the attacker over HTTP.
If you installed or updated that version during the window, act now. Check for the svc-telemetry key, run Cursor's remediation script, and rotate credentials from a clean machine. Uninstalling the extension alone is not enough. The payload leaves scripts that keep running. Cursor's notice has the full steps and indicators of compromise.
Why this one matters
------------------------
Nothing here was clever. A trusted name. A new version number. An install or auto-update. That was enough.
The lesson is bigger than one marketplace. AI coding tools now run a growing stack of add-ons: extensions, MCP servers, skills and plugins. Many of them can read your repo, run shell commands and touch your environment. Your software supply chain has moved into the editor, and most teams aren't watching it yet.
Know Your AI Toolchain
--------------------------
One of our engineers put it well in an internal thread: teams need a habit of knowing their AI toolchain. For every extension, MCP server, skill and plugin, you should be able to answer four questions:
1. Who made it? Is the publisher who you think it is?
2. What changed? What's different in this version from the last one you trusted?
3. What does it do? Does its behavior match its stated purpose?
4. What is it allowed to do? Which files, commands, networks and secrets can it reach?
In practice, that means a few concrete steps:
- Allowlist publishers and pin versions for anything with shell or file access. Don't let agent extensions auto-update unreviewed.
- Run editors without admin rights. In this incident, missing admin rights stopped the worst step on most machines.
- Review MCP servers like dependencies. Know where each one comes from and what tools it exposes.
- Watch the usual persistence spots. ~/.ssh/authorized_keys, LaunchAgents, scheduled tasks and startup folders.
- Centralize policy. Developers shouldn't each decide alone which tools and models are safe.
Where Kilo stands
---------------------
To be clear: no editor is immune. Kilo ships as an extension too, and we hold ourselves to the same four questions.
Here's how we help teams answer them:
- Open source. Kilo's code is public on GitHub. You can see what it does and what changed.
- Admin controls. Kilo Enterprise lets you set which models and providers each org and sub-org can use, with SSO, SCIM, role-based access and audit logs.
- Provider policies. Filter providers by training policy, prompt retention and location.
- Coding guardrails. Kilo works with Enkrypt AI's guardrails, which check each prompt, tool call (including shell commands) and tool result against a policy your security team sets. A pasted API key, or an instruction hidden in a README, is blocked before the agent acts on it, and every block is logged for audit.
- Coming next. Admins will be able to turn on guardrails for every Kilo user in one place, and MCP Scan and Skill Scan, by Enkrypt AI, will check MCP servers and skills before they run
The other reason teams are rethinking Cursor
------------------------------------------------
Security isn't the only pressure. Cursor's model access is shifting too:
- OpenAI has said it won't supply future models to Cursor following Cursor's acquisition by SpaceX.
- OpenAI model access in Cursor is scheduled to end November 12, 2026.
- Cursor's new X Subscription plans drop the included third-party model allowance.
The common thread: your toolchain shouldn't depend on one vendor's marketplace or one vendor's provider deals. You should control both.
The Cursor Exodus: Kilo Enterprise, free for your remaining term
--------------------------------------------------------------------
If you're on a Cursor enterprise contract and want out, we'll make the move easier. Through the Cursor Exodus offer:
- Kilo Enterprise is free for the rest of your Cursor contract, up to 12 months.
- Seats match 1:1 with your Cursor seats.
- 500+ models, including GPT, with zero markup on token prices through the Kilo Gateway.
- Bring your own keys, local models or eligible ChatGPT Plus and Pro subscriptions.
- Apply by November 30, 2026.
AI usage is billed separately, and no credits are included. The offer is discretionary and needs a signed attestation plus a redacted proof of your Cursor contract. It doesn't cancel or reimburse your Cursor contract.
You don't have to switch overnight. Pilot Kilo on real repositories alongside Cursor, compare quality and cost, then roll out. Our migration guide walks through it, and you can read what Anaconda's engineers found when they made the same move.
!substackcdn.com
The takeaway
----------------
Whatever editor you use, audit your AI toolchain this week. Know who made each piece, what changed, what it does and what it can touch.
And if you're ready to take back control of your models and your stack, claim the Cursor Exodus offer.
Gleiches Modell und völlig unbrauchbar?!
Hier geht's zu WECHSELPILOT: wechselpilot.short.gy [Werbung]
Mit dem Code MORPHEUS bekommt ihr zusätzlich 20 € Cashback auf den ersten Wechsel.
Teil 2 vom CLI-Benchmark: GitHub Copilot CLI, OpenCode und Kilo Code bekommen dasselbe Modell wie die Tools aus Teil 1, Gemini 3.7 Flash, und dieselbe Aufgabe: MorphCook mit genau einem Prompt bauen. Ich schaue mir an, was jeder Harness daraus macht, wer mitten in der Arbeit stehen bleibt und was das am Ende kostet.
Quellen zum Video:
TheMorpheus407/morphcook
github/copilot-cli
anomalyco/opencode
Kilo-Org/kilocode
MorphReader im PlayStore:
play.google.com
MorphReader im App Store:
apps.apple.com
Newsletter und RSS-Feeds:
patreon.com
Kostenlos Informatik lernen mit der Bootstrap Academy:
bootstrap.academy
github.com/Bootstrap-Academy
Instagram:
instagram.com
Meine anderen Kanäle und Projekte:
the-morpheus.de
Discord:
the-morpheus.de
Unterstützt mich – danke!
patreon.com
paypal.me
Kapitel:
0:00 Intro
1:22 Werbung: WECHSELPILOT
2:56 Grundlagen: Testaufbau, Modell, Sandbox, Kosten
8:48 GitHub Copilot CLI: Intro
11:11 GitHub Copilot CLI: Auswertung
21:21 OpenCode: Intro
22:57 OpenCode: Auswertung des Neulaufs
35:40 Kilo Code: Intro
37:51 Kilo Code: Auswertung
46:26 Fazit & Ausblick auf Teil 3
[en-US] Same model and completely unusable?!
Here's the link to WECHSELPILOT: wechselpilot.short.gy [Advertisement]
Use the code MORPHEUS to get an additional €20 cashback on your first switch.
Part 2 of the CLI benchmark: GitHub Copilot CLI, OpenCode, and Kilo Code are given the same model as the tools from Part 1, Gemini 3.7 Flash, and the same task: to build MorphCook with just one prompt. I'll see what each harness can do, which one gets stuck mid-project, and what the final cost is.
Part 2 of the CLI benchmark: GitHub Copilot CLI, OpenCode, and Kilo Code are given the same model as the tools from Part 1, Gemini 3.7 Flash, and the same task: to build MorphCook with exactly one prompt. Sources for the video:
TheMorpheus407/morphcook
github/copilot-cli
anomalyco/opencode
Kilo-Org/kilocode
MorphReader on the Play Store:
play.google.com
MorphReader on the App Store:
apps.apple.com
Newsletter and RSS feeds:
patreon.com
Learn computer science for free with Bootstrap Academy:
bootstrap.academy
github.com/Bootstrap-Academy
Instagram:
instagram.com
My other channels and projects:
the-morpheus.de
Discord:
the-morpheus.de
Support me – thank you!
patreon.com
paypal.me
Chapters:
0:00 Intro
1:22 Advertisement: WECHSELPILOT
2:56 Basics: Test setup, model, sandbox, costs
8:48 GitHub Copilot CLI: Intro
11:11 GitHub Copilot CLI: Evaluation
21:21 OpenCode: Intro
22:57 OpenCode: Evaluation of the rerun
35:40 Kilo Code: Intro
37:51 Kilo Code: Evaluation
46:26 Conclusion & Outlook on Part 3
583 likes · 74 comments · 37,054 views
Mentions
Know Your AI Toolchain: Lessons from the Cursor Marketplace Incident _A fake Claude Code extension sat in Cursor’s marketplace for 11 hours. Here’s what every engineering team should check now, and why it’s a good moment to rethink who controls your AI stack._ On October 29, a tampered build of Anthropic's Claude Code extension, version 2.1.313, appeared in Cursor's VS Code extension marketplace. Anthropic didn't build it. It was live from about 2:27am to 1:35pm PT, and up to 5,000 users may have installed it. Cursor caught it, pulled it, shut down the marketplace, rotated keys and worked with the host to take the attacker's server offline. They also published a clear, detailed security notice. That's the right response, and they deserve credit for it. But the attack itself is the part worth studying. It was simple. And it will happen again, to some tool, somewhere. What the extension did -------------------------- The malicious build tried to plant a persistent SSH backdoor. According to Cursor, it: - Collected host details: hostname, username, OS, home directory, environment variable names, Git email and public IP. - Added an attacker-controlled SSH key (labeled svc-telemetry) to authorized_keys. - Tried to enable the local SSH service and open a reverse tunnel. This step failed on most machines, because it needs admin rights. - Installed persistence through a LaunchAgent on macOS or a scheduled task on Windows, retrying the tunnel every 60 seconds. - Reported back to the attacker over HTTP. If you installed or updated that version during the window, act now. Check for the svc-telemetry key, run Cursor's remediation script, and rotate credentials from a clean machine. Uninstalling the extension alone is not enough. The payload leaves scripts that keep running. Cursor's notice has the full steps and indicators of compromise. Why this one matters ------------------------ Nothing here was clever. A trusted name. A new version number. An install or auto-update. That was enough. The lesson is bigger than one marketplace. AI coding tools now run a growing stack of add-ons: extensions, MCP servers, skills and plugins. Many of them can read your repo, run shell commands and touch your environment. Your software supply chain has moved into the editor, and most teams aren't watching it yet. Know Your AI Toolchain -------------------------- One of our engineers put it well in an internal thread: teams need a habit of knowing their AI toolchain. For every extension, MCP server, skill and plugin, you should be able to answer four questions: 1. Who made it? Is the publisher who you think it is? 2. What changed? What's different in this version from the last one you trusted? 3. What does it do? Does its behavior match its stated purpose? 4. What is it allowed to do? Which files, commands, networks and secrets can it reach? In practice, that means a few concrete steps: - Allowlist publishers and pin versions for anything with shell or file access. Don't let agent extensions auto-update unreviewed. - Run editors without admin rights. In this incident, missing admin rights stopped the worst step on most machines. - Review MCP servers like dependencies. Know where each one comes from and what tools it exposes. - Watch the usual persistence spots. ~/.ssh/authorized_keys, LaunchAgents, scheduled tasks and startup folders. - Centralize policy. Developers shouldn't each decide alone which tools and models are safe. Where Kilo stands --------------------- To be clear: no editor is immune. Kilo ships as an extension too, and we hold ourselves to the same four questions. Here's how we help teams answer them: - Open source. Kilo's code is public on GitHub. You can see what it does and what changed. - Admin controls. Kilo Enterprise lets you set which models and providers each org and sub-org can use, with SSO, SCIM, role-based access and audit logs. - Provider policies. Filter providers by training policy, prompt retention and location. - Coding guardrails. Kilo works with Enkrypt AI's guardrails, which check each prompt, tool call (including shell commands) and tool result against a policy your security team sets. A pasted API key, or an instruction hidden in a README, is blocked before the agent acts on it, and every block is logged for audit. - Coming next. Admins will be able to turn on guardrails for every Kilo user in one place, and MCP Scan and Skill Scan, by Enkrypt AI, will check MCP servers and skills before they run The other reason teams are rethinking Cursor ------------------------------------------------ Security isn't the only pressure. Cursor's model access is shifting too: - OpenAI has said it won't supply future models to Cursor following Cursor's acquisition by SpaceX. - OpenAI model access in Cursor is scheduled to end November 12, 2026. - Cursor's new X Subscription plans drop the included third-party model allowance. The common thread: your toolchain shouldn't depend on one vendor's marketplace or one vendor's provider deals. You should control both. The Cursor Exodus: Kilo Enterprise, free for your remaining term -------------------------------------------------------------------- If you're on a Cursor enterprise contract and want out, we'll make the move easier. Through the Cursor Exodus offer: - Kilo Enterprise is free for the rest of your Cursor contract, up to 12 months. - Seats match 1:1 with your Cursor seats. - 500+ models, including GPT, with zero markup on token prices through the Kilo Gateway. - Bring your own keys, local models or eligible ChatGPT Plus and Pro subscriptions. - Apply by November 30, 2026. AI usage is billed separately, and no credits are included. The offer is discretionary and needs a signed attestation plus a redacted proof of your Cursor contract. It doesn't cancel or reimburse your Cursor contract. You don't have to switch overnight. Pilot Kilo on real repositories alongside Cursor, compare quality and cost, then roll out. Our migration guide walks through it, and you can read what Anaconda's engineers found when they made the same move. !substackcdn.com The takeaway ---------------- Whatever editor you use, audit your AI toolchain this week. Know who made each piece, what changed, what it does and what it can touch. And if you're ready to take back control of your models and your stack, claim the Cursor Exodus offer.
换模型就得换工具，账单还加价？ kilocode 是开源 coding agent：VS Code、JetBrains、CLI 都能用，500+ 模型按提供商原价、零加价。 适合一个工具通吃多模型的人，先从常用模型试起。 先用哪个模型，Claude 还是 DeepSeek？ #AI编程 #开源 @grok Kilo-Org/kilocode
Gleiches Modell und völlig unbrauchbar?! Hier geht's zu WECHSELPILOT: wechselpilot.short.gy [Werbung] Mit dem Code MORPHEUS bekommt ihr zusätzlich 20 € Cashback auf den ersten Wechsel. Teil 2 vom CLI-Benchmark: GitHub Copilot CLI, OpenCode und Kilo Code bekommen dasselbe Modell wie die Tools aus Teil 1, Gemini 3.7 Flash, und dieselbe Aufgabe: MorphCook mit genau einem Prompt bauen. Ich schaue mir an, was jeder Harness daraus macht, wer mitten in der Arbeit stehen bleibt und was das am Ende kostet. Quellen zum Video: TheMorpheus407/morphcook github/copilot-cli anomalyco/opencode Kilo-Org/kilocode MorphReader im PlayStore: play.google.com MorphReader im App Store: apps.apple.com Newsletter und RSS-Feeds: patreon.com Kostenlos Informatik lernen mit der Bootstrap Academy: bootstrap.academy github.com/Bootstrap-Academy Instagram: instagram.com Meine anderen Kanäle und Projekte: the-morpheus.de Discord: the-morpheus.de Unterstützt mich – danke! patreon.com paypal.me Kapitel: 0:00 Intro 1:22 Werbung: WECHSELPILOT 2:56 Grundlagen: Testaufbau, Modell, Sandbox, Kosten 8:48 GitHub Copilot CLI: Intro 11:11 GitHub Copilot CLI: Auswertung 21:21 OpenCode: Intro 22:57 OpenCode: Auswertung des Neulaufs 35:40 Kilo Code: Intro 37:51 Kilo Code: Auswertung 46:26 Fazit & Ausblick auf Teil 3 [en-US] Same model and completely unusable?! Here's the link to WECHSELPILOT: wechselpilot.short.gy [Advertisement] Use the code MORPHEUS to get an additional €20 cashback on your first switch. Part 2 of the CLI benchmark: GitHub Copilot CLI, OpenCode, and Kilo Code are given the same model as the tools from Part 1, Gemini 3.7 Flash, and the same task: to build MorphCook with just one prompt. I'll see what each harness can do, which one gets stuck mid-project, and what the final cost is. Part 2 of the CLI benchmark: GitHub Copilot CLI, OpenCode, and Kilo Code are given the same model as the tools from Part 1, Gemini 3.7 Flash, and the same task: to build MorphCook with exactly one prompt. Sources for the video: TheMorpheus407/morphcook github/copilot-cli anomalyco/opencode Kilo-Org/kilocode MorphReader on the Play Store: play.google.com MorphReader on the App Store: apps.apple.com Newsletter and RSS feeds: patreon.com Learn computer science for free with Bootstrap Academy: bootstrap.academy github.com/Bootstrap-Academy Instagram: instagram.com My other channels and projects: the-morpheus.de Discord: the-morpheus.de Support me – thank you! patreon.com paypal.me Chapters: 0:00 Intro 1:22 Advertisement: WECHSELPILOT 2:56 Basics: Test setup, model, sandbox, costs 8:48 GitHub Copilot CLI: Intro 11:11 GitHub Copilot CLI: Evaluation 21:21 OpenCode: Intro 22:57 OpenCode: Evaluation of the rerun 35:40 Kilo Code: Intro 37:51 Kilo Code: Evaluation 46:26 Conclusion & Outlook on Part 3
Kilo Code is an open source AI coding agent for VS Code, JetBrains, and the terminal. See the repo: Kilo-Org/kilocode t.co
Need an AI agent inside your coding workflow? 🤖 Kilo Code works in editors and the CLI to inspect files, make edits and help debug. Review its changes before shipping. 💻 Kilo-Org/kilocode #AICoding #浇朋友 #蓝朋友 #互关 #fo
写代码遇到 Bug，想让 AI 直接看项目？🤖 Kilo Code 可在编辑器或终端里使用 AI Agent，协助查看文件、修改代码和排查问题。改动记得自己审查。💻 Kilo-Org/kilocode #AICoding #浇朋友 #蓝朋友 #互关 #fo
💸 [Repos That Shouldn't Be Free] kilocode: The Free Tool Taking Over GitHub! #shorts Discover Kilo-Org/kilocode: Kilo is the all-in-one agentic engineering platform. Build, ship, and iterate faster with the most popular open source coding agent. 💬 Comment "KILOCODE" below for the direct link, or grab it from the links below: 👉 Interactive Star History & Live Analysis: githubrepo.cloud ⭐ Embed Live Verified Badges in your README: githubrepo.cloud 🔗 Direct GitHub Repository: Kilo-Org/kilocode 📊 Repository Specs: ⭐ Stars: 27,509 🍴 Forks: 3,236 💻 Language: TypeScript 📜 License: MIT #shorts #kilocode #ai #aiage #aicoding #aidevelopertools #artificialintelligence #machinelearning #deeplearning
@MrPeterLMorris Not just me either kilocode#14475 huggingface.co