Breaking: AI-agent attack hits GitBook as ARTEX claims WorkOS and Chainstack, plus a poisoned Claude Code extension

Breaking (high severity): GitBook says an attacker obtained some of its infrastructure credentials around noon Nov 2 in what it calls "a sophisticated, highly targeted attack using AI agents." The app and private docs sites went offline and were restored Nov 3. Integration tokens, Git Sync secrets, API tokens and GitBook Assistant visitor questions may have been accessed; there's no sign hosted content was altered. GitBook rotated its credentials and revoked customer API tokens, and PancakeSwap moved its docs off GitBook. ARTEX claimed two more victims: WorkOS (a sales app with CRM contacts and customer call, support and Slack excerpts) and Chainstack (dev to production, password hashes, node credentials). What to do: rotate GitBook API tokens and linked secrets, re-authenticate the GitBook MCP server, and rotate node credentials. The take: agents go after doc and sales tools first.

The big one is ARTEX. CrowdStrike attributes a campaign to a China-based group it tracks as Vapor Panda, which used a Go-based, open-source multi-agent penetration-testing framework to go after more than 200 organizations in at least 14 countries, compromising about 140 sensitive targets in 11 days. Kaspersky separately described a Chinese-speaking actor going after schools in Africa and Latin America, and 123 Reg has disclosed an attack on customer data that it suspects is linked. What stands out is the speed. A human crew does not work 200 targets in under two weeks.

If you run an external attack surface, do this today: run the same kind of agentic scan against yourself, and fix the boring findings first, meaning exposed admin panels, stale credentials and unpatched edge devices. Tools like this chew through the easy stuff in bulk, so your defense is mostly making sure the easy stuff isn't there. The practitioner take: the attacker's cost per target just collapsed, which means being a mid-priority target no longer protects you.

Closer to home for anyone writing code with agents, Cursor pulled versions 2.1.312 and 2.1.313 of the Claude Code extension from its marketplace after they tried to add an attacker's SSH key, enable local SSH and open a reverse tunnel. Anthropic says its own systems weren't compromised and that someone with access to Cursor's marketplace published the tampered build. It was live for roughly 11 hours and hit Windows and macOS. If you installed or updated that extension during that window, check ~/.ssh/authorized_keys for keys you don't recognize, look for unexpected reverse tunnels, and rotate anything that lived on that machine. The take here is that an extension marketplace is a software supply chain, and it deserves the same pinning and review you give npm.

Help Net Security also covered Glow Labs research on what it calls MCPhantom. When a developer asks an agent to set up an MCP server, the agent often fills in a package name from its training data, and sometimes that package is an archived, unmaintained reference server. Glow Labs found four high-severity flaws in those servers, including remote code execution in the Puppeteer one through prompt injection, with no patches coming. Audit which MCP servers your team's agents have installed, replace anything archived with a maintained alternative, and pin server names in your agent configs instead of letting the model guess. These servers run through npx, so they never show up in a dependency file, and your SCA tool won't see them.

One more for the incident responders: BleepingComputer reports a 3AM ransomware affiliate that encrypted about 37 of nearly 50 machines at a UK school estate, entering from an unmanaged host. Researchers say the commands look model-generated or revised mid-intrusion, though they stop short of claiming full automation. The lesson is the old one, and it holds up: inventory your unmanaged hosts, because that is where the attacker started.