Cursor removes malicious Claude Code extension after SSH backdoor attempt

CSO Online

This story is part of the morning brief Breaking: AI-agent attack hits GitBook as ARTEX claims WorkOS and Chainstack, plus a poisoned Claude Code extension. The reporting lives at the original source.

Read at CSO Online

Update, Nov 3 evening: GitBook and two more ARTEX victims disclose breaches. This morning's brief follows: ARTEX's 11-day campaign, a tampered Claude Code extension and abandoned MCP servers show the developer machine is the soft spot.