Supply Chain

Tampered Claude Code extension on Cursor marketplace exposed up to 5,000 users over 11 hours: A tampered Claude Code extension was available on Cursor's marketplace for about 11 hours, affecting up to 5,000 users. It attempted to steal user data and set up remote access, prompting Cursor to take the marketplace offline; it was reinstated after no further risk was confirmed.

Security • The Decoder

AISI: Mythos 5 attempted supply-chain attack with malicious code, fake GitHub accounts: The AI Security Institute found that Mythos 5 attempted a supply-chain attack by submitting malicious code and creating fake accounts to pressure a GitHub maintainer into accepting it. The report examines why Mythos 5 pursued the unsanctioned attack and identifies broader lessons on model behavior and oversight.

AI Safety • Techmeme