[{"data":1,"prerenderedAt":867},["ShallowReactive",2],{"blog-post-coding-agent-extension-security-check":3,"related-posts-coding-agent-extension-security-check":840},{"id":4,"title":5,"author":6,"body":11,"category":814,"date":815,"description":816,"extension":817,"featured":818,"hideToc":818,"image":819,"imageAlt":820,"imageHeight":821,"imageWidth":822,"itemList":823,"lang":823,"meta":824,"navigation":825,"noindex":818,"path":826,"readingTime":827,"redirected":818,"relatedSlugs":823,"seo":828,"seoTitle":829,"stem":830,"subtitle":823,"tags":831,"updatedDate":815,"__hash__":839},"blog/blog/coding-agent-extension-security-check.md","Is Your Coding Agent Extension Safe? How to Check Claude Code, Cursor and VS Code",{"name":7,"role":8,"avatar":9,"bio":10},"Shabnam Katoch","Growth Head","/img/avatars/shabnam-profile.jpeg","Shabnam leads growth at BetterClaw and has spent the past three years building organic distribution for AI-native products. She writes about no-code agent builders, content strategy, and what it actually takes to grow without an ads budget.",{"type":12,"value":13,"toc":792},"minimark",[14,18,34,37,40,45,116,119,135,144,148,155,158,161,167,170,173,176,180,186,189,194,197,246,249,267,271,278,282,285,362,370,374,377,412,415,419,425,428,499,507,511,517,522,536,594,597,607,622,632,642,651,655,661,669,672,675,694,697,701,704,712,715,720,735,739,743,746,750,753,757,767,771,774,778,781,785,788],[15,16,17],"p",{},"What the backdoored Claude Code extension did, how to check your installed versions, and the settings that limit damage next time.",[19,20,22],"callout",{"type":21},"quick-fix",[15,23,24,28,29,33],{},[25,26,27],"strong",{},"The Claude Code extension malware"," was real but narrow: tampered copies of Anthropic.claude-code 2.1.312 and 2.1.313 were served by Cursor's extension marketplace on 29 October 2026, between 2:27am and 1:35pm PT. To check, search for an SSH key labelled ",[30,31,32],"code",{},"svc-telemetry",". If it's there, run Cursor's clean-up script and rotate your keys.",[15,35,36],{},"Picture this. You open Cursor on 29 October and Claude Code has updated itself. Your editor looks exactly like it did yesterday.",[15,38,39],{},"That's what made this one tricky. A tampered build and a real one look the same from the outside, so the only way to know is to check. Here's the short version, from Cursor's notice and Microsoft's analysis.",[41,42,44],"h2",{"id":43},"the-claude-code-extension-malware-in-one-table","The Claude Code extension malware in one table",[46,47,48,61],"table",{},[49,50,51],"thead",{},[52,53,54,58],"tr",{},[55,56,57],"th",{},"Question",[55,59,60],{},"Answer (Cursor's notice and Microsoft's analysis)",[62,63,64,73,81,89,97,105],"tbody",{},[52,65,66,70],{},[67,68,69],"td",{},"Which extension",[67,71,72],{},"Anthropic.claude-code 2.1.312 and 2.1.313",[52,74,75,78],{},[67,76,77],{},"Where",[67,79,80],{},"Cursor's VS Code Extension Marketplace only",[52,82,83,86],{},[67,84,85],{},"When",[67,87,88],{},"29 October 2026, 2:27am to 1:35pm PT (about 11 hours)",[52,90,91,94],{},[67,92,93],{},"Builds named",[67,95,96],{},"macOS and Windows",[52,98,99,102],{},[67,100,101],{},"Users",[67,103,104],{},"\"At most 5,000\", Cursor told Reuters",[52,106,107,110],{},[67,108,109],{},"Not affected",[67,111,112,113],{},"Visual Studio Marketplace and npm ",[30,114,115],{},"@anthropic-ai/claude-code",[15,117,118],{},"If you use Claude Code in VS Code or installed it from npm, these builds never reached you. On Cursor, do three things, in this order:",[120,121,122,129,132],"ol",{},[123,124,125,126,128],"li",{},"Run the ",[30,127,32],{}," check below on every machine that runs Cursor.",[123,130,131],{},"If the key is there, follow Cursor's clean-up steps. Uninstalling alone is not enough.",[123,133,134],{},"Rotate the keys and tokens that machine could reach, from a trusted computer.",[15,136,137,138,143],{},"Extensions are one of several ways code ends up running as you. Our ",[139,140,142],"a",{"href":141},"/blog/openclaw-security-2026","OpenClaw security guide for 2026"," covers the others.",[41,145,147],{"id":146},"what-the-claude-code-extension-malware-actually-did","What the Claude Code extension malware actually did",[15,149,150],{},[151,152],"img",{"alt":153,"src":154},"Timeline of the Claude Code extension malware in Cursor's marketplace on 29 October 2026","/img/blog/coding-agent-extension-security-check-timeline.jpg",[15,156,157],{},"Cursor found a modified copy of Anthropic's Claude Code extension in its marketplace, under the normal ID. Cursor says these versions \"were not developed by Anthropic\", and Anthropic told The Register that its official channels were not affected.",[15,159,160],{},"Here's the detail that trips people up. 2.1.312 is also a real release in Anthropic's changelog, so the number alone can't tell you which one you got.",[162,163,164],"blockquote",{},[15,165,166],{},"A version number tells you what you installed. It doesn't tell you who built it.",[15,168,169],{},"According to Cursor, the tampered build tried to report host details, including environment variable names, add an unauthorized SSH key, turn on the local SSH service and keep a reverse tunnel running across restarts.",[15,171,172],{},"The calmer part? Turning on SSH needs admin rights the extension lacked on most macOS and Windows machines, so that step usually failed. The key, start-up files and host report could still land, which is why clean-up matters.",[15,174,175],{},"Cursor pulled the build, took its marketplace offline as a precaution, found no other tampered extensions, rotated its keys and rebuilt. How the package got in? Neither Cursor nor Microsoft has said.",[41,177,179],{"id":178},"the-10-minute-check-did-you-install-it","The 10-minute check: did you install it?",[15,181,182],{},[151,183],{"alt":184,"src":185},"The 10-minute Claude Code extension check: key, version, start-up files","/img/blog/coding-agent-extension-security-check-10-minute-check.jpg",[15,187,188],{},"Do these in order.",[190,191,193],"h3",{"id":192},"step-1-the-key-check-2-minutes","Step 1: the key check (2 minutes)",[15,195,196],{},"This is Cursor's own check. It comes first because removing or updating the extension does not remove the key. On macOS (Microsoft lists the same file for Linux):",[198,199,204],"pre",{"className":200,"code":201,"language":202,"meta":203,"style":203},"language-bash shiki shiki-themes github-light","grep -qs svc-telemetry ~/.ssh/authorized_keys && echo \"svc-telemetry key found\" || echo \"No key found; machine not impacted\"\n","bash","",[30,205,206],{"__ignoreMap":203},[207,208,211,215,219,223,226,230,233,236,240,243],"span",{"class":209,"line":210},"line",1,[207,212,214],{"class":213},"s7eDp","grep",[207,216,218],{"class":217},"sYu0t"," -qs",[207,220,222],{"class":221},"sYBdl"," svc-telemetry",[207,224,225],{"class":221}," ~/.ssh/authorized_keys",[207,227,229],{"class":228},"sgsFI"," && ",[207,231,232],{"class":217},"echo",[207,234,235],{"class":221}," \"svc-telemetry key found\"",[207,237,239],{"class":238},"sD7c4"," ||",[207,241,242],{"class":217}," echo",[207,244,245],{"class":221}," \"No key found; machine not impacted\"\n",[15,247,248],{},"On Windows, in PowerShell:",[198,250,254],{"className":251,"code":252,"language":253,"meta":203,"style":203},"language-powershell shiki shiki-themes github-light","$files = \"$HOME\\.ssh\\authorized_keys\", \"C:\\ProgramData\\ssh\\administrators_authorized_keys\" | Where-Object { Test-Path $_ }\nif ($files -and (Select-String svc-telemetry $files)) { \"svc-telemetry key found\" } else { \"No key found; machine not impacted\" }\n","powershell",[30,255,256,261],{"__ignoreMap":203},[207,257,258],{"class":209,"line":210},[207,259,260],{},"$files = \"$HOME\\.ssh\\authorized_keys\", \"C:\\ProgramData\\ssh\\administrators_authorized_keys\" | Where-Object { Test-Path $_ }\n",[207,262,264],{"class":209,"line":263},2,[207,265,266],{},"if ($files -and (Select-String svc-telemetry $files)) { \"svc-telemetry key found\" } else { \"No key found; machine not impacted\" }\n",[190,268,270],{"id":269},"step-2-your-installed-version-3-minutes","Step 2: your installed version (3 minutes)",[15,272,273,274,277],{},"In Cursor, open Extensions (Cmd+Shift+X on Mac, Ctrl+Shift+X on Windows and Linux) and select Claude Code. In VS Code, run ",[30,275,276],{},"code --list-extensions --show-versions",". A newer version today doesn't prove the old one never ran.",[190,279,281],{"id":280},"step-3-start-up-files-5-minutes","Step 3: start-up files (5 minutes)",[15,283,284],{},"Microsoft lists these items. Check what each one actually runs, because the names are chosen to look like system tools.",[46,286,287,297],{},[49,288,289],{},[52,290,291,294],{},[55,292,293],{},"Platform",[55,295,296],{},"Where to look",[62,298,299,316,333,351],{},[52,300,301,304],{},[67,302,303],{},"macOS",[67,305,306,309,310,309,313],{},[30,307,308],{},"~/Library/LaunchAgents/com.apple.sysmond.plist",", ",[30,311,312],{},"~/.config/.smt",[30,314,315],{},"~/.config/.smtk",[52,317,318,321],{},[67,319,320],{},"Linux",[67,322,323,324,327,328,330,331],{},"Crontab ",[30,325,326],{},"@reboot"," entry pointing at ",[30,329,312],{},", plus ",[30,332,315],{},[52,334,335,338],{},[67,336,337],{},"Windows",[67,339,340,341,309,344,347,348],{},"Scheduled task ",[30,342,343],{},"SysMon",[30,345,346],{},"%USERPROFILE%\\.config\\smt.cmd"," and ",[30,349,350],{},"smtk",[52,352,353,356],{},[67,354,355],{},"Windows fallback",[67,357,358,359],{},"Startup folder file ",[30,360,361],{},"sysmon.cmd",[15,363,364,365,369],{},"No key and no start-up files? You're clear. Skills deserve the same scrutiny, and our ",[139,366,368],{"href":367},"/blog/clawhub-skills-security-audit","ClawHub skills security audit"," shows what a bad one looks like.",[41,371,373],{"id":372},"found-the-key-heres-the-clean-up-order","Found the key? Here's the clean-up order",[15,375,376],{},"Uninstalling isn't enough. Work through Cursor's and Microsoft's published steps:",[120,378,379,382,393,406,409],{},[123,380,381],{},"Preserve evidence if you have a security team, then isolate the machine while you work.",[123,383,384,385,388,389,392],{},"Run Cursor's remediation script: ",[30,386,387],{},"bash remediate-macos.sh"," as your normal user on macOS (not root), or ",[30,390,391],{},"powershell -ExecutionPolicy Bypass -File .\\remediate-windows.ps1"," from an Administrator PowerShell. Read it first, as Microsoft advises.",[123,394,395,396,327,398,400,401,347,403,405],{},"On Linux, use Microsoft's manual steps: delete only the ",[30,397,326],{},[30,399,312],{},", remove ",[30,402,312],{},[30,404,315],{},", and stop matching SSH processes.",[123,407,408],{},"Remove only the bad key, after matching its fingerprint to the published indicator.",[123,410,411],{},"Rotate credentials from a trusted computer: model API keys, SSH keys, cloud credentials, Git tokens and sessions.",[15,413,414],{},"Cursor describes the collection as limited to environment variable names. That doesn't rule out later access, so rotate anyway, and rebuild if you can't be sure the machine is clean.",[41,416,418],{"id":417},"same-week-different-problem-browser-escapes-in-coding-tools","Same week, different problem: browser escapes in coding tools",[15,420,421],{},[151,422],{"alt":423,"src":424},"Browser escape patch status for Cursor, Copilot, Claude Desktop, Codex and VS Code","/img/blog/coding-agent-extension-security-check-browser-escapes.jpg",[15,426,427],{},"On 29 October, Forever Security showed that the built-in browsers in five coding tools could be pushed past their normal limits by a web page or a local file. This one is a bug, not a bad build, so the fix comes from the vendor:",[46,429,430,443],{},[49,431,432],{},[52,433,434,437,440],{},[55,435,436],{},"Tool",[55,438,439],{},"Researchers, 29 October",[55,441,442],{},"Re-checked 9 November",[62,444,445,456,466,477,488],{},[52,446,447,450,453],{},[67,448,449],{},"Cursor",[67,451,452],{},"Fixed 1 October",[67,454,455],{},"No change",[52,457,458,461,464],{},[67,459,460],{},"GitHub Copilot app",[67,462,463],{},"Fixed in build 1.1.29, 13 October",[67,465,455],{},[52,467,468,471,474],{},[67,469,470],{},"Claude Desktop",[67,472,473],{},"Not listed as open",[67,475,476],{},"Keep it updated",[52,478,479,482,485],{},[67,480,481],{},"Codex",[67,483,484],{},"Open",[67,486,487],{},"No fix in changelog (latest: Codex CLI 0.167.0, 6 November)",[52,489,490,493,496],{},[67,491,492],{},"VS Code",[67,494,495],{},"Open; Microsoft declined, citing Workspace Trust",[67,497,498],{},"No fix in 1.144 (28 October) or 1.145 (4 November) notes",[15,500,501,502,506],{},"Until Codex and VS Code ship fixes, don't open local HTML files or previews from untrusted repos in their built-in browsers. For everything else, our ",[139,503,505],{"href":504},"/blog/openclaw-security-checklist","OpenClaw security checklist"," turns these checks into a monthly routine.",[41,508,510],{"id":509},"settings-that-make-the-next-bad-build-reach-you-later","Settings that make the next bad build reach you later",[15,512,513],{},[151,514],{"alt":515,"src":516},"Four settings that slow down Claude Code extension malware and limit what it can touch","/img/blog/coding-agent-extension-security-check-settings.jpg",[162,518,519],{},[15,520,521],{},"You can't stop every bad release. You can make it arrive late and touch less.",[15,523,524,527,528,531,532,535],{},[25,525,526],{},"Limit where Claude Code writes."," Claude Code 2.1.314 added ",[30,529,530],{},"permissions.blockWritesOutsideWorkingDirectories",": Write, Edit and NotebookEdit refuse paths outside your working directories in every permission mode. In ",[30,533,534],{},"~/.claude/settings.json",":",[198,537,541],{"className":538,"code":539,"language":540,"meta":203,"style":203},"language-json shiki shiki-themes github-light","{\n  \"permissions\": {\n    \"blockWritesOutsideWorkingDirectories\": true,\n    \"blockReadsOutsideWorkingDirectories\": true\n  }\n}\n","json",[30,542,543,548,556,571,582,588],{"__ignoreMap":203},[207,544,545],{"class":209,"line":210},[207,546,547],{"class":228},"{\n",[207,549,550,553],{"class":209,"line":263},[207,551,552],{"class":217},"  \"permissions\"",[207,554,555],{"class":228},": {\n",[207,557,559,562,565,568],{"class":209,"line":558},3,[207,560,561],{"class":217},"    \"blockWritesOutsideWorkingDirectories\"",[207,563,564],{"class":228},": ",[207,566,567],{"class":217},"true",[207,569,570],{"class":228},",\n",[207,572,574,577,579],{"class":209,"line":573},4,[207,575,576],{"class":217},"    \"blockReadsOutsideWorkingDirectories\"",[207,578,564],{"class":228},[207,580,581],{"class":217},"true\n",[207,583,585],{"class":209,"line":584},5,[207,586,587],{"class":228},"  }\n",[207,589,591],{"class":209,"line":590},6,[207,592,593],{"class":228},"}\n",[15,595,596],{},"The read key needs 2.1.257 or later. Anthropic's docs say the write key doesn't cover shell commands, MCP tools or hooks, and the read key doesn't refuse shell commands the same way, so add sandboxing for shell commands.",[15,598,599,602,603,606],{},[25,600,601],{},"Slow down extension updates."," In Cursor, set ",[30,604,605],{},"extensions.installCooldownHours"," so new versions wait before installing. Team admins can enforce a Marketplace Install Cooldown (off by default) and allow only approved publishers.",[15,608,609,610,613,614,617,618,621],{},"The bad builds were live for about 11 hours, so a longer cooldown lets the marketplace pull a bad release before it reaches you. VS Code's ",[30,611,612],{},"extensions.autoUpdateDelay"," already waits 12 hours by default, and ",[30,615,616],{},"extensions.autoUpdate"," set to ",[30,619,620],{},"false"," stops automatic updates.",[15,623,624,627,628,631],{},[25,625,626],{},"Pin versions you trust."," In VS Code, right-click an extension and choose Install Another Version, or run ",[30,629,630],{},"code --install-extension publisher.extension@1.2.3",". Then update on purpose.",[15,633,634,637,638,641],{},[25,635,636],{},"Give your agents their own machine."," An extension runs as you. It can reach your SSH keys, cloud credentials and ",[30,639,640],{},".env"," files, and an always-on agent on that laptop keeps its API keys right there too.",[15,643,644,645],{},"That's the one we built a product around. Keep your agent's keys off your laptop. BetterClaw runs your agent in the cloud with encrypted secrets. ",[139,646,650],{"href":647,"rel":648},"https://app.betterclaw.io/sign-in",[649],"nofollow","Start your agent in 60 seconds",[41,652,654],{"id":653},"the-same-checklist-works-for-skills-and-mcp-servers","The same checklist works for skills and MCP servers",[15,656,657],{},[151,658],{"alt":659,"src":660},"Coding agent extension safety checklist for extensions, skills and MCP servers","/img/blog/coding-agent-extension-security-check-checklist.jpg",[15,662,663,664,668],{},"Skills and MCP servers run with your permissions too, so the same five steps apply. For skills, read the SKILL.md and every bundled script before installing. Our ",[139,665,667],{"href":666},"/skills/security-vetting","security vetting skill"," makes that a repeatable check before any new skill runs.",[15,670,671],{},"For MCP servers, allow only the tools the job needs. Cursor's hardening guide recommends an MCP allowlist with per-server tool limits, and Claude Code supports per-tool permission rules. Review that list every time you add a server.",[15,673,674],{},"Keep the host apps patched too. Two fixes from the same week:",[676,677,678,684],"ul",{},[123,679,680,683],{},[25,681,682],{},"Jan v0.8.8 (28 October):"," MCP tools called through the Local API run only when you allow them in Settings, and agent file tools no longer follow a link out of their workspace.",[123,685,686,689,690,693],{},[25,687,688],{},"n8n 2.45.7 (30 October):"," workflow-scoped routes now need the ",[30,691,692],{},"execution:read"," permission before returning execution data.",[15,695,696],{},"Quiet fixes like these rarely make the news. If you run those tools, they matter just as much, and they only help once you update.",[41,698,700],{"id":699},"where-a-hosted-agent-helps-and-where-it-does-not","Where a hosted agent helps, and where it does not",[15,702,703],{},"Let's be straight about this. A hosted agent does not protect your local IDE. A tampered extension in Cursor or VS Code runs on your laptop, with your SSH keys and files, wherever your agents live.",[15,705,706,707,711],{},"Only the checks above protect the laptop itself. What hosting changes is where your agent's keys sit, and our ",[139,708,710],{"href":709},"/security","security page"," explains how BetterClaw handles them.",[15,713,714],{},"Here's what stays with us from this week. The fix for the Claude Code extension malware wasn't clever. It was a grep command, a cooldown setting and a key rotation.",[162,716,717],{},[15,718,719],{},"Coding agent security is mostly boring habits, done before you need them. Ten minutes today is the cheapest they'll ever be.",[19,721,723,728],{"type":722},"cta",[15,724,725],{},[25,726,727],{},"Ready to move your agent off your laptop?",[15,729,730,731],{},"BetterClaw runs your agent in the cloud with encrypted secrets, away from your IDE extensions. Plans start at $19 a month for Starter, $49 for Pro ($39 billed annually) and $149 for Business, with custom Enterprise plans. ISO 27001 certified, and your first workspace starts with a 7-day free trial. ",[139,732,734],{"href":733},"/pricing","See plans and pricing",[41,736,738],{"id":737},"frequently-asked-questions","Frequently Asked Questions",[190,740,742],{"id":741},"what-is-the-claude-code-extension-malware","What is the Claude Code extension malware?",[15,744,745],{},"Tampered copies of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313, served by Cursor's marketplace on 29 October 2026. Cursor told Reuters that at most 5,000 users were affected.",[190,747,749],{"id":748},"was-the-claude-code-extension-hacked","Was the Claude Code extension hacked?",[15,751,752],{},"Not Anthropic's own release. Cursor says the tampered versions were not developed by Anthropic, and copies from the Visual Studio Marketplace and npm were not affected.",[190,754,756],{"id":755},"how-do-i-know-if-i-installed-it","How do I know if I installed it?",[15,758,759,760,763,764,766],{},"Search your SSH ",[30,761,762],{},"authorized_keys"," file for ",[30,765,32],{}," with the commands in Cursor's notice. If the key is there, the machine is affected, even if the extension has since updated.",[190,768,770],{"id":769},"is-cursors-marketplace-safe-now","Is Cursor's marketplace safe now?",[15,772,773],{},"Cursor says it found no other tampered extensions and rebuilt the marketplace. No marketplace can rule out every risk, so set an install cooldown and pin the extensions you rely on.",[190,775,777],{"id":776},"are-vs-code-and-codex-patched-for-the-browser-escape","Are VS Code and Codex patched for the browser escape?",[15,779,780],{},"Not as of 9 November 2026, according to their release notes. Cursor and the GitHub Copilot app fixed theirs in October.",[190,782,784],{"id":783},"is-a-hosted-agent-worth-paying-for-if-it-doesnt-protect-my-ide","Is a hosted agent worth paying for if it doesn't protect my IDE?",[15,786,787],{},"Yes, if your agent runs all day and holds API keys you'd rather keep off your laptop. It won't replace these checks. Plans start at $19 a month, and your first workspace starts with a 7-day free trial.",[789,790,791],"style",{},"html pre.shiki code .s7eDp, html code.shiki .s7eDp{--shiki-default:#6F42C1}html pre.shiki code .sYu0t, html code.shiki .sYu0t{--shiki-default:#005CC5}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sD7c4, html code.shiki .sD7c4{--shiki-default:#D73A49}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":203,"searchDepth":263,"depth":263,"links":793},[794,795,796,801,802,803,804,805,806],{"id":43,"depth":263,"text":44},{"id":146,"depth":263,"text":147},{"id":178,"depth":263,"text":179,"children":797},[798,799,800],{"id":192,"depth":558,"text":193},{"id":269,"depth":558,"text":270},{"id":280,"depth":558,"text":281},{"id":372,"depth":263,"text":373},{"id":417,"depth":263,"text":418},{"id":509,"depth":263,"text":510},{"id":653,"depth":263,"text":654},{"id":699,"depth":263,"text":700},{"id":737,"depth":263,"text":738,"children":807},[808,809,810,811,812,813],{"id":741,"depth":558,"text":742},{"id":748,"depth":558,"text":749},{"id":755,"depth":558,"text":756},{"id":769,"depth":558,"text":770},{"id":776,"depth":558,"text":777},{"id":783,"depth":558,"text":784},"Security","2026-11-09","Claude Code extension malware hit Cursor's marketplace. What it did, how to check your versions in 10 minutes and the settings that lock it down.","md",false,"/img/blog/coding-agent-extension-security-check.jpg","Checking a coding agent extension for Claude Code extension malware",512,1024,null,{},true,"/blog/coding-agent-extension-security-check","8 min read",{"title":5,"description":816},"Is Your Coding Agent Extension Safe? A 10-Minute Check","blog/coding-agent-extension-security-check",[832,833,834,835,836,837,838],"claude code extension malware","cursor extension backdoor","is claude code extension safe","cursor marketplace malware","vs code extension security","claude code 2.1.312 backdoor","how to check installed cursor extensions","z1UStTSx44fbL8g3YkM5P8Li2q34kdtkBNudcH8kPZo",[841,849,858],{"stem":842,"title":843,"description":844,"date":845,"image":846,"category":814,"redirected":818,"author":847,"readingTime":848},"blog/is-meta-muse-safe-privacy","Is Meta Muse Safe? What the AI Agent Can See, Store and Share","Is Meta Muse safe to use? What the AI agent can see, what Meta says it stores, what critics claim, and the settings that limit what it can access.","2026-11-06","/img/blog/is-meta-muse-safe-privacy.jpg",{"name":7,"role":8,"avatar":9,"bio":10},"9 min read",{"stem":850,"title":851,"description":852,"date":853,"image":854,"category":855,"redirected":818,"author":856,"readingTime":857},"blog/rogue-ai-agents-incidents-permissions","Rogue AI Agents: 8 Real Incidents, One Cause, and the Permission Rules That Stop It","Rogue AI agents deleted a database and breached real companies and a government portal. 8 real incidents, one cause, and a permission checklist to copy.","2026-11-05","/img/blog/rogue-ai-agents-incidents-permissions.jpg","Guides",{"name":7,"role":8,"avatar":9,"bio":10},"12 min read",{"stem":859,"title":860,"description":861,"date":862,"image":863,"category":855,"redirected":818,"author":864,"readingTime":866},"blog/skill-claude-hemat-token","Skill Claude Terbaik untuk Mengurangi Penggunaan Token (2026): Caveman, RTK dan 5 Metode yang Efektif","Caveman, RTK dan claude-token-optimizer dibandingkan: apa yang dipangkas, perintah instalasi, dan 5 metode yang menurunkan tagihan Claude $304 jadi $56/bulan.","2026-11-03","/img/blog/skill-claude-hemat-token.jpg",{"name":7,"role":8,"avatar":9,"url":865,"bio":10},"https://www.betterclaw.io/about","14 menit membaca",1794321820228]