Semgrep says the tampered 2.1.313 build sat in Cursor's marketplace for about 11 hours on Oct 29 and up to 5,000 developers may have installed it, and WIRED says only flawed code stopped the attacker from fully compromising those machines. If you inst...
VQV Signal
AI AT WORK
WATCH
TECHNICAL
The tainted Claude Code extension: up to 5,000 installs, and uninstalling isn't enough
Semgrep says the tampered 2.1.313 build sat in Cursor's marketplace for about 11 hours on Oct 29 and up to 5,000 developers may have installed it, and WIRED says only flawed code stopped the attacker from fully compromising those machines. If you inst...
Semgrep says the tampered 2.1.313 build sat in Cursor's marketplace for about 11 hours on Oct 29 and up to 5,000 developers may have installed it, and WIRED says only flawed code stopped the attacker from fully compromising those machines. If you installed it, update to 2.1.314, remove the leftover "svc-telemetry"...
Teams using AI at work may want to compare this against current productivity and review workflows.
VQV organizes public signals from inspectable sources. It does not independently verify the underlying report.
Signal Strength 87%
Technical label WATCH
Public Interest 53
Category AI AT WORK
Reader Depth TECHNICAL
Signal Strength reflects source quality, relevance, freshness and evidence. Public Interest helps organize discovery; it is not proof of truth.
Public Interest components
Recognizable Entity Score 82
Practical Impact Score 28
Novelty Interest Score 70
Consequence Score 46
Curiosity Score 0
Shareability Score 64
VQV surfaced this signal because it is recent, relevant to AI Coding Tools, connected to Scobleizer News Pulse (X).
No login, cookies, social SDKs, or automatic posting.