The Trusted Update Channel, Again

The Trusted Update Channel, Again

Version 2.1.313 of the official Claude Code extension for VS Code, published from Anthropic's verified account, shipped with a Secure Shell backdoor. Phorion found it: an immediately invoked function expression prepended to the minified bundle that runs the moment Node loads the file, before the extension activates and without any user interaction. Stage one appends an attacker-controlled Ed25519 public key to the user's authorized_keys and tries to switch on the local SSH daemon. Stage two opens a reverse SSH tunnel to an external server with an embedded private key, so the operator can log back in through the forwarded port with the planted key and get a full shell without any custom command-and-control code. Stage three adds persistence through crontab, a LaunchAgent, or a scheduled task. Stage four posts a recon beacon with hostname, user, Git email, public IP, and the names of up to 40 credential-looking environment variables. The malware is also buggy: on macOS the Remote Login check runs unprivileged, misreads the permission error as "already on," and never enables SSH, so the inbound half fails on Macs where SSH was off. Phorion calls that luck rather than defense, and notes that uninstalling the extension removes none of the dropped keys, scripts, or persistence (more: https://phorion.io/blog/offical-claude-code-vsx-compromise).

Cursor's security notice corroborates the mechanics and confirms the version was pulled from its marketplace, Open VSX, and the Visual Studio Marketplace, with 2.1.314 as the replacement. Kevin Beaumont's write-up supplies the assertions: that Cursor puts affected systems around 5,000, that the extension auto-updated to the bad build, that Anthropic "has not informed customers" and silently removed it, and that Cursor's phrase "not developed by Anthropic" is doing heavy lifting given the upload came from Anthropic's publisher account. Until Anthropic explains how its publisher account was compromised, "Anthropic hacked" is a reasonable inference from the artifacts rather than a confirmed finding (more: https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2).

Berryville Institute of Machine Learning ties the extension to the week's Binance incident, noting Binance ran Claude Code and Cursor on laptops and guessing at North Korea. That is a hypothesis and should be labeled one; the documented link is that Binance is one of thousands of customers (more: https://berryvilleiml.com/2026/10/30/anthropic-spearheads-supply-chain-attack). Analysts tracked roughly 3.5 billion dollars leaving three hot wallets for a fresh Ethereum address within seconds, Arkham tags an entity holding about 5.78 billion dollars across linked wallets, Tether and Circle froze more than 2.3 billion dollars, and Binance confirmed only that it was investigating "reports of a potential security issue." The 5.8 billion figure is assets held by tracked wallets, not confirmed loss, and a later BleepingComputer headline attributes the theft to a compromised DevOps laptop, which is consistent with the extension story but does not establish it (more: https://www.bleepingcomputer.com/news/security/binance-probes-potential-58-billion-crypto-theft-hack). A year ago the proof that IDE extensions were an undefended surface was a third-party rogue extension. Now it is the first-party publisher, and disclosure speed is part of the control.

The Patch Gap Closes on Firefox

Epoch AI gave GLM 5.3, Z.ai's August open-weight release, a stock Ubuntu box, an official Firefox build, no internet, and one instruction: inspect the unshipped fixes and build a page that reads a local file and sends it out. It succeeded against all six Firefox releases between September 17 and October 26, with a fastest run of 12 hours. It chained a patch-gap bug for code execution in the content process with a separate unpublished sandbox bypass it rediscovered every time. Firefox 159.0 on October 27 fixes the bypass; Epoch has not confirmed whether 159.0 survives the same treatment. Total Firefox spend exceeded 100,000 dollars in API fees, but the marginal cost per new version was about 1,000 dollars, and no provider, Z.ai included, triggered a refusal. The same harness has failed against Chrome at similar spend, which Epoch declines to read as safety (more: https://epoch.ai/publications/open-weight-models-patch-gap).

Mozilla's post the same day is the defender's view of those numbers. Since February Firefox has shipped more than seven times the security fixes of the same period in 2025 using early access to Anthropic and OpenAI frontier models, and Mozilla claims the depth reachable by attackers' models "has largely been picked clean." The patch gap is the exception, and GLM 5.3 "can exploit some of the fixes for bugs originally uncovered by more advanced models." The countermeasures are concrete: weekly builds, regression tests withheld until the fix ships because the model was much less effective without them, every landing commit scanned, and a plan to stagger patch gaps so the renderer bug and the sandbox escape an attacker needs are never exposed in the same window. In March the defender's advantage had an expiration date. It was October (more: https://blog.mozilla.org/en/firefox/privacy-security/defending-patch-gap).

Orange Tsai's Edge chain is the counterexample worth keeping precise: a sandbox escape from five logic bugs and two Windows features, no memory corruption, no language model, 175,000 dollars at Pwn2Own Berlin and a Pwnie for Epic Achievement. The primitive is "sourceless navigation": a browser-initiated navigation with no renderer source, so Chromium uses the active tab and a tab switch during a delay yields universal cross-site scripting that ignores Content Security Policy. The escape went through an Immersive Reader scheme Microsoft forgot to blacklist, a file write with a null byte, and a rewritten auto-launch protocol config that ran a planted telnet binary from a user-writable PATH directory. Tsai says the two months went into finding, not chaining, and he is porting the chain to Chrome (more: https://blog.orange.tw/posts/2026-10-the-last-proof-of-human-craft-browser-full-chain/).

Veracode's fall snapshot covers the code those models write. After four flat quarters at 55 to 56 percent, the average security pass rate across 18 models moved to 62 percent, with Claude Opus 5.5 and GPT-6-Sol tied at 73 percent. The reason: almost all of the gain is cross-site scripting, a short, heavily documented, framework-supported pattern, while log injection sits flat near 12 percent across every snapshot because it requires reasoning about data flow. Security improved where it is easiest to improve (more: https://www.veracode.com/blog/fall-2026-genai-code-security).

Containment Becomes a Product Category

tryboxi is "E2B, but on your computer": disposable Ubuntu 24.04 microVMs with their own kernel under Virtualization.framework on Apple Silicon, with a Model Context Protocol adapter for Cursor, Claude Code, and Codex. The repo syncs one way into the VM, and changes come back only through diff, apply, and pull, which back up files, refuse path traversal and escaping symlinks, and never touch branches or the index. Secret-looking files are never synced; the VM sees placeholders, and an egress proxy swaps in real values only for whitelisted hosts. Networking is whitelist-only, with loopback, LAN, link-local metadata, and CGNAT ranges blocked unconditionally (more: https://github.com/karthikponna/tryboxi).

Upstream of the sandbox is the decision whether a tool call runs at all. pi-automode-classifier reproduces Claude Code's auto mode for the Pi agent in three stages: shell-parsing rules, then LANCET Nano, a 111-million-parameter classifier on CPU, then a local Qwen3.8-Flash-Next that reads the user's messages and blocks risky calls nobody asked for. The benchmark over 1,793 commands is honest about the trade. Rules alone let 37 risky calls run but prompted on 645 safe ones; the full stack cut safe prompts to 114 while letting 133 risky calls through, 76 of them GTFOBins rows where a common Unix tool yields a shell and looks identical to a legitimate pipeline when all the classifier sees is the command (more: https://old.reddit.com/r/LocalLLaMA/comments/1xhpoer/three_stage_tool_call_classifier_rules_followed/). Watching the result is shoulder's job: a read-only Go terminal UI that tails the session logs Claude Code, Codex, Gemini CLI, opencode, and omp already write, shows each agent's file, diff, and shell commands, and sends nothing anywhere (more: https://github.com/bjarneo/shoulder).

The Agentic Trust Framework, published through the Cloud Security Alliance and now at a v0.9.1 review draft, is the governance layer: five elements (identity, behavior, data governance, segmentation, incident response) and a four-level ladder from Intern to Principal with demotion on any critical incident. It is a specification, not code, and its value is a checklist a regulator will recognize (more: https://github.com/massivescale-ai/agentic-trust-framework). What happens without the checklist is Wired's headline this week: a defense contractor gave a personal AI agent access to a secure Pentagon system. The details sit behind a paywall and are not yet in the public record, but the headline alone is an Intern-level agent at Principal scope (more: https://unwall.app/www.wired.com/story/a-defense-contractor-gave-their-personal-ai-agent-access-to-a-secure-pentagon-system).

The [un]prompted II practitioner conference in San Francisco covered the same stack from the research side, and its organizers loaded the transcripts into a Gemini notebook that answers with citations. The talks it surfaces: six million inference calls in which every behavioral control against prompt injection failed, with grammar-constrained decoding at the token sampler, a JSON schema as a whitelist over output tokens, as the fix; Google's Capsem, a Rust hypervisor routing all agent egress through one low-privilege policy engine; and StealthBench, where capable offensive agents burn callback IPs and run unthrottled LSASS dumps, making operational security rather than capability the bottleneck (more: https://notebook.google.com/notebook/79bc1d16-7d89-4ed1-b8eb-762369c7b346). The field-notes post pitching the notebook adds one attendee's distilled answer: the model is not a security boundary (more: https://www.linkedin.com/posts/leerob_unprompted-ii-field-notes-ugcPost-7521592540760834049-Oo2U).

Harness Economics

Stencil's harness playbook is the postmortem of oh-my-pi and the design document for its rewrite, and its thesis is that a coding agent is not "a while loop around a fetch" but a game engine with the same obligations. The failure it diagnoses is two sources of truth: the message tree is journaled, but todo state, retry counters, subagent registries, and settings live outside it, so "rewind, fork, and resume all lie." The rewrite materializes the whole session as a DOM with a property-change journal, and moves Model Context Protocol and long-tail tools behind a synthesized CLI because tool grammar in the prompt "actively contributes to token generation": trimming the roster from 23 to 15 wire definitions cut a median 14 seconds per task. The authors now call TypeScript "an awful choice" for this work (more: https://stencil.so/blog/harness-playbook). Today's omp is already the heavily tooled fork, and its trust posture is worth reading first, since opening a repository loads its extensions, hooks, and project MCP configuration by design unless an overlay disables it (more: https://github.com/can1357/oh-my-pi).

Two companion posts put numbers on the economics. Prewalk attacks plan mode: on SWE-Bench Pro, Opus 4.8 planning and Gemini Flash 3.5 executing cost 3.18 dollars per task, 14 percent more than Opus alone, because reading is 91 percent of agent tokens and a 2K-token plan is "a postcard" that makes the cheap model re-read everything the expensive one already read. Prewalk instead swaps the cheap model into the frontier model's context right after its first edit: 1.46 dollars with Flash at 92 percent of Opus's pass rate. The swap also stopped the cheating: solo frontier runs started searching GitHub for the real fix around turn 12 to 14 once exploration stalled, and prewalk exits before the desperation phase (more: https://stencil.so/blog/prewalk). SnapCompact is stranger: when context fills, render the transcript as a dense pixel-font PNG and hand it back as an image, at a third of the text price. On SQuAD-style recall it scored 0.86 to 0.96 F1 while prose compaction was "a fact shredder." The catch is that models decode dense images by thinking, at roughly five times the output tokens, which can eat the savings in one pass (more: https://stencil.so/blog/snapcompact).

Arize's two-year retrospective on its in-product agent is the production corollary: no agent framework, everything in harness code, a to-do tool that made the model spend its turns checking boxes until the plan was moved into a rendered message, and long-term memory that ended as one Markdown file per user capped at 8,000 characters (more: https://www.youtube.com/watch?v=YIhvrvHtonk).

Local Inference and Who It Is Terrible For

Sam Altman's line that "local inference is a terrible allocation of scarce resources," because DRAM in a personal machine idles 95 percent of the time while the cloud could run it flat out, is true about aggregate hardware efficiency and beside the point about who benefits. The substantive r/LocalLLaMA reply noted that the shortage is fabs moving capacity to HBM for accelerators, and that an idle GPU costs its owner, not OpenAI, in exchange for no rate limits and data that never leaves the house (more: https://old.reddit.com/r/LocalLLaMA/comments/1xizbq1/sam_altman_local_inference_is_a_terrible/).

Revolut's head of AI operations gave the enterprise version of that answer. Serving 2,000 engineers on self-hosted GLM 5.3, an 800-billion-parameter model, takes 56 B200s; blended cost is 30 cents per million tokens and the invoice is a tenth of what the bank paid Anthropic and OpenAI. The measured effect was a 60 percent improvement in coding time and 70 percent in lead time, with the tuning lessons that 256K context is enough, FP4 on Blackwell is lossless, and time to first token above five seconds fills the Slack inbox. For the regulator, a sandbox with approval rules is what makes the deployment "not an autonomous agent" (more: https://www.youtube.com/watch?v=Ok6QdZHCcI8).

Strata is the consumer end of the same curve. Version 0.2.8 runs Qwen3.8-Flash-Next, a 125-billion-parameter mixture-of-experts, on a 12 GB GPU using two- and three-bit quants, and DeepSeek V4.1 Flash by streaming from SSD what does not fit, at 9 to 11 tokens per second on an RTX 3060 (more: https://github.com/Niko1221/Strata). A community fork for the 64 GB Jetson AGX Orin takes Qwen3.6-35B-A3B from about 21 tokens per second in llama.cpp to roughly 40 with sampled multi-token prediction and INT8 KV caching, with the caveat that the comparison was not controlled and the code heavily AI-assisted (more: https://old.reddit.com/r/LocalLLaMA/comments/1xfbjil/strata_optimized_for_64gb_agx_orin/). On Apple silicon, MLX-Serve now takes plugins, and a DeepSeek 4.1 STQ kernel tuned for the M5 Ultra 256 GB is reported approaching 4,000 tokens per second prefill and over 150 tokens per second speculative generation at 3 bits per weight, which, if it holds, closes the prefill gap that made the Mac a one-person machine (more: https://x.com/Beamsters1/status/2115954978854785202).

Cache Telepathy and Adversary Brains

Swarm Telepathy, from MIT CSAIL and the MIT-IBM lab, asks whether language models from different families can communicate without text, and answers with the first cross-family KV-cache transfer that needs no prefill on the receiving side. For each sender-receiver pair a roughly 300-million-parameter mapper is trained with both models frozen, in under six GPU-hours. Across 12 models from six families and 17 benchmarks, the method with cache compaction beats text-to-text summaries on task score, sender GPU time, and receiver time-to-first-token, averaging 40 percent more accurate. The limitations matter for deployment: a mapper per pair scales quadratically with families, and the transferred cache "may contain information beyond what is explicit in the text," a polite way of saying the channel is unauditable. It clears the bar of beating text under controlled tests and raises a governance one (more: https://arxiv.org/html/2610.15095v1).

Gadi Evron's Adversary Brains proposes a signature format above YARA and Sigma: where those match a file or a log line, a brain is a knowledge graph of STIX-typed entities and typed links, held as a hypothesis the data tests continuously. It operationalizes the CIA's Analysis of Competing Hypotheses at the scale of thousands, with language models extracting brains from reports and judging matches only by citing the deterministic match block, and attribution deliberately absent from the schema. The synthetic results are illustrative: over 6,000 host-days a flat rule on two common artifacts fired 6,000 times and a three-step ordered identity brain fired 5, and across 100 runs with rotated indicators the behavioral brain fired every time while its indicator-based twin fired once. The paper says it does not measure detection on real telemetry and that "one case is not a rate," which is the right amount of confidence. It is also a shift from the author's August position that RAPTOR's triage should be rules-only and model-free, resolved by architecture: deterministic matching, with the model confined to explaining it (more: https://arxiv.org/pdf/2610.35624v1).

Cold Storage and the Old Net

Reuters reports the Pentagon is treating the late-August freezer failures at at least six commissaries as a suspected cyberattack, with Cyber Command and Army investigators in contact with French counterparts about this month's refrigeration attack on more than 350 supermarkets. The detail that moves this from malfunction to sabotage is the same in both countries: at Fort Huachuca the freezer "went into defrost mode where it heated up all the food," and in France units were driven hot enough to catch fire. Earlier French reporting attributed that attack to abuse of the defrost function on outdated Danfoss controllers reachable from the internet, with perpetrators unconfirmed. Reuters could not establish which controllers the US bases use, Danfoss did not respond, and no official has stated a conclusion or an attribution, so "suspected" is the whole story for now. The pattern the record does support is controllers built for an on-site technician and then connected to the internet (more: https://www.reuters.com/technology/pentagon-treating-military-base-freezer-malfunctions-suspected-cyberattack-2026-10-29).

The Wired story above was reachable this week only through unwall.app, a paywall-bypass reader that layers browser-like headers, script blocking, and archive fallbacks, while stating it never authenticates subscriptions or emulates payment. Whether that holds legally is a different question from whether it works (more: https://unwall.app). Telehack is the antidote to the rest of the week: a multi-user simulation of the ARPANET and Usenet of 1985 to 1990, with 26,600 virtual hosts to wardial and porthack, and the Usenet archive Henry Spencer collected and David Wiseman rescued on 141 magtapes in a pickup truck. It accepts SSH, which makes it the one hacking playground this week where the only backdoor is the one you were invited to use (more: https://telehack.com/telehack.html). For the hobbyist, a slide deck titled "Being AI-Native Relevant: The Hobby Way" circulated as a public Google Slides link; the content lives only in the slides, so the title is the summary (more: https://docs.google.com/presentation/d/1c0Y_AeRjPGw3rlL74ENRI1Uk0GYFdANCKClL5fDlObo).