#claude-code
-
Official Claude Code Extension on Cursor's Marketplace Swapped for a Version with an SSH Backdoor
A modified Claude Code extension spread through Cursor's extension marketplace. It added an attacker's key to authorized_keys and installed persistence. Cursor estimates that at most 5,000 users were affected.
-
Claude Code spends up to a fifth of your tokens on a three-word status line
Independent developers found that Claude Code's background agent_summary feature eats roughly 15–20% of tokens to produce a short status line. There is no built-in way to turn it off, so they published a Bun hook that does.
-
AGENTS.md file in Downloads folder hijacks AI coding agents
Researchers found a malicious AGENTS.md instruction file on a customer's machine that pushed an AI coding agent to install a rogue npm package. Browsers save downloads there automatically — and agents read instructions from the same folder without asking.
-
CyberXero Wields Claude Code to Steal Over 628,000 Ukrainian Records
SOCRadar has detailed a two-pronged access-broker campaign that paired Cobalt Strike with a Claude Code orchestration layer and bypassed the model's safety controls by claiming each session was an "authorized pentest."
-
Linus Torvalds Turns to Claude Code for Linux Kernel Work
Linux creator Linus Torvalds is leaning further into AI tooling — he is now using Claude Code to work on new kernel features.
-
Plugin4Shell: Swapping Out a "Pinned" Plugin in Four AI Coding Agents
Air Security has described a vulnerability that lets the owner of a plugin repository slip malicious code to an AI agent even where the plugin is bound to a specific, verified version.
-
Study: Claude Code Burns Through Up to 33,000 Tokens Before It Even Reads the User's Request
According to data published on Hacker News, the AI development tool Claude Code sends the model roughly 33,000 tokens of housekeeping information before it even processes the user's actual request, whereas the competing tool OpenCode gets by on about 7,000 tokens.
-
Alibaba Bars Employees from Using Claude Code
The company has reportedly classified the AI-powered coding tool as high-risk software.
-
Users Report a Possible Session Leak Between Claude Code Accounts
An issue has appeared on GitHub reporting a potential leak of sessions or cache between workspace instances or Claude Code accounts. The discussion on Hacker News gathered 205 points and 93 comments.