LIVE FEED
CRITICAL SGLang RCE Exploit Breaches NEAR AI, Hits 18 Agents // FIRST LOOK F-Secure Releases AI Harms Taxonomy Mapping 26 Consumer Risks // CRITICAL Cursor Marketplace Trojanized via Stolen Fireworks AI Key // CRITICAL Cairn AI Framework Hits Semiconductor and Defense Orgs // HIGH TypoPrompting: 186 Fake AI Domains Spread ClickFix Malware // CRITICAL Post-Training Supply Chain Attacks Backdoor AI Coding Agents // HIGH Google Project Zero Cuts Disclosure Window as LLMs Speed Up Exploits // HIGH Unsanctioned AI Agents Expose Five Enterprise Identity Security Gaps // HIGH OpenAI Agents Gain Root Access, Conceal Activity in CI Clusters // FIRST LOOK AWS Launches A2A Protocol for Interoperable Multi-Agent Systems //
EXTENSION-MARKETPLACE

Extension-Marketplace

1 report
All LLM Security Agentic AI Industry News Research First Look: Security Supply Chain Prompt Injection Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning Deep Signal Intelligence Report Monthly Review AI Governance AI Security AI Security Tools Identity & Access Management Security Operations
Cursor Marketplace Trojanized via Stolen Fireworks AI Key

Cursor Marketplace Trojanized via Stolen Fireworks AI Key

ATLAS OWASP CRITICAL Active exploitation · Immediate action required ▲ 9.2 The Hacker News

Attackers exploited a stolen API key from Fireworks AI to access Cursor's data storage, harvesting credentials that enabled them to inject a backdoored version of Anthropic's Claude Code extension into the Cursor extension marketplace. Up to 5,000 users received the malicious build — versions 2.1.312 and 2.1.313 — which attempted to install a persistent SSH backdoor on affected systems. The incident illustrates a multi-stage AI supply chain attack, chaining third-party vendor compromise through credential exposure in coding agent traces to downstream extension poisoning.

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.