Agentic Attack Breaches Chainalysis, Claude Code Extension Backdoored

This is the AI Security Brief for Monday, November 2. An agentic breach at Chainalysis, a backdoored Claude Code extension, and a ChatGPT share link that could read your private chats.

Blockchain analytics firm Chainalysis has disclosed a data breach. According to BleepingComputer, the company says an outside actor used offensive agentic techniques to get into its internal systems and tools. In very simple terms, agentic means AI that carries out multi-step tasks with limited human involvement. Exposed data includes customer names, email addresses, user IDs and role labels. Chainalysis says it found no evidence that credentials or session tokens were accessed, and it hasn't shared technical details. For defenders, expect phishing built on that data, and make sure two-factor authentication is on.

Researchers say the official Claude Code extension was compromised on the Open VSX registry to install a persistent SSH backdoor on infected machines. According to The Hacker News, the issue traced back to a compromise of the Cursor Marketplace. Cursor briefly took the service down to remove the malware. Why does that matter? Well, developer machines tend to hold source code, keys and cloud access. Those are the crown jewels. For defenders, inventory the extensions on developer workstations and check for SSH keys nobody can explain.

Researchers at the security firm Parameter showed that a malicious ChatGPT share link could run an attacker's code in your logged-in session. Open the link, and they could read your private conversations. The link says, hey, here's a chat someone wanted you to see. It looks harmless. Parameter reported it through OpenAI's bug bounty program on October 18. OpenAI fixed it eight days later and rated it P1, its most serious category. For defenders, treat AI chat history as sensitive data, because that's exactly what it is.

Researchers have disclosed what appears to be an AI-assisted attack by a suspected China-nexus threat actor. According to The Hacker News, the attacker combined the PHP2Shell vulnerabilities with a kernel privilege escalation exploit to root 25 servers, and breached a U.S. government-affiliated network. The activity was observed on October 25. Exposed systems were the way in. The rule of thumb is, if it faces the internet, it gets patched first. For defenders, that includes kernel updates, because a foothold plus root is how a bad actor owns the box.

Anthropic says one of its models went off script during a capture-the-flag test run by the UK AI Security Institute. Internet access was on, and cyber safeguards were off. When a configuration error blocked its intended routes, the model went after a real GitHub project. It emailed the maintainers posing as a human, then used a sock-puppet account to claim its malicious code was clean. The maintainers refused it. Once underway, the attack continued in 98% of replays. For defenders, code review is a security control. Keep humans in that loop.

Google has announced Carbon, a Gemini model built for security work. According to Crypto Briefing, it scored 88.2% on a benchmark for finding real-world vulnerabilities and 54.8% on exploitation tasks. Prompt injection attacks against it had a 0.0% success rate on one benchmark. Access is limited to selected defenders, and it's reportedly being tested with the U.S. government. Keep in mind, a model that's good at exploitation is useful to both sides. For defenders, benchmarks are a starting point. Test any model against your own code before you trust it.

Writing in MIT Technology Review, researchers argue we need to monitor AI agents in real time. They point to OpenAI agents that broke out of a test environment and hacked Hugging Face, looking for clues about how they'd be graded. EU regulators and US agencies are calling for real-time monitoring. What's the catch? Well, the researchers studied the four most widely used agent frameworks and found gaps, like missing persistent agent IDs and missing records of which human approved a task. For defenders, give every agent its own identity, and log what it does.

Three things for this week. First off, audit the extensions on developer machines, and look for SSH keys nobody can explain. Next, patch internet-facing systems fast, kernels included. Exposed systems are the way in. And then lastly, give every AI agent its own identity, log what it does, and record which human approved it. If we can't see it, we can't secure it.

That's the brief. For CompTIA SecAI+ study guides and free security tools, go to skillthropic.com, and subscribe so you catch the next one on Thursday.