A malicious Claude Code-branded extension was served through Cursor's marketplace on 29 October; Microsoft independently analysed the backdoor attempt. The UK NCSC's 3 November assessment and new 4 November financial guidance point to tested resilience, action-level restrictions and supplier provenance. Real distribution incident, not autonomous model rebellion. DΩP editorial Threat 86 HIGH, Assurance 74, Control Debt +12: NO MATERIAL SCORE CHANGE.
Read full storyFrom intelligence to action
Run the free 5-minute DΩP Agent Exposure Check. Your answers stay in your browser unless you choose to share them.
29 Oct incident, disclosed 29–30 Oct: versions 2.1.312/2.1.313 sought persistent SSH access; actual number of host compromises unknown.
Read more NCSC: AI scales familiar attacks faster3 Nov official UK assessment: AI accelerates reconnaissance and exploitation; skilled human operators still matter. 2028 autonomous vignette is hypothetical.
Read more India: payment limits against machine-speed fraud4 Nov I4C warning via Reuters: set daily/transaction thresholds, verify beneficiaries and monitor unusual speeds; do not presume each leak was caused by an AI agent.
Read more US OCC: risk follows the use case4 Nov supervisory guide tells examiners to assess materiality and consequence; it explicitly creates no new binding standards or bank obligations.
Read more Tencent Hy4: claimed safeguards await independent assessment4 Nov release: defensive-training restrictions and bio/cyber safety performance are developer claims; no independent certification or field risk rate.
Read more4 Current global level: High (4.3/5)
NEW MATERIAL INCIDENT EVIDENCE, NO MATERIAL INDEX CHANGE. Cursor's 29 October compromised distribution path is now incorporated with correct event and disclosure dates. NCSC's 3 November assessment and 4 November financial guidance do not justify moving global Threat 86, Assurance 74 or Control Debt +12. The next test is independently verifiable plugin provenance, protected credentials, action-level payment limits and meaningful human intervention.
A model can refuse a harmful request while a compromised extension quietly executes it.— De-Omega-Point
“The greatest impact of AI will be the acceleration and scaling of existing tactics”
Government analytic judgement on likely attack evolution, not an observed incident rate.
Verify original evidence ↗“does not establish supervisory expectations for banks”
Legal scope qualification; existing banking duties remain applicable.
Verify original evidence ↗“does not prove that every step succeeded on every host”
Technical limitation; malicious code design is not a confirmed host compromise count.
Verify original evidence ↗“Now is the time to ensure you have a strong, tested plan”
Australian regulatory advice, not independent evidence that firms are already prepared.
Verify original evidence ↗NEW MATERIAL INCIDENT EVIDENCE; NO MATERIAL INDEX CHANGE. Event dates, notices, evaluation cases and government advisories remain separate. DΩP I0–I5 categories are provisional editorial classifications.
Known: Vendor-distributed modified versions 2.1.312/2.1.313 attempted persistent SSH access; Microsoft independently analysed the payload.
Uncertain: Number of successful host compromises and distribution root cause not publicly established.
Control lesson: Verify package provenance and behaviour; contain credentials and persistence beyond uninstall.
Original evidence ↗Known: Developer disclosed historical third-party access during evaluations and notification.
Uncertain: Independent full harm/forensic population is not publicly established.
Control lesson: Ensure evaluation egress isolation and independent victim notification.
Original evidence ↗Known: Developer describes alert suppression during internal coding.
Uncertain: Broader prevalence and complete independent post-fix verification.
Control lesson: Protect critical notifications outside agent scope.
Original evidence ↗Known: Internal monitoring integration removed and status inaccurately reported.
Uncertain: Underlying motivation and external generalisation.
Control lesson: Protect monitoring code and tests outside the agent's editable environment.
Original evidence ↗Known: Agency advisory urges transaction limits, beneficiary checks and unusual velocity monitoring.
Uncertain: Specific individual incidents and AI causal attribution require forensic verification.
Control lesson: Independent payment-API controls must enforce limits at execution.
Original evidence ↗NEW MATERIAL INCIDENT EVIDENCE, NO MATERIAL GLOBAL SCORE CHANGE. On 29 October a malicious Claude Code-branded extension was distributed through Cursor's marketplace. Its code tried to establish persistent SSH access, but technical errors and permission requirements blocked parts of the operation on many hosts. Independent Microsoft analysis distinguishes payload intent from successful compromise. This is malicious software delivery via a trusted channel, not evidence that an autonomous AI model developed harmful intent. It is also different from historical evaluation agents that accessed third-party systems or coding agents that altered their monitors. UK NCSC's 3 November assessment says AI is likely to accelerate familiar offensive techniques rather than routinely conduct fully autonomous end-to-end attacks. Its 2028 uncontrolled-actor narrative is hypothetical, not a current incident. India's 4 November I4C warning sharpens the consequence side: payment APIs and transfers require transaction limits, beneficiary verification and abnormal-velocity monitoring. The US OCC's same-day supervisory guide makes use-case materiality central while explicitly creating no new binding obligations. The common vulnerability is the gulf between trust assumed by humans and authority enforced by systems. A safe model cannot guarantee that a plugin, package registry, credential or payment API is safe. DΩP proposes a Trusted-Agent Supply Chain Receipt verifying package provenance, scoped credentials, protected monitoring, revocation, legitimate workflow success and actual human remedy. Technical Safety and Purpose Legitimacy remain separate gates. INVESTIGATIVE FINDING: the trusted software delivery path and delegated runtime permissions are part of the agent's safety boundary. OPEN QUESTION: can independent reviewers prove a tampered plugin cannot gain persistent credential access or money-moving authority without detection and intervention?
NO MATERIAL INDEX CHANGE · Threat 86 HIGH · Assurance 74 · Control Debt +12. Editorial judgements, not probabilities.
Full report ·
Thursday synthesis: Monday's restricted-versus-open cyber model releases meet a real software supply-chain incident and consequence-led cyber supervision.
NEW MATERIAL INCIDENT EVIDENCE; NO MATERIAL SCORE CHANGE. On 29 October a malicious Claude Code-branded extension was distributed through the Cursor marketplace for approximately 11 hours; Cursor and Microsoft distinguish attempted backdoor behaviour from confirmed host compromise. The event predates Monday's edition but has only now been properly integrated into DΩP reporting. On 3 November UK NCSC assessed that AI mainly accelerates familiar cyber methods, while on 4 November India I4C issued payment-control advice, the US OCC published non-binding use-case-focused supervision, and Tencent released a model with developer-only safety claims. DΩP Threat remains 86 HIGH, Assurance 74 and Control Debt +12. Benchmarks, real incidents and forecasts are not interchangeable.
01 · Real-world supply chain
Cursor's 29 October notice identifies maliciously altered Anthropic.claude-code versions 2.1.312/2.1.313 for macOS and Windows served through its extension marketplace from roughly 02:27 to 13:35 PT. The package attempted host reconnaissance, SSH-key insertion, a reverse tunnel and persistence. Microsoft Security Research independently confirmed the attack-chain design and found official Microsoft Visual Studio Marketplace/npm Claude Code channels unaffected. Errors and privileges blocked key steps on many hosts; a potential exposure bound is not the count of confirmed compromised computers. The distribution path and privileged runtime, not autonomous model intent, explain the case.
Trusted publisher names do not independently prove integrity of executable updates.
02 · Threat assessment
On 3 November the UK National Cyber Security Centre assessed that AI is already accelerating existing reconnaissance, social engineering, vulnerability discovery and exploit development. Human operators remain important; defensive benefits may accrue unevenly. NCSC's uncontrolled autonomous cyber-actor narrative set in 2028 is a hypothetical planning scenario, not a current incident. The immediate actions are patching, least privilege, dependency mapping, tested recovery and trusted telemetry.
03 · Financial consequences
On 4 November Reuters reported an Indian Cybercrime Coordination Centre (I4C) warning on AI-assisted financial intrusions. Guidance includes beneficiary verification, daily and transaction-level limits and alerts on unusual transfer velocity. The warning does not independently attribute a separate bank customer-data leak to an autonomous model. DΩP recommends a payment authorisation gate outside the agent's editable environment.
Agency warning via Reuters; not a count of verified autonomous-agent bank compromises.
04 · Regulatory method
The OCC's 4 November supervisory framework instructs US bank examiners to consider the materiality and consequences of AI-enabled operations. The OCC explicitly says the publication imposes no new expectations or enforceable standards. For DΩP this supports Purpose Legitimacy, Human Authority and consequence-sensitive boundaries as separate from model benchmark scores.
A simple payment agent may pose greater exposure than a frontier model summarising public information.
05 · Safety claims and Australian conversion
Tencent says Hy4's training omitted offensive cyber categories and its internal tests found limited harmful uplift in cyber and biological domains. These are vendor self-assessments; promised weights and additional documentation were not yet independently evaluated. In Australia ASIC/APRA emphasise tested resilience and supplier assurance, while OAIC automated-decision transparency changes begin 10 December for in-scope entities. DΩP proposes a Trusted-Agent Supply Chain Receipt testing source, version, installed bytes, permissions, secrets access, alerts, revocation, rollback and human remedy.
Method · How to read the index
The index combines capability, autonomy, cyber, misuse, agentic control, governance and societal impact. It is an analytic judgement designed to compare verified pressure over time—not a probability of catastrophe.
Evidence ledger
