October's attacks came through developer tools and AI. November's controls should start there

In brief

The most instructive incidents of October 2026 did not break through a perimeter. They arrived through things organisations had already chosen to trust: an extension marketplace, a package manager, a recruitment platform, an internal AI tool, a booking-systems provider and a certificate authority.

Two stand out because they sit on the developer's machine. On 29 October Cursor found tampered builds of the Claude Code extension in its marketplace that tried to plant an SSH backdoor. On 3 November Binance said the theft it suffered on 29 October began months earlier with a tampered Homebrew installation and a fake job interview, and moved through an internal AI tool to a deployment token.

This piece sets those incidents beside the supplier breaches ByteNib covered in October, separates what the companies have confirmed from our interpretation, and ends with the controls security and IT teams should change this month.

The editor became the entry point

Cursor's security notice says that "between about 2:27am PT and 1:35pm PT" on 29 October, versions 2.1.312 and 2.1.313 of Anthropic.claude-code for Windows and macOS in the Cursor VS Code Extension Marketplace were maliciously modified (our report covers the incident). Cursor states: "These malicious versions of the extension were not developed by Anthropic."

According to Cursor, the code collected host details, including environment variable names and the configured Git email, tried to add an attacker key labelled svc-telemetry to authorized_keys, tried to enable the local SSH service and open a reverse tunnel, and set up persistence through a LaunchAgent on macOS or a scheduled task on Windows. Cursor says enabling SSH needs admin rights the extension lacked on most hosts, so on those the attacker "could not have logged in through the tunnel". The key, the persistence and the host report were still written. Cursor removed the builds, shut down and rebuilt the marketplace, rotated its keys and had the attacker server taken offline.

Microsoft's analysis of the loader adds two facts that matter for response. It says the packages "were never published nor distributed from Microsoft Visual Studio Marketplace and from npm @anthropic-ai/claude-code", and that "Removing or updating the extension does not remove artifacts written outside its installation directory." It also notes that the loader sent environment variable names, not values.

The lesson is about where trust is granted. The extension was branded as a well-known AI coding tool, delivered by the editor's own marketplace and updated automatically. Nothing about the install would have looked unusual to the developer. Microsoft points to Cursor's own hardening controls: restricting extensions to approved publishers and configuring an installation cooldown for newly published versions.

Binance: a developer laptop, an AI tool and a deploy token

Binance's initial report, published on 3 November, puts the impact at "Approximately USD 6.34 billion in digital assets" and says about USD 2.85 billion had been frozen or intercepted. It describes "a sophisticated, multi-stage campaign" and states: "It was not a single isolated breach or a simple phishing incident." ByteNib covered the theft itself and the FBI's attribution in our earlier report.

The attack path, as Binance tells it:

• June: a poisoned developer tool. A Wallet DevOps engineer "downloaded a tampered Homebrew installation in order to install a popular AI coding tool after searching for it on a search engine". Binance detected it, replaced the device and rotated credentials, but the engineer's role and colleagues "was exposed to the hacker". Binance's report does not itself say the download came from an advert. A SANS Internet Storm Center diary from May documents a malicious search advert for a fake Homebrew page, which shows the technique is in use, but it does not describe the Binance case.
• September: a fake job interview. A second engineer was approached "through a legitimate job-hunting platform" by someone posing as a project director. After two interview rounds, the second with the "CEO of a fictitious company", he was told to download an "assignment" repository to his work computer. Its setup code replaced a pyenv component in Homebrew's directory with a malicious copy. Binance says the malware "was not detected by the endpoint security protection tools at the time".
• 20 October: the AI tool as a springboard. Binance says the attacker, working from the second engineer's computer, "used an internal AI tool to gain control over" the machines of the first engineer and a third, and found that the first "had a container deployment permission token on his computer".
• 29 October: the theft. Between 17:15 and 19:56 (Binance does not give a time zone) the attacker logged onto a third engineer's computer, used the stolen credentials, "deployed a container, and triggered a malicious script". The script used unauthorised access to an internal wallet signing service.

Binance says it has rebuilt the wallet system and "the affected internal AI tool and access controls", replaced devices and decommissioned the engineers' credentials and tokens. It has not explained how the AI tool was used to reach other machines.

Read against Binance's own account, three controls failed in sequence: what a developer could install, what a work laptop could run, and what a token on that laptop could deploy. The internal AI tool deserves particular attention because many organisations are now connecting such tools to code, tickets and colleagues' environments.

Suppliers that hold your data or your trust

Two other October incidents ByteNib covered are supply-chain events in the plain sense: a third party held either data or trust on behalf of many customers.

Amadeus. Japan Airlines says it was informed on 23 October by Amadeus, the provider of its passenger service system, that unauthorised access to its system had exposed part of JAL's customer reservation data. The period of access ran from 10 August 2023 to 23 September 2026. JAL counts about 92,000 affected customers, about 2,000 of them with details including passport numbers. JAL says there was no compromise of credit card numbers or passwords. Other airlines have made their own disclosures; see ByteNib's report.

eMudhra. Microsoft's MSRC says it is responding to "eight eMudhra intermediate certificate authority (CA) private keys: six associated with TLS and two with code signing". The code-signing keys "could be used to make malicious software appear to come from a trusted publisher". Microsoft blocked the affected CAs on 20 October and removed seven certificates from the Windows trust list on 26 October and from Edge on 27 October. It stresses that the issue "was not a compromise of Microsoft systems". Our practical guide covers offline machines and applications that ship their own certificate bundles.

Other October stories, such as the BTCPay Server wallet thefts and the LXD, GoAhead and php2shell vulnerabilities, are product security flaws rather than supplier compromises, and we leave them out of this pattern. ByteNib's October supply-chain roundup covers smaller vendor-linked incidents.

Copilot's billing change is a governance question, not an attack

Microsoft 365 Copilot's commercial changes belong in this picture for a different reason. They are not a security incident. They change who can switch on AI agent capability, and how its cost is controlled.

Microsoft's October Partner Center announcements say that "Starting December 1, 2026, usage-based billing will be enabled by default for new Microsoft 365 Copilot Business licenses purchased in Cloud Solution Provider (CSP)". The date was moved from 2 November. The default spending limit "will be 4,000 Copilot Credits per user per month, which can be adjusted by admins". Microsoft also says that from 1 December new Copilot offers "can be purchased without a qualifying Microsoft 365 base subscription".

The point for security teams is that a default-on meter is also a default-on capability. Agent features that run through usage billing should go through the same approval as any new tool that can read company data. ByteNib set out the cost side in our Copilot billing explainer and the related dates in Microsoft's autumn deadlines.

What security and IT teams should change in November

This section is ByteNib editorial analysis, drawn from the incidents above.

1. Treat extension marketplaces and package managers as suppliers. List which editors your developers use, which marketplaces they pull from, and whether auto-update is on. Where the tool supports it, allow only approved publishers and add a cooldown before new versions install, as Microsoft recommends for Cursor.
2. Hunt for the Cursor indicators now, even if you think you were not exposed. Check authorized_keys files for svc-telemetry, then use the indicator sections of Cursor's security notice and Microsoft's analysis. Removing the extension is not a clean-up.
3. Make developer tooling installs come from known sources. Binance's first foothold came from a tampered install found through a search engine. Publish internal, verified install routes for Homebrew, AI coding assistants and common CLIs, and monitor for changes to binaries under user-writable tool directories such as /opt/homebrew.
4. Ban take-home assignments and interview code on work devices. Say it in policy and in onboarding, and give staff a clear reason. Binance's second engineer ran an interview repository on his work computer.
5. Remove standing deployment tokens from laptops. Replace them with short-lived, just-in-time credentials tied to a reviewed pipeline. A token that can deploy to production should not sit in a developer's home directory.
6. Put internal AI tools inside the threat model. For each internal assistant or agent, record what systems and colleagues it can reach, what actions it can take and who reviews its logs. Binance has rebuilt its AI tool's access controls; most organisations have not yet written theirs down.
7. Check certificate trust outside Windows Update. Find Java runtimes, appliances and applications with their own certificate stores, and confirm the eMudhra changes have reached them.
8. Ask booking and data processors for an access timeline. Amadeus's access window ran for more than three years. Ask key processors how long they retain logs, and how quickly they would notify you.
9. Set Copilot usage limits before 1 December. For Copilot Business licences bought through CSP, decide who may enable usage-billed agent features, and replace the default limit with a figure you have chosen.

Sources and scope

All sources were checked on 4 November 2026:

• Cursor, security notice on the malicious Claude Code extension, 29 October, updated 30 October.
• Microsoft Security, analysis of the Claude Code-branded extension and SSH backdoor, 30 October.
• Binance, 29 October security incident: initial findings and response update, 3 November, read on Binance's LinkedIn page because its blog did not load for us.
• SANS Internet Storm Center, malicious ad for Homebrew, 1 May, cited for the technique only.
• Japan Airlines, unauthorised access to the Amadeus passenger service system, 30 October.
• Microsoft Security Response Center, response to compromised eMudhra CA keys, 26 October, updated 27 October.
• Microsoft, Partner Center announcements, October 2026.

Scope and caveats: Binance's account is its own initial report and has not been independently verified; it says the investigation is ongoing. Media reports that Binance's first compromise came from a malicious search advert rest on an unnamed source, so we do not state it as fact. Anthropic's position on the extension is as reported by Cursor and Microsoft. Copilot terms apply to CSP purchases and may differ under other agreements. The grouping of these incidents as one pattern, and the November recommendations, are ByteNib editorial analysis.

Drafted with AI assistance and reviewed by the editor before publication.

Cover illustration: AI-generated illustration: ByteNib

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.