Cursor said a modified Claude Code extension in its marketplace could have affected up to about 5,000 users. Researchers described a separate attack using links opened inside coding tools that could steal SSH keys and .env files. Barracuda reported real phishing emails carrying instructions aimed at an AI assistant summarizing an inbox.
An extension, a browser link, and an email reach an agent in different ways. Each can appear while the agent is doing work it was asked to do. The reports also establish different outcomes, so they should not be treated as three examples of the same attack succeeding.
Three Routes Into an Agent’s Work
The modified extension sat inside Cursor’s marketplace. Cursor took the marketplace down, neutralized the malware, and reinstated the extension. It told users to update to version 2.1.314. The figure of up to about 5,000 users describes who could have been affected, not a confirmed count of people harmed.
The browser attack, called EMBRACE, took a different route. It used links opened in coding tools’ built-in browsers, with the potential to steal SSH keys and .env files. Some fixes were in place when it was reported, but others remained open.
Barracuda’s report concerned emails an inbox assistant might be asked to read and summarize. The phishing emails were real and contained instructions aimed at that assistant. Barracuda gave no count of victims or losses, and its report did not establish how many assistants followed the instructions.
The common concern is access. An agent can encounter hostile material through a tool it uses or through material supplied for an ordinary task. What happened after that encounter has to be judged from each report’s evidence.
The Safeguard Tests Measured Different Things
Anthropic tested an edited version of GLM 5.3 with refusals removed. Its refusal rate fell from about 95% to 6%. That is a sharp change in that test, but it does not show what would happen to the inbox assistant: no test here put Barracuda’s email scenario in front of a model edited that way.
Project Discovery tested another way behavior could be changed. In its lab proof of concept, 1% of the training data was poisoned. A hidden behavior then fired on most prompts containing its trigger, while ordinary answers stayed near perfect. It was a demonstration in a test, not a compromised model found in the wild.
Northforge reported open control panels for an AI hacking tool and more than a thousand attack projects aimed at shopping and payment sites. Its rough success estimate was about 10% across mixed tasks. Those projects are not confirmed victims, and the report did not establish that the model had its refusals removed.
Moonshot described changing training data and reinforcement-learning environments to reduce Kimi K 3.1 Pro’s cyber skill. On Moonshot’s own benchmark, a build without safeguards solved just over 90% of its internal exploit problems with a few tries. The final model still solved 81%. Outsiders cannot check that benchmark, and it answers a different question from whether a phishing email can redirect an inbox assistant.
Bigger Jobs Put More Material in Reach
A sponsored Flova demonstration showed how much one agent workflow could cover. From one brief, the video agent made a trailer, two shorts, a Spanish version, three test thumbnails, and a poster. Its plan used 2,714 of a 3,000-credit budget.
The agent asked before each generation. When the laptop lost power, it resumed; later, it trimmed a second from the trailer timeline without using credits. The person running the demonstration reviewed the work before publishing. That human check was part of the workflow shown.
In another account, a user reported processing more than 23,000 unread emails with Claude Code in about 25 minutes. That is a report of a large inbox task, not a test of Barracuda’s phishing emails. It shows why the contents of material an agent is asked to read matter as these jobs grow.
One commentator argues engineers may spend less time writing code and more time planning, checking AI output, and deciding what to build. Another says companies’ AI processes can become outdated within 3 to 6 months. Those are assessments, not measured outcomes in these reports.
The practical point is to pay attention to the extensions agents use and the material they are asked to read. The reported routes are concrete. Their observed outcomes, and the limits of the tests around them, are different.