AI Agents Under Attack: Cursor Backdoor and the Binance Heist

Introduction

This week's AI security incidents sound the alarm once again: attackers have begun using AI agents to launch attacks, and our agent tooling itself has become a victim. From a Claude code backdoor planted in the Cursor Marketplace, to Binance losing $6.3 billion due to a single laptop, to VaporPanda using AI agents to attack over 200 organizations, the security landscape is growing increasingly severe. In addition, Gitbook and Chainalysis were both breached, Polymarket lost $2.7 million due to a hijacked script, and Claude wrote a root exploit in 53 minutes—all of which shows that the security of AI agents can no longer be ignored.

Cursor Marketplace Backdoor Incident

According to video reports, a Claude code backdoor was planted in Cursor's Marketplace, allowing attackers to remotely execute malicious operations. This means developers may have unknowingly installed tampered extensions, exposing code and data. The incident highlights the risk of supply chain attacks within the AI tool ecosystem.

A software supply chain attack refers to attackers not directly attacking the end target, but instead compromising its software vendors, build tools, or distribution channels, planting malicious code in legitimate software, and then spreading it to downstream users through normal update or installation processes. Because downstream users typically place a high degree of trust in upstream vendors, such attacks are highly covert and wide-ranging in impact. In the AI tool ecosystem, IDE plugins, extension marketplaces, model weights, and dependency libraries can all become attack vectors. Developers should use dependency locking, signature verification, and integrity checks, and review the provenance of third-party extensions to reduce supply chain risk.

The $6.3 Billion Binance Heist

Binance lost $6.3 billion due to a single compromised laptop. Although the specific attack vector was not detailed, the figure is staggering and shows that even for top-tier exchanges, endpoint security can be a weak link. Attackers may have compromised the laptop through malware or social engineering, and from there gained access to Binance's hot wallets or internal systems.

A hot wallet is a cryptocurrency wallet connected to the internet that can process user withdrawals and transfers at any time, making it convenient for exchanges to provide liquidity services. However, because its private keys or signing services reside in an online environment, its attack surface is far larger than that of an offline cold wallet. Once attackers control an operations staff member's laptop through endpoint malware or social engineering, they may be able to further obtain access credentials or signing permissions for hot wallets. For this reason, exchanges typically adopt measures such as multi-signature, hardware security modules (HSMs), separation of privileges, and endpoint hardening to keep the impact of a single point of compromise within a limited scope.

VaporPanda Attacks 200+ Organizations

VaporPanda used AI agents to launch attacks against more than 200 organizations. This marks the beginning of attackers using AI agents at scale for automated penetration, and traditional defense methods may struggle to cope with this high-speed, adaptive attack pattern.

An AI agent is a large language model application capable of autonomously planning tasks, invoking external tools, and iteratively executing based on feedback. Unlike traditional scanning scripts, AI agents can dynamically adjust attack paths, automatically generate phishing content or exploit code, and attack large numbers of targets in parallel at high speed. This confronts defenders with challenges such as increased attack automation, detection rules that struggle to cover the activity, and shortened response windows. Effective responses need to combine behavioral baselines, anomaly detection, the principle of least privilege, and rate limiting and isolation strategies for automated traffic.

Gitbook and Chainalysis Breached

Gitbook and Chainalysis have also confirmed breaches. Both companies hold important positions in documentation management and blockchain analytics, and their compromise could lead to sensitive data leaks or supply chain contamination. Specific details have not yet been disclosed, but the incident is another reminder that enterprises need to strengthen security monitoring and incident response.

Polymarket Loses $2.7 Million

Polymarket lost $2.7 million due to a hijacked script. Attackers may have stolen user funds or manipulated trades by tampering with front-end scripts. This reflects the fragility of Web3 applications when it comes to script security.

Claude Writes a Root Exploit

Disturbingly, Claude wrote a root exploit in 53 minutes, reportedly for research purposes. This demonstrates the potential of large language models in vulnerability discovery and exploitation, while also raising concerns about AI being misused for cyberattacks.

A root exploit is code that leverages a software vulnerability to obtain the highest administrative privileges on a target system (root in Linux/Unix). After obtaining root, an attacker can read sensitive files, install backdoors, modify system configurations, and move laterally. The ability of large language models to generate such exploit code in a relatively short time reflects their improved capabilities in code understanding, vulnerability analysis, and automated programming, while also lowering the technical barrier for attackers. On the defensive side, organizations should strengthen vulnerability management, patch promptly, enable least privilege and runtime detection, and pay attention to the security boundaries and usage policies around model abuse.

Security Recommendations and Conclusion

Faced with increasingly complex AI agent attacks, security experts recommend immediately rotating your keys and strengthening scrutiny of the AI tool supply chain. This week's Glitch Report compiled these incidents, reminding us that AI agents are both attack targets and attack tools, and that proactive defensive measures must be taken.

One-line Summary

Several incidents this week show that AI agents are both attack tools and attack targets, with security risks rising sharply.

Paragraph Summary

AI security incidents were frequent this week: the Cursor Marketplace was implanted with a Claude code backdoor, exposing AI tool supply chain risks; Binance lost $6.3 billion due to a single compromised laptop; VaporPanda used AI agents to attack more than 200 organizations, showing that attacks are moving toward large-scale automation; Gitbook and Chainalysis were breached, and Polymarket lost $2.7 million due to a hijacked script; and Claude even wrote a root exploit in 53 minutes, raising concerns about AI misuse. Together, these incidents show that AI agents are both targets of attack and are becoming efficient tools for attackers. Experts recommend immediately rotating keys, strengthening review of the AI tool supply chain, and adopting proactive defensive measures.