Benchmark8d ago
Anthropic's Frontier Red Team details five exploit chains an unreleased internal Claude model built for Chrome, Safari, Android, Windows and Linux; Chrome 156 fixes 62 CVEs
Anthropic's Frontier Red Team published a research post on Oct 27 saying it spent the past few months using an unreleased internal research model to find critical vulnerabilities in browsers and operating systems, and that after initial prompting Claude wrote five full exploit chains: one-click remote code execution with a sandbox escape in Chrome, a same-origin policy bypass in Safari, data extraction from a locked Android phone over USB, a remote denial of service against Windows HTTP/3 (QUIC), and zero-click root code execution on Linux servers with a multipath TCP listener. Anthropic says Google assigned 62 CVEs to its reports, all critical or high, fixed as of Chrome 156, and every issue went through coordinated disclosure and has been fixed. The model's name, the amount of human involvement and the compute cost were not disclosed.
Tooling5d ago
Cursor marketplace served a tampered Claude Code 2.1.313 extension with an SSH backdoor, affecting at most 5,000 users
Cursor posted a security notice on X at 07:46 UTC on Oct 30: version 2.1.313 of Anthropic.claude-code in its VS Code extension marketplace was a maliciously modified build, not developed by Anthropic, available from about 2:27am to 1:35pm PT on Oct 29 and affecting at most 5,000 users. The payload collects host details, adds an attacker SSH key, tries to open a reverse SSH tunnel and installs persistence. Cursor pulled the version, shut down and rebuilt the marketplace, rotated keys and had the attacker server taken offline; it asks users to update Claude Code for VS Code to 2.1.314 and follow the check and cleanup steps in its blog post.
Tooling66d ago
Cursor introduces Background Cloud Agent for asynchronous multi-repo refactoring while IDE is offline
Cursor unveiled Background Cloud Agent, enabling developers to offload lengthy codebase migrations and test suites to cloud sandboxes. Programmers can close their IDE while the remote agent executes refactoring plans, validates lint rules, runs test matrices, and submits verified PRs for review.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.