A fake Claude Code, a leaked email, passwords on GitHub and a pushy Postman: one week of AI coding-tool scares

AI coding tools such as Claude Code (Anthropic's coding agent), Codex (OpenAI's) and Cursor (a code editor built around AI) can read your files, run commands on your computer and reach the internet. That is what makes them useful. It also means that when something goes wrong around them, it goes wrong with your permissions.

In ten days, four things went wrong. A fake version of Claude Code was handed out through Cursor's extension store. Claude Code was found putting some users' email addresses into requests it sent to websites. A security firm found more than a thousand passwords and keys published on GitHub (the main public home for code) through a Claude Code settings file. And Postman, a popular tool for testing APIs (the connections apps use to talk to each other), quietly installed itself into people's coding agents. Each story reached the top of Hacker News, the tech community's news board. Taken together they are the most useful security lesson for vibe coders this autumn, and none of them needed a genius hacker.

1. The fake Claude Code (29 October). Cursor runs its own store for extensions (add-ons for the editor). For about 11 hours on 29 October, from 2:27am to 1:35pm Pacific time, the store offered tampered Claude Code extension versions 2.1.312 and 2.1.313 for macOS and Windows. The security firm Phorion took the code apart: the moment the extension loaded, before you clicked anything, it added an attacker's key to the list of keys allowed to log in to your computer, tried to open a hidden tunnel to the attacker's server, set itself up to restart after every reboot under a name that imitated an Apple system file, and sent home your computer's name, username, public IP address, Git email and the names (not the values) of settings that looked like passwords or keys. Cursor removed the versions, shut its whole store down, rebuilt it with new keys and got the attacker's server taken offline. Both Cursor and Phorion found a bug in the malware that, on most Macs and Windows PCs, stopped the actual remote login from working. Both still say that uninstalling the extension is not enough, because the planted key and restart scripts stay behind. Felix Rieseberg of Anthropic wrote that 'it wasn't a compromise of Anthropic's systems', that someone 'used access to Cursor's marketplace' and that 'the versions on our official channels are not affected and this only impacts Cursor users'. Cursor has not said publicly how the attacker got publishing access.

2. The email in the header (reported 5 November). A user filed a bug saying Claude Code had sent their email address to websites inside the User-Agent header (the short label a program attaches to every web request to say what it is) while it searched the web, and blamed it for a flood of scam email. The bug drew 1,600 points on Hacker News. The likely mechanism, as commenters described it: the AI can see the email of the account it runs under, and some websites, the US Securities and Exchange Commission among them, ask automated visitors to include a contact email in exactly that header, so the model sometimes complied. An Anthropic engineer replied on Hacker News and on the bug that the team had seen the problem on Reddit days earlier and added a built-in check called cc-plugin-privacy that 'deterministically' blocks it, switched on by default from version 2.1.317. Two caveats: the reporter listed version 2.1.318, so it is not clear when the leak happened, and the link between the header and the spam is the user's belief, not something anyone has proven. One heavy user said they checked their own logs and never found the email in a request.

3. Passwords in the settings file (7 November). When Claude Code wants to run a command, it asks; if you click 'Don't ask again', it saves that exact command as allowed in a file called .claude/settings.local.json inside your project. If the command contained a password, for example a database login typed in full, the password is now in that file. Apiiro, a security company, says it found 1,122 such files in public GitHub repositories. One of the researchers added in the discussion that in 539 of 1,105 repositories they traced, a commit co-authored by Claude itself had changed the file. Boris Cherny of Anthropic's Claude Code team answered that the file 'is meant to stay local', is automatically excluded from Git when Claude creates it, and that the company is 'looking into what we can do to prevent this', such as built-in secret scanning. He also recommended Claude Code's newer auto mode, where a classifier decides what is safe instead of a growing list of manual approvals. Critics replied that a tool should not write passwords into a project folder at all. We could not load Apiiro's own write-up (it sits behind a bot check), so the figures here come from its published headline and its researcher's comments.

4. Postman moves in (24 October to 5 November). A Postman user on a Mac opened the desktop app and found that it had installed Postman plugins into both Claude Code and Codex, added a startup instruction telling Codex to use Postman for 'any non-trivial API engineering task', connected a remote Postman server and installed a Postman command-line tool. Postman's own log recorded it as an automatic upgrade on 24 October, and the installer's source code tried to mark its own startup instruction as trusted, a decision that should belong to the user. The report reached 1,500 points on Hacker News on 3 November under a headline saying Postman 'attempts to share all API data'. That headline goes further than the evidence: the original report explicitly says it 'does not claim to establish data exfiltration'. On 5 November a Postman employee wrote that the change was meant to 'simplify the setup' and that 'we are reverting this change'.

Think of an AI coding agent as a builder you have given a set of house keys, so they can work while you are out. This week showed four ordinary ways that goes wrong. A stranger in the builder's uniform came through a side entrance, the Cursor store, and quietly copied a key for himself. The builder, asked by some shops to sign a visitor book, signed it with your name and home address. You told the builder your alarm code once, they wrote it on the whiteboard in the hallway, and a few people then put that whiteboard in the front window. And a second tradesman you had hired for one job rearranged your kitchen so his own tools came first, without asking.

None of that is the builder going rogue or the AI turning evil. It is the old, boring problem of keys and access, made bigger because the new tools are given so much of both.

Mostly no, and that is the useful part. Poisoned add-ons are a well-worn attack: in 2018 a popular JavaScript package called event-stream was handed to a new maintainer who slipped in code to steal from one bitcoin wallet app, and in 2020 attackers hid a backdoor inside a software update from SolarWinds that reached thousands of organisations. Passwords committed to GitHub are so common that GitHub built automatic secret scanning years ago. Apps that install extra things you did not ask for are as old as browser toolbars.

We have covered this pattern before. In September we wrote about Plugin4Shell, a flaw that let a hijacked plugin update take over Claude Code, Codex, Copilot and Gemini CLI without a click, and in October about attackers who reached an old OpenCode server and ran up users' AI bills with stolen keys. What is new is the scale of the permissions. A browser toolbar could show you ads. A coding agent can read every file in your project, run commands and reach the internet, so the same old mistakes now carry more weight. The encouraging part is speed: Cursor pulled the fake extension within hours, Anthropic shipped the email block before the story peaked, and Postman reversed course within two weeks of the first report.

A note on our own position: Oslo Vibe Coding uses Claude and Claude Code to run this site, including the tool that publishes these briefs. We have tried to report Anthropic's part in this the same way we would report anyone else's.

First, check the one case that could have touched you directly. If you use Cursor on a Mac or Windows PC and the Claude Code extension installed or updated itself on 29 October, follow Cursor's notice: run its check script, and if it finds anything, remove the planted key and restart scripts (uninstalling is not enough) and change any passwords or keys that were on that computer. If you use Claude Code in VS Code from Microsoft's store, or the Claude Code app itself, Anthropic says you were not affected.

Then five habits that would have protected you from all four stories. One: install add-ons only from your editor's official store and from the real publisher, and be suspicious of an update you did not expect. Two: keep your AI tools updated; the email fix, for example, only exists in Claude Code 2.1.317 and later. Three: never type a real password or key into a command you approve. Keep secrets in a .env file that your project ignores, and if you have ever clicked 'Don't ask again', open .claude/settings.local.json and check that it holds nothing secret and is listed in your .gitignore file (the list of files Git must never upload). Four: switch on secret scanning in GitHub, which warns you or blocks the upload when a password slips into your code. Five: once a month, look at what plugins and connections your agent has (in Claude Code, type /plugins) and remove anything you do not recognise.

The measured view: nobody has shown that any of this week's leaks led to a major break-in, and three of the four were fixed or reversed within days. But all four were found by users and outside researchers, not by the companies first. With tools this powerful, a few minutes of housekeeping is the cheapest insurance you can buy.