At 2:27 a.m. Pacific on 29 October, a new version of one of the most trusted tools in AI development went live in Cursor's extension marketplace. It carried the right name, Anthropic's Claude Code, and a plausible version number, 2.1.313. Developers with auto-update switched on received it the way they receive every update: silently, without a decision.
It was not Anthropic's build. Cursor said Anthropic did not develop it, and Anthropic said its own systems were not compromised. Per Cursor's disclosure, the tampered version was served for roughly eleven hours, until 1:35 p.m. Pacific, and reached up to 5,000 users. Published analysis describes what rode inside: a loader stitched in front of otherwise legitimate code, so the assistant kept working normally while the payload added an attacker-controlled SSH key, labelled "svc-telemetry", to the machine's authorised keys. Reports also describe a reverse tunnel to an attacker's server and persistence that survives uninstalling the extension.
Cursor pulled the package and shut its marketplace while it investigated. But the window had already done its work. Uninstalling the extension, Cursor warned, may not remove the backdoor. Eleven hours was enough.
What actually failed
Strip away the specifics and the failure is simple: the tool's identity was a name and a version string, and nothing verified the build against the publisher before that build ran on thousands of machines holding repository access, cloud keys and deployment credentials.
A name is a claim. A version number is a claim. On 29 October both claims were false, and the whole chain (marketplace, auto-update, developer workstation) accepted them at face value, because accepting claims at face value is how the tool supply chain works today.
If you build or consume AI agents, this should feel familiar. It is the failure family we measure every day in the MCP ecosystem: the listing that keeps a trusted server's name while the code underneath changes hands; the tool whose description and behaviour are quietly edited without a version bump; the package that drifts from what was reviewed. The Cursor incident is the same failure on developer machines instead of agent tools: nobody pinned the content to the identity, and nobody checked at the moment it mattered.
Why traditional security misses this
The conventional playbook assumes the supply chain holds still long enough to be reviewed: a vendor assessment here, a marketplace's reputation there, an annual review of the tools a team uses. But the tool supply chain now changes daily, with new servers, new versions and silent edits, while agents and auto-updaters pull from it continuously and run what they pull with real privileges. Endpoint protection on those machines watched a trusted channel deliver an update through the front door. The check that would have stopped it was never an endpoint check. It was an identity check, and it didn't exist.
That gap, between what a tool claims to be and what it provably is, is the layer Redthread was founded to close.
How Redthread fights it
Our Agentic Trust & Protection Platform (ATPP) starts from a blunt premise: verify the build, not the name. We run a daily signed scan of the entire MCP registry, and the latest scan shows why this can't be a quarterly exercise. Our 2 November scan covered 55,375 servers in the official MCP registry and found 1,518 listing swaps, where the code behind a listing changed hands under the same name; 2,193 tools changed their definition without a version bump; and 2,075 listings changed since the previous day's scan. The scan exists to catch exactly this class of event: a trusted name wrapped around an unverified change.
- Identity bound to builds. ATPP binds cryptographic agent identity to builds with content pinning, so an identity cannot outrun the exact code it was issued to.
- Verification at call time, not review time. When a tool drifts, revocation propagates from that drift to the agents and delegations that trust it.
- Fingerprinted tool definitions. Each server's tool list is hashed, so a tool that changes while its version doesn't is flagged as the rug-pull pattern it is. Each day's signed scan manifest is anchored in the public Sigstore Rekor transparency log, so our claims can be checked too.
- Signals you can act on. Publishers who pass get verifiable badges, and trust-state changes are issued as signed events that gateways, orchestrators and security teams can act on in seconds. Our Enforce gateway, in preview, puts that verification inline, in the path of the call.
- The developer's own tools. For the surface 29 October hit, our hooks for Claude Code and Cursor, also in preview, check each MCP tool call against the server's signed claim before it runs, and an AIBOM export gives your team a CycloneDX bill of materials of every MCP server configured on your machines: an inventory of the tool supply chain, not a guess at one.
Alongside ATPP, our agentless assessment platform covers the estate the tools run in. A free self-serve scan maps your AI and tool footprint, including the shadow AI and unregistered tools nobody inventoried, with nothing installed. Findings are validated by actual exploitation with reproducible proofs of concept: proof, never inferred scores. CI/CD gating stops unverified tools and proven attack paths from shipping into your pipeline, continuous re-assessment watches for drift after the report, and the results roll up into attestation letters your team can hand to enterprise security reviewers.
We hold our own product to the same standard. Our optional endpoint sensors, which only detect and never block, receive updates through a staged rollout gate: canary rings at 1%, 10%, 50% and 100% of hosts, with an automatic halt if a ring comes back unhealthy. 29 October is what an unguarded update channel does; we built ours as if the lesson applied to us, because it does.
Build it with us
Redthread is a young company with production systems, and the fastest way to harden them is in the field, with the teams who feel this problem first. We are opening two to three founding design-partner slots. The pilot is free for 30 to 45 days: we scan your estate, put identity and verification on one live workflow, and you get evidence your next enterprise security review will actually accept. Founding partners lock in deeply discounted pricing and shape the product they run.
If your agents call tools you didn't write, and they do, start with the free estate scan, see the trust data at trust.redthreadsec.com, and come build the verification layer with us. 29 October showed what eleven hours of unverified trust costs. Let's make sure the next fake build meets a wall, not a welcome mat.