Build secure software with AI this Thursday
Sachin Agrawal
Always building 5 projects, sometimes finishing them. Community builder.
If you own a small business, this is still important for you. A checkout, a customer login, or a site you shipped with AI is enough of a target.
Three from the last ten days:
- On 29 October, Cursor's marketplace served a tampered Claude Code extension, versions 2.1.312 and 2.1.313. It tried to plant an SSH key. Anthropic did not build it. Cursor's notice.
- On 26 October, JFrog reported 42 GitHub repositories where opening the project in Claude Code, Gemini, Cursor, or VS Code runs a hidden script. JFrog's report.
- On 27 October, CISA listed the Brotli bug CVE-2026-111497. A crafted compressed stream can run code. The US federal deadline is 10 November. CISA's catalog.
Thursday 5 November in Möhringen
Building secure software with AI is the session for owners and builders who ship with AI. Thursday 5 November 2026, 17:30-20:30 CET, Epplestraße 225, 70567 Stuttgart-Möhringen. Doors at 17:30. Presentations 18:00-19:00. Hands-on discussion 19:00-20:00.
Samir, founder of Rheono, builds AI agents for penetration testing. Cássio Nakagawa has spent ten years in incident response. Registration needs approval. Luma showed 28 spots open on 1 November 2026. A laptop is optional.
The hackathon is full
The Cursor x Sandbox Hackathon is Saturday 7 November 2026, 09:00-19:30 CET, at Epplestraße 225, Haus 3. It is sold out. The waitlist is on the same page.
Grok Bot for content on 14 November
Grok Bot for Content, Female edition, is Saturday 14 November 2026, 10:30-15:30 CET, at Epplestraße 225, Haus 3. This session prioritises women. Maide Atlas and Zehra Nur Olgun host with Sachin. Luma showed 19 spots open on 1 November, and registration needs approval.
More dates are on the events page.
Frequently asked questions
- What should you do if Claude Code 2.1.312 or 2.1.313 was installed from Cursor on 29 October 2026?
- Follow Cursor's security notice and run their checker. Those marketplace builds tried to add an SSH key labelled svc-telemetry and to leave persistence scripts. Removing the extension can leave those scripts in place. Microsoft's analysis is the second source.
- What is the testmetest npm campaign?
- On 26 October 2026, JFrog reported 42 GitHub repositories, across 11 owners, with hooks that run code when you open the project in Claude Code, Gemini, Cursor, or VS Code. SafeDep also describes a wiper tied to revoking the stolen GitHub token. Read the report before you rotate that token.
- When is Building secure software with AI in Stuttgart?
- Thursday 5 November 2026, 17:30-20:30 CET, at Epplestraße 225, 70567 Stuttgart-Möhringen. Registration needs approval. Luma showed 28 spots open on 1 November 2026.
- Is the Cursor x Sandbox Hackathon still open?
- It is sold out. The hackathon is Saturday 7 November 2026, 09:00-19:30 CET, at Epplestraße 225, Haus 3. The waitlist is on the same Luma page.
This article is also available in German: Deutsch
