Claude Code

Agent plugins are privileged dependencies, and the Claude Code backdoor proves it

A tampered Claude Code extension sat in Cursor's marketplace for about 11 hours. The lesson isn't about one vendor: coding-agent plugins need signing, review and sandboxing.