Hello!

Welcome to issue #20 of Secure Prompt's Threat Wire, covering October 26 to November 1.

This week the tools developers trust with AI access were the delivery route. Cursor's marketplace served a trojanized Claude Code extension for about 11 hours. The agentic pentest framework ARTEX, tied to Storm-0940 in our last issue, was linked to more actors by CrowdStrike, Google and Microsoft. Wiz traced stolen AI platform keys into resale pools. And LiteLLM shipped a fix for a CVSS 10.0 flaw under release notes that said "No action needed to upgrade".