Malicious Claude Code extensions targeted Windows and macOS developers through Cursor collecting device details and planting files for persistent remote access.

Darktrace says a LiteLLM AI gateway linked to Amazon Bedrock was compromised for cryptomining after signs of exposed SSH activity.