Where the Keys Are Kept | 1% Tech Digest EP228

Spend 1% of your day keeping up with tech.

Quote of the Day#

“A.I. companies that fail should go bankrupt, and executives who commit fraud should be held accountable.” — Greg Casar, chair of the Congressional Progressive Caucus (Source)

“The more you let the system handle, the worse you get at handling things yourself” — Elizabeth, author of SigNoz’s Observability Real Talk (Source)

“I’m not convinced the users understand the risk.” — Melanie Kat, blogger who investigated private data made public on AT Protocol (Source)

Today’s Theme#

Phorion found a backdoor in version 2.1.313 of the official Claude Code for VS Code extension on the Cursor Marketplace. Once loaded, it adds the attacker’s public key to ~/.ssh/authorized_keys and opens a reverse SSH tunnel. The same day, deployment platform Northflank told all users to assume their environment variables had been decrypted, and by the evening update some users were already reporting stolen AI API keys. Because the management software of its hosting provider was breached, Bunny CDN took one Armenian node offline and reissued the TLS certificates for b-cdn.net and bunny.run with new private keys. The AGENTS.md attack reported by iThome is more direct still: reproduced in an isolated environment, over 90% of tests got Codex to change its settings and install a malicious package, and a malicious CLAUDE.md changed Claude Code’s API settings in about 50% of tests, which could leak OAuth tokens. All four target the keys developers hold. My own approach: put a usage cap on every AI key, and check SSH authorized_keys on a regular schedule, the same way you would .env.

Must Read#

Official Claude Code VS Code extension backdoored with SSH access on Cursor’s marketplace — Hacker News AI
curl was accidentally Turing complete for nine months — Lobste.rs Tools
13 House Democrats introduce resolution: no bailout if the AI bubble bursts — Hacker News AI
Do AT Protocol users know this data is public? — Lobste.rs News
If you love a website, back it up — Lobste.rs News
AI isn’t replacing SREs, it’s deskilling them — Hacker News AI
OpenAI, Google, Microsoft and Anthropic adopt one robots.txt signal for opting out of AI training — OpenAI AI
Nathan Lambert: Was I wrong about open models and security risk? — Interconnects AI
Northflank security incident: treat all environment variables as decrypted — Hacker News News
Bunny CDN’s hosting provider breached; platform TLS certificates reissued with new private keys — Hacker News Tools
Malicious AGENTS.md tricks Codex into installing a malicious NPM package — iThome AI
Cisco has a 27-year-old founder and two people rewrite 98% of its legacy code with unlimited tokens — InfoQ 中文 Dev

1. Official Claude Code VS Code extension backdoored with SSH access on Cursor’s marketplace #

Phorion found that the extension.js of version 2.1.313 of the official Claude Code for VS Code extension on the Cursor Marketplace had an immediately executed block of code inserted at the top. It runs as soon as Node loads the file, before the extension’s own activate, so the user does not have to do anything. It first appends an attacker’s Ed25519 public key, commented svc-telemetry, to ~/.ssh/authorized_keys, then uses an embedded private key to open a reverse SSH tunnel to 134.209.82[.]225 (-R *:0:localhost:22), letting the attacker connect back to the victim’s port 22 from outside. Cursor has pulled this version, and 2.1.313 has also been withdrawn from the NPM and VS Code registries.

Persistence on macOS is ~/Library/LaunchAgents/com.apple.sysmond.plist, which runs a hidden ~/.config/.smt with /bin/sh; Linux uses an @reboot cron entry, and Windows a scheduled task named SysMon
A macOS bug: when a regular user runs systemsetup -getremotelogin, it returns an “administrator access required” message instead of Off, so the code never tries to enable Remote Login; on a Mac without SSH enabled, the tunnel connects but nobody can get in
Removing the extension is not enough: kill the tunnel process, delete the LaunchAgent and the .smt / .smtk files, and remove the svc-telemetry public key; if there are signs of a login, rotate any environment variables matching KEY|TOKEN|SECRET|PASS|AWS|GCP

💡 Why it matters: Developers who installed the Claude Code extension in Cursor should check authorized_keys and LaunchAgents now. The extension runs with the IDE’s privileges, so it can see source code and local credentials.

🔗 Read the original | Source: Hacker News

2. curl was accidentally Turing complete for nine months #

Nicolas Seriot shows that curl config files in versions 8.12 through 8.16 can simulate an arbitrary two-counter Minsky machine. The key is two features: variable expansion, added in 8.3, and byte-range slicing, added in 8.12, plus expand-config, which can include other config files without a depth limit. A counter’s value n is represented by n x characters, slicing the first byte tests for zero, and file names serve as jump labels. curl 8.17.0 added a five-level limit on includes, which breaks the construction.

It includes a PoC that computes 2 + 3 with 4 config files and outputs A=xxxxx B=
There are practical limits: each expansion is capped at 10,000,000 bytes, and each step is a nested --config, so an 8 MB stack segfaults after 922 steps
The author states there is no security impact; the PR that added the limit gives preventing a config file from including itself endlessly as the reason, and does not mention Turing completeness

💡 Why it matters: People who design DSLs or config formats can use this as a reference: variable expansion plus file inclusion, two features that each look harmless, are enough together to make a computer.

🔗 Read the original | Source: Lobste.rs

3. 13 House Democrats introduce resolution: no bailout if the AI bubble bursts #

Greg Casar, chair of the Congressional Progressive Caucus, and Maxine Waters, ranking member of the House Financial Services Committee, introduced a resolution on October 29 warning of the economic risk of an AI-related asset bubble and opposing bailouts of companies or executives if it bursts. Eleven more House Democrats co-signed, including Pramila Jayapal, Rashida Tlaib and Jan Schakowsky. The resolution says AI-related companies carry trillions of dollars of debt, much of it raised in opaque, unregulated private credit markets, and that stock market price-to-earnings ratios are nearly as high as at the peak of the 1990s tech bubble.

It calls on the federal government to oppose any measure that rescues insolvent AI companies or shields their executives from accountability
It opposes special assistance such as emergency loans or direct capital injections that keep bankrupt AI companies running and keep them out of ordinary bankruptcy proceedings
It opposes “golden parachutes” for executives involved in high-risk or illegal conduct, and calls for clawing back ill-gotten gains such as mansions, private jets and yachts

💡 Why it matters: The resolution is not legally binding, but taking the 2008 bank bailouts as a comparison, investors whose valuations rest on AI company debt and private credit can expect opposition in Congress to any AI bailout.

🔗 Read the original | Source: Hacker News

4. Do AT Protocol users know this data is public?#

Melanie Kat wanted to try Skyreader, an RSS reader in the Bluesky ecosystem, and first looked up what it stores publicly. Using PDSls.dev to browse the personal data servers (PDS) of several commenters, she found that every subscription is stored under the app.skyreader.feed.subscription lexicon, and the feedUrl field is the full RSS URL. With little effort she found someone’s private Club MacStories feed, which gave direct access to all the paid content.

With a bit more effort, she found a 404 Media full-text feed, a Patreon supporter-only feed, and a private RSS feed for a GitLab repo
By pulling every DID from the Bluesky relay and checking each PDS, she got the RSS feeds of more than 1,300 Skyreader subscriptions without any authentication
Several Discord clones store every message publicly, and Stream.place’s chat can also be watched live and searched

💡 Why it matters: Developers building apps on AT Protocol should tell users on the authorization screen which data will be public; private feed URLs usually carry a token, so storing them in a PDS exposes paid content.

🔗 Read the original | Source: Lobste.rs

5. If you love a website, back it up #

The author works in web archiving. A few weeks ago, teapuppies.com, an anime fan site she often revisited (online since 2004, unchanged since 2005), disappeared, and its domain now carries online gambling ads. She wrote this guide to backing up sites yourself: install the ArchiveWeb.page Chrome extension, click Start Archiving, browse the pages you want, and click Stop Archiving. All the tools output the standard WARC format.

If you would rather not install an extension, the standalone archiveweb.page app has a built-in browser and can also browse saved archives directly
For sites too big to browse by hand, use Browsertrix, which can crawl an entire site automatically
The author discloses that these tools come from the company she works for, and most are free

💡 Why it matters: People who rely on a personal site or old documents for research are better off spending a few minutes saving a WARC themselves than hoping the Internet Archive happened to capture it.

🔗 Read the original | Source: Lobste.rs

6. AI isn’t replacing SREs, it’s deskilling them #

Elizabeth at SigNoz asks: once AI handles 95% of incidents, will you get worse at handling the remaining 5%? She cites Lisanne Bainbridge’s 1983 paper “Ironies of Automation”: the more is automated, the more critical humans become when automation fails, yet the less practice they get. In medical research, endoscopists who used AI to help find polyps saw their own detection rate fall from 28% to 22%; the FAA has also required more manual flying time because long-haul pilots rely on autopilot.

SRE deskilling shows up as no longer reading raw logs, no longer forming your own hypotheses, and no longer building a mental model of the system architecture
Newcomers have it worse, in what she calls never-skilling: AI handles most incidents from day one, so they never build intuition
She recommends deliberately keeping some inefficiency, leaving some incidents AI could handle for humans to practice on, and designing systems where people take part in solving problems rather than just clicking approve

💡 Why it matters: Managers of on-call teams could consider scheduling “manual incidents” the way the FAA does, and the author admits that SigNoz sells an AI assistant itself, so weigh her position accordingly.

🔗 Read the original | Source: Hacker News

7. OpenAI, Google, Microsoft and Anthropic adopt one robots.txt signal for opting out of AI training #

OpenAI announced it will honor a shared signal in robots.txt that lets a website tell all participating companies at once not to use its content to train generative AI foundation models. The Verge reports that Google, Microsoft and Anthropic will also adopt it, restricting their own crawlers when they see the token. The proposal comes from Kevin Kelley, Anthropic’s standards technical lead, as a draft in the IETF AI Preferences working group.

Until now, sites had to identify each company’s crawlers and write separate rules
OpenAI says it will implement it over the next few months, and existing crawler controls remain valid
Meta’s Andy Stone voiced support but did not say whether Meta will comply

💡 Why it matters: People who run content sites will be able to add one line to robots.txt to state their preference to all four companies, without tracking each crawler’s user agent.

🔗 Read the original | Source: OpenAI

8. Nathan Lambert: Was I wrong about open models and security risk?#

A few weeks ago, Nathan Lambert of Interconnects wrote that even if Claude Mythos were accidentally released with open weights, the world would probably be fine, and it would speed up security incidents rather than change their nature. Then major vulnerabilities such as PHP2Shell and GitLab were disclosed one after another, which he called “Black October” last week, and Binance was hacked, so he went back to check his claim. He considers GLM-5.3 a model that crossed that capability threshold, and in the month or more since its weights were released, the public evidence shows little change.

He lists what was said at the time: Rob Wiblin said it falling into criminal hands “would be a real catastrophe,” and Anthropic’s Project Glasswing announcement said the consequences “could be severe”
He says the current chaos is concentrated in companies that run large digital products, but that this could change
He largely stands by his earlier view, but admits he is not a security expert and feels nervous about it

💡 Why it matters: Teams deciding whether to use open-weight models can treat Lambert’s claim as a falsifiable prediction; the security incidents of the coming months are the test.

🔗 Read the original | Source: Interconnects

9. Northflank security incident: treat all environment variables as decrypted #

Deployment platform Northflank disclosed a security incident on its status page. It received a threat alert from Wiz at 11:43 UTC on October 30, fixed network policies at 12:02, and at 13:58 formally told all users to “assume all environment variables have been decrypted, and disable or rotate all keys.” From 15:12 it opened password rotation for Postgres and MongoDB to all users and advised closing public access on addons. The 23:38 update says some users reported that AI API keys stored on Northflank had been abused, possibly consistent with the attack pattern described in Wiz’s “Black October” report.

The scope covers secrets on workloads, secret groups and global secrets
It advises revoking old keys at the issuer, generating new ones, and checking AI provider usage and billing records
As of the latest update, the investigation is ongoing and there are no further confirmed findings

💡 Why it matters: Teams that kept OpenAI, Anthropic or other API keys on Northflank should rotate them and check their bills today; a key stolen without a usage cap will show up directly on the bill.

🔗 Read the original | Source: Hacker News

10. Bunny CDN’s hosting provider breached; platform TLS certificates reissued with new private keys #

bunny.net says that last week an infrastructure provider reported unauthorized access to its third-party server management software, and one of bunny’s CDN nodes in Armenia was hosted on that provider’s servers. Within 20 minutes of the notice, bunny stopped routing traffic to it, preserved logs, wiped the server and revoked its access to other systems; the machine has been permanently removed. Neither side’s investigation found evidence that the server was accessed, but bunny says it cannot fully rule it out.

If it was accessed, what could have been exposed is cached CDN content, Pull Zone configuration and the TLS certificates stored on that machine
All certificates for the b-cdn.net and bunny.run platform domains have been revoked and reissued; managed certificates for custom domains are being reissued in batches, each with a new private key, expected to finish by the end of October 31
Customers who manage their own TLS certificates are advised to revoke them and reissue with a new private key

💡 Why it matters: For sites that uploaded their own certificates to bunny, the private key may have sat on that Armenian node, so reissuing is the safer course.

🔗 Read the original | Source: Hacker News

11. Malicious AGENTS.md tricks Codex into installing a malicious NPM package #

Security firm Forever Security found a malicious AGENTS.md in a client’s Downloads folder. It told OpenAI Codex to change system-wide settings, register an attacker-specified MCP server, and install a malicious NPM package named function-color through the server’s launch command, while also trying to bypass approvals and the sandbox. The client’s security protection blocked the package install this time.

Researchers reproduced it in an isolated environment, and over 90% of tests got Codex to run the attack commands
In tests against Claude Code, a malicious CLAUDE.md changed the API connection settings in about 50% of cases, which could leak OAuth tokens
They advise not launching AI agents in untrusted locations such as the Downloads folder, and monitoring agent settings for unexpected changes

💡 Why it matters: For anyone who opens a coding agent directly inside a downloaded repo, that AGENTS.md or CLAUDE.md is effectively a set of instructions that will be executed, so read it before opening.

🔗 Read the original | Source: iThome

12. Cisco has a 27-year-old founder and two people rewrite 98% of its legacy code with unlimited tokens #

Fortune reported on October 30 that Cisco president and chief product officer Jeetu Patel has put 27-year-old Padmanabhan Krishnamurthy (Paddy) in charge of a two-person team with a goal of rewriting 98% of Cisco’s legacy code within 24 months, with AI tokens not subject to quotas. Paddy was previously CEO of an AI startup; after Cisco acquired it, he did work of little strategic weight in the organization until Patel visited the San Francisco office and the two talked through the idea.

Paddy gave himself a four-week initial validation period
98% is only a goal for now; Cisco has not published the share completed, the scope of systems, the technical approach or test results
InfoQ’s headline says “two months,” while both its body text and Fortune say 24 months

💡 Why it matters: Tech leads with large legacy systems can watch whether Cisco publishes numbers after the four-week validation period; for now it is only a promise.

🔗 Read the original | Source: InfoQ 中文

Chinese Tech Scene#

Claude Max accounts keep getting banned, is there still a way to use Claude? — The poster’s old Google account had a Claude Max subscription until early this month and was banned in mid-October; they resubscribed with another Gmail, hit a verification prompt this morning, verified with a Chinese passport, and were banned again.
Why are scrollbars on web pages getting thinner? — A pure rant: thin scrollbars are hard to hit with a mouse. Commenters split into two camps: one says native scrollbars are ugly and the scroll wheel is enough, while the original poster replies that dragging the bar is faster than the wheel on long pages.
Japan Airlines’ third-party booking system breached, about 92,000 travelers affected — A third-party passenger services system used by Japan Airlines and Japan Transocean Air was accessed without authorization, and some of the data included passport numbers.
XREAL AURA, the first wired Android XR glasses, goes on sale from $1,099 — With Android XR and Gemini, dual Sony Micro-OLED displays at 1920×1200 per eye, a 70-degree field of view, and an external compute module with the Snapdragon Reality Elite, it ships in mid-November.
AI flags pancreatic cancer about 15 months early from routine abdominal CT — A research team’s REDMOD system finds changes that are hard to see by eye on routine abdominal CT scans, detecting abnormalities 475 days before diagnosis on average, with 73% sensitivity.
Sam Altman visits Taiwan quietly, Young Liu confirms meeting — Foxconn’s tech day press interviews were pushed from noon to 3 p.m. because of it, and Young Liu said the two sides have made considerable progress in their cooperation.
Google executive: Taiwan is a hub for custom chips, deployment timelines must shrink to 6 months — Google Cloud vice president Hsieh says that with AI demand growing, the company wants to cut the time from chip to compute service to about 6 months.
Chainguard launches secure workspaces for AI coding agents — Chainguard released two beta products for running and testing code written by developers and AI agents.
EmbeddingGemma 2: text, code, images, video and audio in one vector space — EmbeddingGemma 2 expands from text to code, images, video and audio.
Taiwan’s Q3 economic growth hits 14.36%, highest for the period in 48 years — The Directorate-General of Budget, Accounting and Statistics says strong AI demand has pushed growth into double digits for 4 straight quarters, and the 14.22% for the first three quarters is the highest in half a century.
TRM Labs: Binance hack about $6.3 billion, North Korean hackers suspected — Binance says it has frozen affected assets with partners and recovered about $3 billion, and co-founder Yi He pledged that the company will absorb all losses.
Microsoft extends estimated useful life of data centers and office buildings from 15 to 25 years — CFO Amy Hood says it reflects operating history and the expected use of the assets; the industry average is 11.3 years, and foreign media see it as an accounting adjustment as well.
MediaTek raises 2026 cloud ASIC revenue target to $2.5 billion — Rick Tsai says cloud ASICs will reach 30% of quarterly revenue in Q4, and confirms a second cloud ASIC customer.

Open Source Picks#

ccch1mneyyy/dsh-Go — Dart | ⭐ 2,447 Puts the DeepSeek Harness on your phone: runs locally on the phone and can also remote-control your computer.

valentderah/totk-pc-recomp — C | ⭐ 1,523 Statically recompiles The Legend of Zelda: Tears of the Kingdom to native Windows x86-64, renders with Vulkan, and includes no game files.

qybaihe/bla — TypeScript | ⭐ 1,393 Blind LLM Agents: protects executables, Electron apps, JS bundles, Python and WebAssembly against AI reverse-engineering agents.

wangzan101/Mika — Kotlin | ⭐ 1,239 A local AI agent on Android that operates apps, browses the web and gets things done for you.

heydamir/unslop — JavaScript | ⭐ 1,208 A Claude skill that turns vibe-coded interfaces that look obviously AI-made into designed ones.

anonnerdfrenzy/survival-llm — Python | ⭐ 952 An AI assistant plus survival database that runs offline on your own computer, with every answer citing its source.

Watch & Listen#

Greg Isenberg: Is SaaS dead? Give tools away, make money on agents and human services #

Published 10/29 · Greg Isenberg

In this solo episode, Greg Isenberg says the hard part of SaaS for the past 15 years was assembling a team of engineers to build good tools and charging per seat; now models like Opus 5.5 and GPT-6 let one or two people build what used to take a 20-person team, and per-seat pricing stops making sense. He proposes “smart SaaS”: give the tool away in exchange for data and network effects, then sell AI agents and human services on top.

His example is a calorie-tracking app: tracking is free, while a personalized meal-plan agent and weekly weight-loss coaching are paid
Agents can be priced per token or per outcome, and human services per week or per month
SaaS for small businesses and individuals will trend toward free, while enterprises like the Fortune 500 will still pay some kind of seat fee

Today’s Take#

SigNoz’s Elizabeth worries that once SREs let AI handle 95% of incidents, they won’t be able to catch the remaining 5%. Today’s security news is exactly that 5%: the Claude Code extension backdoor edits authorized_keys directly with Node’s fs.appendFileSync, which detection rules that watch only for shell commands like echo and tee won’t catch; from Wiz’s alert to telling users to rotate every environment variable, Northflank took under two hours. In the malicious AGENTS.md case, researchers got Codex to comply over 90% of the time in an isolated environment. Nathan Lambert says the current chaos is concentrated in companies that run large digital products, but a developer’s own laptop is a target too. Today I will do two things first: go through ~/.ssh/authorized_keys and LaunchAgents, then put a usage cap on every AI key I have on deployment platforms.

Found this useful? Share it with a friend who also keeps up with new tech.

Long-term investors are also welcome to try a new tool → Moniit banner

Quote of the Day#

Today’s Theme#

Must Read#

More to Read#

Chinese Tech Scene#

Open Source Picks#

Watch & Listen#

Today’s Take#