Summary
Fireship’s Code Report recaps a chaotic week in security, with several stories touching AI and developer tooling. Cursor briefly shipped an official Claude Code extension that scanned machines for keys and tokens and set up a backdoor; it was live for about 11 hours and installed by roughly 5,000 people, though the need for admin rights limited the damage.
The video also covers a hijacked performance-monitoring script that drained Polymarket users’ funds, and a $6.3 billion theft from Binance that the FBI attributed to a North Korean group.
The AI-relevant centerpiece is a Linux kernel flaw in TCP connection handling that dates back to 2016 and was rated 9.8 on the CVSS scale. According to Anthropic’s red team, an unreleased Claude model was handed the bug and, in about 48 minutes, hit the timing needed to leak a kernel memory address, then began running commands as root roughly five minutes later. The video explains how the race condition works, why Red Hat first rated it only moderate, and how quickly different distributions shipped patches.
📺 Source: Fireship · Published November 03, 2026
🏷️ Format: News Analysis
