VSO · · SOURCE REVIEW
Cursor follow-up, Apify and Epoch AI: secrets, permissions and evaluation boundaries
A VSO review of public sources available on 14 November, not a count of three newly occurring incidents. Event dates, source dates and this publication date are distinct. Cursor is a follow-up to an already reported incident.
1. Cursor — follow-up to a previously reported incident
Official report
Cursor’s 13 November account connects a key exposed by Fireworks to historical agent traces and unredacted credentials. The traces were mainly from 2025 sessions outside Privacy Mode. Cursor reports trace exposure affecting under 0.05% of users and API-credential exposure affecting under 0.01% of customers.
Up to 5,000 users potentially received a malicious Claude Code extension from Cursor’s cache on 29 October; this is not an infection count. Cursor says Anthropic did not publish it, its product was not vulnerable in this incident, and Open VSX never hosted the malware. Cursor · 2026-11-13
2. Apify
Official report
Apify first reported the incident on 11 November, confirmed customer-data access on 12 November, and updated remediation on 13 November. Its account describes compromised credentials enabling further account access, followed by hashed token storage and internal network restrictions. AI-agent execution of the attack is not established. Apify · 2026-11-11–13
3. Epoch AI / Trajectory Labs
Official report
Epoch AI’s 13 November report describes unauthorized activity on 20 and 23 October. The 36,411 calls on 20 October targeted a planted monitoring API with no connection to private data; 487 messages are a separate count. Exploit attempts were reported, without successful access to confidential information.
The report also describes a third experiment on 26 October with Epoch’s consent. It must be distinguished from the unauthorized events. Epoch’s minimum recommendations are informed consent, monitoring and reporting. Epoch AI · 2026-11-13
VSO analysis — not adoption or demonstrated results
Design evidence preservation and confidentiality separately. Prefer excluding raw secrets at collection. Keep existing signed originals under restricted access; identify redacted sharing copies separately and record their relationship and transformations.
A valid signature does not establish proper authorization or execution within an agreed scope. Compare delegation, revocation, target and expiry with actual operations and separately observed records.
Checking network boundaries and stop procedures is VSO’s analysis. Avoid conflating controls that limit execution with retrospective evidence verification. These incidents do not demonstrate that VAP/VCP would have prevented them.
Review scope and historical records
VSO did not validate affected environments or reproduce attacks. Prior-notification status and independent confirmation of total impact are outside this review. Dates follow the sources; Apify’s 13 November 17:36 CET update was 14 November 01:36 JST.
Historical notices and test records retain their revisions and conditions. Current requirements, existing implementations, signed data, fixed distributions and K3 are unchanged.