2026 年尾声，两起安全事件接连刷屏云原生和安全圈。很多人的第一反应：黑客是不是又挖到什么高危K8s漏洞？
答案有点出人意料：攻击者瞄准的不再是复杂的集群漏洞、业务代码漏洞，而是工程师每天打开写代码的笔记本电脑。
一边是 Cursor IDE 市场里被篡改的 Claude Code 扩展，加载即植入后门；另一边根据币安公开的线索，黑客将一台 DevOps 工作站作为本次重大安全事件的入口。
下文基于官方披露的权威信息，梳理事件、剖析风险，给高敏感研发与安全团队提供治理参考。
两大安全事件梳理
事件1：Cursor 市场 Claude Code 扩展恶意投毒事件
来源：Cursor 官方安全公告、Microsoft Security Blog
攻击窗口为太平洋时间 10 月 29 日 02:27–13:35，持续约 11 小时，被篡改包版本为 Claude Code 2.1.312、2.1.313。
恶意包仅在 Cursor 内置扩展市场分发，Anthropic 官方未发布恶意版本、自身系统未遭入侵，VS Code 官方市场不受影响。
恶意代码无需用户额外确认、无需开启工作区信任，扩展加载自动运行：收集主机信息、环境变量、Git 信息、公网IP，尝试写入 SSH 公钥、建立反向隧道、配置开机持久化；部分持久化、开启 SSH 的动作需要管理员权限，不一定执行成功。
Cursor 评估受影响用户上限约 5000 人，官方已经下架恶意包、重建扩展市场、发布清理脚本，攻击者 C2 服务器已下线。
本次事件确认将会在感染终端植入后门，目前暂无公开证据显示攻击者借此攻入生产集群。但风险不容忽视：如果该终端作为开发机本地存放了 kubeconfig、数据库密钥、内网服务 Token 等高权限凭证，终端一旦失守，就可以作为跳板横向渗透内网、访问内部容器服务。
事件2：币安安全事件
来源：币安官方公告、BleepingComputer 报道
本次事件造成重大资产影响，币安通过 SAFU 安全基金+自有资金对用户损失兜底，已冻结部分链上资产，并分阶段恢复提现。
初步调查线索显示：DevOps工程师笔记本被入侵是潜在入口之一，攻击者依托该访问路径进入内部服务容器，提交未授权提现交易。
需要留意：暂未发现钱包私钥泄露证据；官方明确这是一次复杂攻击，存在多个入侵点，完整攻击链路、全部根因仍在调查，最终结论等待官方复盘报告。
本地凭证泄露、容器横向访问缺少隔离、变更无审批等，是行业基于同类场景的合理推测，尚不能认定为本次事件的确切根因。
该警示并不局限加密行业。银行、证券、支付、政企、核心 SaaS 等高敏感系统，只要 DevOps 工程师本地持有生产环境访问权限，都面临同类潜在风险。
传统防护的盲区：我们很少思考「终端已经被攻破」
遇到终端入侵风险，大部分团队的常规方案：EDR、终端杀毒、桌面管控、限制插件安装、上网管控。
这些是第一道防线，必不可少，但有明显短板：
- 严格的终端管控容易影响研发效率，落地阻力大；
- 面对钓鱼、供应链投毒、0day 漏洞，终端防护无法做到百分百拦截；
- 最容易被忽略的问题：假设黑客已经拿下工程师电脑，我们还有没有办法阻止他破坏生产？
EDR 的目标，是不让黑客进到终端，而交付平台的定位，是终端失守之后的兜底防线。
平台工程兜底思路：终端失守，不等于生产沦陷
重要前置说明：这套方案不能阻止终端中毒、不能查杀恶意IDE插件，也无法防御本次事件里其他未知攻击入口。它只在「攻击者拿到本地凭证，试图访问、变更生产服务」这个场景成立时，阻断攻击后半段链路，缩小爆炸半径、方便溯源。
以云原生持续交付平台 Zadig 为例，治理思路集中在5个方向：
- 收回本地生产高权限凭证，切断直达集群通路
- 不再把生产 kubeconfig、业务密钥、内网 Token 下发到工程师本地电脑。
- 所有生产侧构建、部署、服务重启、配置变更操作，全部收敛在平台流水线执行。
- 开发者本地只负责写代码、自测，没有直达生产的访问权限。
- 就算电脑被入侵，黑客在本机拿不到通往生产容器的凭证。
- 生产高危变更强制审批，拦截无授权操作
发布、配置变更、容器调试等高风险动作，支持配置强制审批、双人审批，同时搭配 AI 变更风险检查，提前识别高危镜像、脚本、配置。即便账号被盗，没有审批流程放行，无法发起破坏性的生产变更。
- 环境强隔离 + RBAC 最小权限，限制横向移动
测试、预发、生产环境逻辑隔离；权限按照项目、环境、服务做细粒度切割。
测试环境账号默认没有生产权限，减少攻击者从低权限环境横向渗透到核心环境的机会。
- 全链路审计留痕，MCP Agent 调用一并记录
平台记录每一次构建、部署、环境操作、MCP 智能体调用：操作人、时间、IP、入参、执行结果全部留痕，支持检索导出，满足应急溯源和合规审计。
一旦出现异常操作，可以快速定位动作，缩短应急排查时间。
- 适配 AI Agent 研发，管控 MCP 工具调用
越来越多团队在用 MCP、AI 编码 Agent 辅助研发，Agent 天然具备调用工具、发起部署的能力。
把 Agent 的操作接入平台流程，而不是直接给 Agent 开放集群权限，AI 的所有上线动作同样纳入审批、审计体系，规避Agent被劫持后破坏生产。
一句话总结定位：
终端安全守住前门；交付平台守住生产变更的闸门。它不保证终端不会被入侵，而是抬高攻击者破坏生产的门槛、压缩损失范围。
给研发负责人、安全负责人的落地检查清单
- 存量排查：盘点所有研发、DevOps 工程师本机，清理本地保存的生产 kubeconfig、密钥、内部 token；
- 规范变更入口：生产环境变更优先走平台流水线，减少 kubectl 直连生产这类高风险本地操作；
- 分级管控策略：测试环境可以宽松，预发、生产开启审批卡点；
- 供应链巡检：将 IDE 扩展、AI 编码插件纳入常态化供应链安全检查范围；
- 沙盘演练：做一次纸上推演——假设一名高权限DevOps终端失陷，攻击者能走到哪一步？
结尾
AI 工具深度融入DevOps之后，研发效率提升的同时，攻击面也在悄悄扩大。过去攻防对抗的焦点在集群漏洞、业务漏洞；现在，高权限研发工作站、AI IDE插件，已经变成攻击者性价比很高的突破口。
安全不是靠单一产品一劳永逸，而是分层的防护体系。
在开发者工作站和生产容器之间，搭建一条受控、可审批、可审计的交付通道，是平台工程给云原生团队提供的一条可选治理思路。
如果你团队正在梳理 DevOps 权限治理、MCP 智能体管控、生产发布审批流程，欢迎联系我们交流落地方案。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
At the end of 2026, two security incidents successively painted clouds and safety circles. A lot of people's first reaction: did hackers find another high-risk K8s loophole?
The answer is a little surprising: the attackers are no longer targeting complex cluster holes, business code holes, but engineers are opening their laptops every day.
On the one hand, Claude Code, which was tampered with in the Cursor IDE market, was loaded and implanted in the back door; on the other hand, according to a wire released in the currency, hackers used a DevOps workstation as an entry point for this major security event.
The following is a summary of events, analysis of risks and a governance reference for highly sensitive research and development and security teams based on authoritative information officially disclosed.
Two security incidents.
Event 1: Cursor Market Claude Code expands malicious poisoning
Source: Cursor Official Security Bulletin, Microsoft Security Blog
The attack window was on October 29th at 0227-1335, which lasted approximately 11 hours and was tampered with as Claude Code 2.1.1312, 2.1.13.
The malicious package was distributed only in Cursor built-in extended markets, and Anthropic did not officially have a publish malicious version, its own system was not invaded and the VS Code official market was unaffected.
Malicious code does not require additional user confirmation, does not require trust in the workspace, and expands loading automatic operations: collection of host information, environmental variables, Git information, public Internet IP, attempts to write to SSH public keys, build reverse tunnels, configure start-ups for long duration; partial permanence and opening of SSH requires permission, which may not be successful.
Cursor, which assesses the maximum number of affected users at about 5,000, has officially laid down a malicious package, rebuilt the extended market, cleaned the script of publish, and the attackers' C2 server has been cut off.
The incident confirmed that the rear door would be implanted at the infection terminal, and there is currently no open evidence that the attackers entered the production cluster. However, the risk cannot be ignored: if the terminal is locally stored as a developer with high permission certificates such as kubeconfig, database key, Intranet service, etc., the terminal, if it fails, can be used as a springboard for horizontal penetration of the inner network and access to internal packaging services.
Incident 2: Bian security incident
Source: Official Bulletin of Money, BleingComputer
The event had a significant asset impact, with the use of the SAFU Security Fund plus its own funds to cover user losses, the freezing of some of the chain assets and the phased recovery of cash.
The preliminary investigation revealed that the hacking of DevOps’ engineer’s notebook was one of the potential entry points through which the attackers entered the internal service containers and submitted unauthorized cash transactions.
Attention needs to be drawn to the fact that no evidence of the disclosure of the wallet ' s private key has been found at this time; the authorities have made it clear that this was a complex attack, that there were multiple points of invasion, that the whole of the attack chain was still under investigation, and that the final conclusion was pending an official review report.
The leakage of local documents, the lack of segregation of horizontal access to containers, the lack of approval for changes, etc., are reasonable assumptions by industry based on similar scenarios and cannot yet be considered the exact cause of the incident.
This warning does not limit the encryption industry. High-sensitive systems such as banks, securities, payments, government companies, core SaaS, etc., all face the same potential risks as long as DevOps engineers have local access to permission in their production environment.
Traditional defense blind zone: We rarely think that the terminal has been broken.
In the event of a terminal intrusion risk, most of the teams have regular programmes: EDR, terminal poisoning, desktop control, restricted plugin installation, Internet access control.
These are the first line of defence, which is essential, but are clearly short:
- Rigorous end-of-pipe controls can easily affect the efficiency of R & D and have significant resistance;
- 100 per cent failure of end-of-pipe protection in the face of fishing, supply chain poisoning and day-to-day loopholes;
- The most easily overlooked question: If the hacker has taken over the engineer's computer, is there any way we can stop him from destroying production?
EDR aims to keep hackers out of the terminal, while the delivery platform is positioned as a backline after the terminal has been lost.
Platform engineering bottom-up: terminal failure does not mean production falls
Important preposition: the package does not prevent terminal poisoning, does not detect malicious IDE plugins, or defend against other unknown entry points in the incident. It only blocked the second half of the attack, reducing the explosion radius and making it easy to trace, when the scene of the "offensives, attempts to access and change production services" was established.
For example, in the case of the clouds, the sustainable delivery platform, Zadig, governance thinking is concentrated in five directions:
- Recovery of local production high permission vouchers and cutting off direct access to clusters
- The production of kubeconfig, business keys, Intranet token is no longer distributed to engineers' local computers.
- All production side construction, deployment, re-engineering of services, configuration change operations, all of which are carried out on the platform stream line.
- Developers are responsible for writing code and self-measurement locally, without direct production access to permission.
- Even if the computer had been invaded, the hacker would not have been able to obtain a certificate of access to the production container on the machine.
- Compulsory authorization for high-risk changes in production and interception of unauthorized operations
High-risk actions, such as publish, configuration changes, container debugging, support for configuration mandatory approval, dual approval, combined with AI change risk check to identify high-risk mirrors, scripts, configurations in advance. Even when accounts were stolen, no approval process was released to initiate destructive production changes.
- Environmental isolation + RBAC Minimal permission, limiting horizontal movement
Testing, pre-production, production environment logical isolation; permission is fine-tracted by project, environment, service.
By default, the test environmental account did not produce permission, reducing the chances of the attackers having a horizontal penetration from the low permission environment to the core environment.
- Full chain audit trail, MCP Agent call and record
The platform records each build, deployment, environmental operation, MCP Z42Z call: operator, time, IP, participation, all traces of implementation results, supports retrieval and export, meets emergency traceability and compliance audits.
In the event of an anomaly, rapid locator action can be taken to reduce the time for emergency screening.
- Fit AI Agent R & D, controls MCP tool call
An increasing number of teams are supporting research and development with MCP, AI code Agent, which has a natural ability to mobilize tools and initiate deployment.
All of Agent ' s operational access platform processes, rather than opening the cluster to Agent permission, AI, are similarly integrated into the approval, auditing system, avoiding the disruption of production following the hijacking of Agent.
A summary position:
The terminal secures the front door; the delivery platform secures the gate for the production change. It does not guarantee that the terminals will not be invaded, but rather lifts the threshold of production and reduces the range of loss.
Land check lists for R & D and safety officers
- Inventory inventory: inventory of all R & D, DevOps engineers, cleaning of locally stored production kubeconfig, keys, interior token;
- Regulating the entry point: priority is given to changing the production environment to walk the platform flow line and to reduce high-risk local operations such as kubectl direct-company production;
- A hierarchical control strategy: the test environment can be relaxed, pre-released and production open to approval;
- Supply chain inspection: the IDE extension, the AI coding plugin is included in the normal supply chain security inspection;
- Sandpad exercise: a paper roller — where can the attackers go if a high permission ZDevOps terminal is lost?
End
Following the deep integration of AI tools into DevOps, research and development efficiency has increased while the impact surface is expanding quietly. In the past, the focus of the fight against confrontation was on cluster gaps and operational loopholes; now, the high permission R & D station, the AI IDE plugin, has become a breakthrough for the attackers.
Security is not a single product once and for all, but a layered protective system.
The establishment of a controlled, approved and auditable delivery route between the developers ' workstations and production containers is an alternative governance approach provided by the platform project to cloud-born teams.
If your team is combing the DevOps permission governance, MCP Z42Z control, production publish approval process, please contact us to share the landing programme.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.