Pull to refresh
Logo
What Changed
Following Why Sign Up
Palo Alto Networks pushes security into AI coding agents with Cortex Cloud 2.3

Palo Alto Networks pushes security into AI coding agents with Cortex Cloud 2.3

New Capabilities

The update adds an eBPF sensor for Linux workloads, coverage for 100 SaaS apps and code scanning inside Claude Code and Cursor — days before a poisoned extension hit Cursor's marketplace

November 2nd, 2026: Cortex Cloud 2.3 ships

Overview

Updated Nov 2

Palo Alto Networks shipped Cortex Cloud 2.3 on November 2, 2026. The update adds a lightweight sensor for Linux cloud servers, protection for about 100 software-as-a-service apps, and code scanning inside two AI coding assistants, Claude Code and Cursor.

The risk arrived first. On October 29, attackers pushed tampered versions of a Claude Code extension into Cursor's extension marketplace, and as many as 5,000 developers downloaded them over roughly 11 hours. Palo Alto's analysis, published November 3, said the code tried to install a remote-access backdoor and send host details to attacker servers.

Why it matters

Security checks are moving into the AI tools that write code, which could shorten the 25-minute attack path Unit 42 simulated.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

100
SaaS applications covered
Cortex Cloud SaaS Security launches with posture, identity, data and AI protection across roughly 100 SaaS apps.
75%
Resource reduction for the new sensor
Palo Alto says the eBPF-based Cortex Cloud Sensor uses up to 75% fewer resources.
25 min
Simulated time to data exfiltration
Unit 42 modeled an AI-assisted attack reaching data exfiltration in 25 minutes.
5,000
Developers potentially exposed by the extension
Palo Alto says up to 5,000 Cursor users could have been exposed during the roughly 11 hours the compromised Claude Code extension versions were available.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

Sarit Tager
Sarit Tager
Co-author of the Cortex Cloud 2.3 announcement
Active at Palo Alto Networks
 Cameron Hyde
Cameron Hyde
Co-author of the Cortex Cloud 2.3 announcement
Active at Palo Alto Networks
YR
Yuval Ronen
Co-author of Palo Alto's analysis of the compromised Claude Code extension
Active at Palo Alto Networks
AQ
Anna Qi
Co-author of Palo Alto's analysis of the compromised Claude Code extension
Active at Palo Alto Networks

Organizations Involved

Palo Alto Networks
Palo Alto Networks
Cybersecurity vendor
Publisher of Cortex Cloud 2.3

Network and cloud security vendor that sells the Cortex Cloud platform.
UN
Unit 42
Threat research unit
Supplied the attack-timeline research cited in the release

Palo Alto Networks' threat intelligence and incident response group.
Anthropic
Anthropic
AI company
Integration partner for Claude Code

Maker of the Claude models and the Claude Code coding assistant.
Cursor
Cursor
AI developer
Integration partner for its code editor; its extension marketplace distributed compromised Claude Code extension versions on October 29, 2026

AI-first code editor built by Anysphere.

Timeline

2025 November 2026

3 events Latest: November 2nd, 2026 · 1 week ago

  1. Cortex Cloud 2.3 ships

    Latest Product launch

    Release adds Security Initiatives, SaaS security for about 100 apps, an eBPF sensor, MCP integrations and artifact attestation.

  2. Poisoned Claude Code extension spreads through Cursor marketplace

    Security incident

    Modified versions 2.1.312 and 2.1.313 of the Claude Code extension were distributed through Cursor's marketplace to macOS and Windows users. Palo Alto said the code tried to collect host details, add an SSH key and establish persistence; Cursor reported the payload largely failed. The versions were later removed.

  3. Cortex Cloud 2.0 goes generally available

    Product launch

    Palo Alto Networks launches Cortex Cloud 2.0 and says customers will receive automated upgrades in the first half of 2026.

Scenarios

1

Fix-oriented vulnerability policies reach general availability

Likely Resolves by Q1 2027

Discussed by: Cortex Cloud release notes, which label the feature limited GA

The release groups CVEs that share a single fix into one issue to cut ticket volume. Palo Alto lists it as limited GA, meaning availability is restricted. If it reaches full general availability, the grouping feature becomes usable across the customer base rather than a subset.

2

Cortex Cloud SaaS Security passes 100 applications

Possible Resolves by Q2 2027

Discussed by: Palo Alto Networks release notes and blog, which state coverage of about 100 SaaS applications

The SaaS security module launches with posture, identity, data and AI coverage across roughly 100 applications. Expansion would show whether the module is a durable product line or a launch-day count. The release notes describe the figure as approximate.

3

A rival ships native scanning inside Claude Code or Cursor

Possible Resolves by Q2 2027

Discussed by: No vendor has announced this; the scenario tracks how quickly the MCP integration is copied

Palo Alto is first to announce native MCP integrations with both coding assistants. Cloud security rivals have matched earlier Cortex features within release cycles. A competing announcement would turn the integration from a differentiator into a baseline requirement.

4

Cursor tightens extension marketplace review

Possible Resolves by Feb 28, 2027

Discussed by: No vendor commitment announced; this tracks how Cursor responds to the October 29 extension incident

Attackers used Cursor's extension marketplace to distribute modified Claude Code packages for roughly 11 hours. Mandatory publisher signing, automated scanning of extension updates or manual review would show the marketplace changed its process. No such change has been announced.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

December 2020

SolarWinds supply chain attack (2020)

Attackers linked to Russia's SVR compromised updates to SolarWinds Orion software, distributing malicious code to roughly 18,000 customers, including U.S. government agencies. Investigators traced the intrusion through multiple federal networks.

Then

The Cybersecurity and Infrastructure Security Agency issued an emergency directive, and agencies scrambled to disconnect Orion servers.

Now

Executive Order 14028 pushed software bills of materials and attestation requirements into federal procurement.

Why this matters now

Cortex Cloud 2.3's artifact attestation and supply chain dashboard are built on the idea that buyers should verify what went into software before it reaches production.

December 2021

Log4Shell vulnerability (2021)

A flaw in the Apache Log4j logging library allowed remote code execution on millions of servers. Security teams spent weeks locating affected systems and patching them.

Then

CISA set a short patch deadline for federal agencies, and scanners lit up with Log4j findings across industries.

Now

Reachability analysis became a selling point for application security vendors trying to separate exploitable flaws from noise.

Why this matters now

The 2.3 release adds open-source reachability analysis, which identifies vulnerable packages and functions that are actually called.

September 2019

GitHub acquires Semmle (2019)

GitHub bought code analysis company Semmle and later built its code scanning product into the pull request workflow, putting security findings where developers already worked.

Then

Code scanning became available to GitHub users, and competitors added similar integrations.

Now

Security checks moved from separate audit tools into the development pipeline.

Why this matters now

The MCP integration moves the same check one step earlier, into the AI assistant that writes the code rather than the review that follows it.

Sources

(8)
+4
Palo Alto Networks Blog Cortex Documentation Portal Fiscal.ai TechWatch Cortex Documentation Portal Palo Alto Networks Palo Alto Networks Blog Palo Alto Networks Blog