1Password Developers

Official updates for developers building with @1Password.

Securely manage API keys, credentials, and agent access without exposing your secrets.

[1Password Developers @1PasswordDev]

The internet has a second audience: AI agents. 🤖

@Cloudflare just shared some fascinating data about how the web is changing.

Here are 3 things that caught our attention 🧵👇

[1Password Developers @1PasswordDev]

@davzer_ @dd_pwnd We explained in details what happened here: https://t.co/via3M6fnSW

[1Password Developers @1PasswordDev]

Attackers distributed a malicious Claude Code extension through Cursor’s marketplace.

Up to 5,000 users may have received it.

But the attack didn’t start with the extension.

It started with an exposed vendor key and credentials buried in old AI coding-agent traces.

Here’s the attack chain. 🧵

[1Password Developers @1PasswordDev]

@karan_luthra_ai We explained in details what happened here: https://t.co/via3M6fnSW

[1Password Developers @1PasswordDev]

Attackers distributed a malicious Claude Code extension through Cursor’s marketplace.

Up to 5,000 users may have received it.

But the attack didn’t start with the extension.

It started with an exposed vendor key and credentials buried in old AI coding-agent traces.

Here’s the attack chain. 🧵

[1Password Developers @1PasswordDev]

@Han7162164272 We explained in details what happened here: https://t.co/via3M6fnSW

[1Password Developers @1PasswordDev]

Attackers distributed a malicious Claude Code extension through Cursor’s marketplace.

Up to 5,000 users may have received it.

But the attack didn’t start with the extension.

It started with an exposed vendor key and credentials buried in old AI coding-agent traces.

Here’s the attack chain. 🧵

[1Password Developers @1PasswordDev]

@harisn We explained in details what happened here: https://t.co/via3M6fVIu

[1Password Developers @1PasswordDev]

Attackers distributed a malicious Claude Code extension through Cursor’s marketplace.

Up to 5,000 users may have received it.

But the attack didn’t start with the extension.

It started with an exposed vendor key and credentials buried in old AI coding-agent traces.

Here’s the attack chain. 🧵

[1Password Developers @1PasswordDev]

@inferencepoint We explained in details what happened here: https://t.co/via3M6fnSW

[1Password Developers @1PasswordDev]

Attackers distributed a malicious Claude Code extension through Cursor’s marketplace.

Up to 5,000 users may have received it.

But the attack didn’t start with the extension.

It started with an exposed vendor key and credentials buried in old AI coding-agent traces.

Here’s the attack chain. 🧵

[1Password Developers @1PasswordDev]

@prasad_pilla We explained in details what happened here: https://t.co/via3M6fnSW

[1Password Developers @1PasswordDev]

Attackers distributed a malicious Claude Code extension through Cursor’s marketplace.

Up to 5,000 users may have received it.

But the attack didn’t start with the extension.

It started with an exposed vendor key and credentials buried in old AI coding-agent traces.

Here’s the attack chain. 🧵

[1Password Developers @1PasswordDev]

@XavierRiveraX We explained in details what happened here: https://t.co/via3M6fVIu

[1Password Developers @1PasswordDev]

Attackers distributed a malicious Claude Code extension through Cursor’s marketplace.

Up to 5,000 users may have received it.

But the attack didn’t start with the extension.

It started with an exposed vendor key and credentials buried in old AI coding-agent traces.

Here’s the attack chain. 🧵

[1Password Developers @1PasswordDev]

@jayzhoupro We explained in details what happened here: https://t.co/via3M6fnSW

[1Password Developers @1PasswordDev]

Attackers distributed a malicious Claude Code extension through Cursor’s marketplace.

Up to 5,000 users may have received it.

But the attack didn’t start with the extension.

It started with an exposed vendor key and credentials buried in old AI coding-agent traces.

Here’s the attack chain. 🧵

[1Password Developers @1PasswordDev]

@thedealdirector We explained in details what happened here: https://t.co/via3M6fVIu

[1Password Developers @1PasswordDev]

Attackers distributed a malicious Claude Code extension through Cursor’s marketplace.

Up to 5,000 users may have received it.

But the attack didn’t start with the extension.

It started with an exposed vendor key and credentials buried in old AI coding-agent traces.

Here’s the attack chain. 🧵

[1Password Developers @1PasswordDev]

The lesson goes beyond Cursor.

AI coding-agent traces, logs, and support tickets can all become unexpected places where credentials are exposed.

We scan code for secrets.

But are we scanning what our AI agents leave behind?

Full disclosure:
https://t.co/gzdP2MkTX5

[1Password Developers @1PasswordDev]

Attackers distributed a malicious Claude Code extension through Cursor’s marketplace.

Up to 5,000 users may have received it.

But the attack didn’t start with the extension.

It started with an exposed vendor key and credentials buried in old AI coding-agent traces.

Here’s the attack chain. 🧵

[1Password Developers @1PasswordDev]

The malicious extension attempted to install a persistent SSH backdoor.

It added an attacker-controlled SSH key, collected host information, and installed persistence mechanisms.

The reverse tunnel generally failed without admin privileges.

But uninstalling alone may not remove the malware.

[Browser Use @browser_use]

Introducing: @browser_use x @1Password

Your agent can log in anywhere without ever seeing your password.

> connect 1Password once
> agent hits a login page
> you approve it in 1Password
> 1Password fills it in, agent keeps going

Try it 🔗⬇️

[David Faugno @1PasswordCEO]

Allie and KC with some great stuff here

[1Password Developers @1PasswordDev]

@birmeya Great list. One layer to add before "ship": secrets.

Every agent in this stack holds tokens, and this week showed what stolen GitHub tokens with write access can do.
https://t.co/SGI9dhP0mL

[1Password Developers @1PasswordDev]

61,000+ GitHub repos received a PR titled `docs: dependency audit notes` this week.

It looked boring. That was the point.

The PR wasn't the malware. It was a test to see which stolen GitHub tokens still worked.

Then the real attack began. 🧵

[1Password Developers @1PasswordDev]

@vercel_dev Nice value for teams experimenting across models.

Wherever those calls run from, keep API keys out of plaintext .env files. Secret references (op://) make that easy:
https://t.co/gmjTQFZqs6