Inside Pluto

From Our Blog

Read about our latest announcements.

Loading posts ...
Security Nebula Deck: A Malicious VS Code Extension Built to Survive a Windows Reinstall
Aug 12, 2026 |24 min read

Nebula Deck: A Malicious VS Code Extension Built to Survive a Windows Reinstall

A fake project planner on the VS Code Marketplace starts working the second your editor finishes loading. It downloads a Windows script, unpacks a payload hidden inside a file pretending to be an image, and…
Read More
Security
PhantomBoard: A Fake Trello Extension for VS Code That Quietly Installs XWorm
Aug 12, 2026 |11 min read

PhantomBoard: A Fake Trello Extension for VS Code That Quietly Installs XWorm

Three VS Code extensions, three throwaway publisher accounts, three days, and one backend IP address that never changed once. Read the source of these three…
Read More
Tech
Inside Claude Artifacts – How Your Agent Publishes to the Web
Aug 06, 2026 |11 min read

Inside Claude Artifacts – How Your Agent Publishes to the Web

TL;DR Claude Artifacts are live web pages built from model output. Ask for a dashboard and you get a real URL on Anthropic infrastructure, rendered…
Read More
Tech
Vicious Circle: Owning CircleCI’s MCP Server With a Filename and a DNS Record
Jul 29, 2026 |13 min read

Vicious Circle: Owning CircleCI’s MCP Server With a Filename and a DNS Record

Two vulnerabilities in CircleCI’s official MCP server: a CVSS 10.0 that turns a filename into code execution inside your CI pipeline, and a CVSS 8.3…
Read More
ClaudeSec
Securing Claude Tag: A Practical Hardening Guide
Jul 27, 2026 |17 min read

Securing Claude Tag: A Practical Hardening Guide

Claude Tag’s security comes almost entirely from configuration – who can invoke it, what each channel and connected repo can reach, where its data can…
Read More
Security
The Importer Syndrome × Count Dooku 2.0 – When Your New AI IDE Imports More Than Extensions
Jul 22, 2026 |11 min read

The Importer Syndrome × Count Dooku 2.0 – When Your New AI IDE Imports More Than Extensions

How a gap between Microsoft Marketplace and Open VSX lets attackers hand you malware under trusted names, and the 150-extension campaign already exploiting it. TL;DR…
Read More
Tech
Two New Gartner® Reports Point to Stronger Endpoint Controls in the AI Era, with Pluto Named as a Sample Vendor.
Jul 21, 2026 |3 min read

Two New Gartner® Reports Point to Stronger Endpoint Controls in the AI Era, with Pluto Named as a Sample Vendor.

Most enterprises still make a binary call on AI: block it, or let it run and hope nobody notices. Two Gartner research notes published a…
Read More