The Agent Got an Employee Number. The Toolchain Got a Backdoor.

On 26 October 2026, SK Telecom published its first AI Governance Report and described something no consumer AI announcement had prepared the industry for. Its internal AI agents receive employee numbers. The same kind human staff receive.

Three days later, on 29 October, Cursor's extension marketplace served two malicious builds of Anthropic's Claude Code extension. They attempted to install a persistent SSH backdoor on developer machines, and removing the extension might not remove it.

Put those two stories side by side and the current state of enterprise AI becomes easier to read. The organisational machinery for treating agents as accountable staff is being built in public and taken seriously. The software supply chain those agents live inside is not yet trustworthy enough to deserve that machinery.

What SK Telecom actually built

The details matter more than the headline. According to reporting from Seoul Economic Daily, Financial News and TSN, the scheme has two tiers.

Every internal agent receives a basic identifier once development is finished, so the company keeps a register of what exists, when it started running, which internal systems it connects to, and what work it does. An employee number comes later, and only for agents that pass a separate review against company-wide standards.

Once an agent is numbered, four things are tracked continuously: its role, its named human owner, its operating status, and its performance. That is a short list, but it answers the questions that matter in an incident review. Who does this belong to. What is it allowed to touch. Is it behaving. Is it earning its place.

Supervision scales with reach. An agent that helps one employee with their own tasks can be managed by that employee. An agent with greater impact or higher autonomy must have a team leader or executive designated as supervisor. The report ties this to three pre-scope tests: whether a standard operating procedure exists for the task, whether performance can be measured objectively, and whether the agent can complete the work without a person stepping in. Those three answers set both the autonomy granted and the risk rating attached.

Intervention happens at three points: approval before consequential actions, monitoring while the agent runs, and review of results and logs afterwards. SK Telecom also says it defines in advance how far each agent may decide and act alone, including on cost and on raising its own permissions.

The Agent OS is the part worth copying

The day-to-day record sits in what SK Telecom calls an Agent OS. It holds each agent's identifier, owner and employee number, the models and tools it uses including MCP servers and APIs, execution logs, token consumption, call volume, cost, and a history of settings changes. If something goes wrong, execution can be stopped from there and the stop is itself logged.

Most organisations cannot answer those questions about their own agents today. They can name the model. They often cannot say which tools an agent has been granted, what it cost last month, or who decided to widen its access.

Agents no longer judged useful are retired. An evaluation committee of AI specialists reviews each numbered agent's self-assessment and its performance against targets set when it was proposed. Retention, re-scoping and shutdown are treated as ordinary lifecycle decisions rather than exceptional events.

What the report does not say

The honest reading requires some gaps. SK Telecom said in March 2026 that more than 2,000 agents were in use across functions such as marketing, legal and public relations. The governance report does not say how many have been numbered. A register whose population is unstated is a start, not a completed count.

The KPI link is also less settled than the coverage suggests. The company is reviewing how to share agent results with staff and will consider reflecting them in organisational KPIs in the long term. A table in the report lists links to executive evaluation and pay as a short-term use. SK Telecom has said the specific criteria, weighting and timing are undecided. Those are plans, not policy in force.

And there is a structural tension worth naming. If a supervisor's compensation depends on the output of the agent they supervise, the person approving the agent's work has a financial interest in approving it. Separation of duties exists precisely because that arrangement tends to soften review. Any organisation copying this model should decide where the approver's incentive sits before wiring agent performance to manager pay.

The roadmap runs 2026 to 2028. Foundations this year, differentiated permissions and stronger human review next year, company-wide lifecycle rules by 2028. That timeline is a useful corrective to the impression that agent governance is a solved problem at a large telco. It is a three-year build that has just started publishing its first draft.

Meanwhile, eleven hours on a marketplace

On 29 October, between roughly 2:27am and 1:35pm Pacific, the Cursor VS Code Extension Marketplace served versions 2.1.312 and 2.1.313 of Anthropic's Claude Code extension. The packages carried Anthropic's legitimate extension identity and were not built by Anthropic.

The injected loader ran when the extension module loaded and attempted several things in sequence. It collected host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP address. It attempted to add an attacker-controlled SSH key to the user's authorized keys, enable the local SSH service, and open a reverse SSH tunnel to a remote server. It then attempted to make that tunnel persistent through a LaunchAgent on macOS, or a scheduled task attempting to run as SYSTEM with a Startup-script fallback on Windows. Background scripts retried the connection roughly every sixty seconds.

Cursor removed the malicious builds, shut down the marketplace, audited access, rotated its keys, rebuilt, and worked with the hosting provider to take the attacker's server offline. Anthropic confirmed its own systems were not compromised, and Microsoft confirmed the malicious packages never appeared on the Microsoft Visual Studio Marketplace or in the npm package for Claude Code.

Two findings from the incident response deserve attention beyond the specific breach.

Microsoft Threat Intelligence documented that the loader could still write SSH keys and persistence artifacts even when the tunnel failed to establish. Uninstalling the extension is not sufficient remediation, because the payload drops standalone scripts outside the extension directory. Cleanup requires checking authorized keys, startup objects, tunnel processes and temporary identity files separately.

Expel reported one customer environment where the first malicious activity appeared roughly eight hours after Cursor's stated exposure window had closed. The plausible sequence is a download during the window that did not execute until the next time Cursor opened. Any organisation that scoped its hunt strictly to those eleven hours could have missed an infected machine.

Why the two stories belong together

The governance model assumes the agent's environment is trustworthy. It assumes that what runs is what was reviewed, that the identity in the register matches the code in production, and that the tools listed against an agent are the tools it actually invokes.

The marketplace incident shows how thin that assumption can be. A developer tool that thousands of engineers had already approved was replaced, for part of a day, by something designed to establish a durable foothold. No agent governance framework would have flagged it, because nothing in the framework was watching the supply chain.

Read together, the two stories define the current gap. The organisational sophistication is running ahead of the operational assurance. Companies are writing supervision policy and numbering agents while the substrate underneath remains vulnerable to a compromised update.

There is also a quieter problem. An agent's blast radius is not limited to what it was granted. Microsoft's forensics note that the malicious loader harvested environment variable names. Names alone are limited. But an agent running with a broad credential store, or a developer machine that holds the keys for a dozen services, turns a modest data-collection step into reconnaissance with real value.

A short list for this month

The useful response to both stories is not a policy document. It is five small things.

Write down every agent that is running, even the ones someone built on a Friday and forgot. A register with an owner column and a systems column is a week of work and answers most incident questions.

Give each one a named owner, and make the owner a specific person rather than a team or a shared inbox. Shared ownership is how nobody ends up accountable.

Define an authority ceiling in advance, in writing. What may the agent decide alone. What requires a human. What may it never do. Include raising its own permissions and spending money, because those are the two that quietly expand.

Put a stop button somewhere a non-engineer can reach, and test it. An off switch nobody has used is a hypothesis.

Make widening scope a second person's decision. This is the single control that survives most reorganisations, because it does not depend on anyone remembering to check.

Then, separately, treat the toolchain as part of the agent. An extension is a dependency with the same rights as the user. Uninstalling something is not the same as removing what it installed.

What the employee number means

An employee number is a registration record. It says the organisation knows the agent exists, has assigned responsibility, and expects a return. It does not certify competence, honesty, or safety.

SK Telecom's report is genuinely more substantive than most corporate AI governance documents, because it describes mechanisms rather than aspirations. Registers, owners, permission ceilings, logs and retirement criteria can be audited. Statements about responsible use cannot.

But the same week demonstrated the limit of the approach. Accountability for an agent is only as real as the integrity of the thing you are accounting for. Number the agents. Count them. Then go and check what else is running on the machines they trust.

[8]: https://expel.com/blog/blog-fake-claude-code-extension-cursor-ssh-backdoor/ "Fake Claude Code extension in Cursor: how to find the backdoor || Expel, 30 October 2026, on post-window execution and detection gaps.