Fireship's "worst week in cybersecurity" ends with Claude getting root
Jeff Delaney's latest Code Report runs from a fake Claude Code extension to a Binance theft, eleven days after his previous "most vulnerable week."
No. 71 on the daily chartNo. 5 on the Tech chart
Why this story? One of the most watched videos since yesterday, with 772,812 views.
The worst week in cybersecurity history... so far
Things we can learn from the video
Press to jump
- 0:41A malicious Claude Code extension on the Cursor marketplace scanned for tokens and opened SSH backdoors for about 5,000 users.
- 1:08A compromised DebugBear script let attackers drain more than $2 million from Polymarket accounts.
- 1:43Binance loses a reported $6.3 billion across blockchains after a DevOps laptop is compromised.
- 2:26Tether and Circle freeze roughly $3 billion of the stolen funds, and Binance covers the losses before resuming withdrawals.
- 2:49A critical Linux kernel bug from 2016 involves a race condition during TCP handshakes.
- 4:14Anthropic shows an unreleased Claude model exploiting that bug in 53 minutes to get root execution.
Eleven days ago, Fireship called it "The most vulnerable week in internet history..." The new episode raises the stakes with two extra words in its title: "The worst week in cybersecurity history... so far." One viewer thanks Jeff Delaney for his slow move into a cybersecurity format. Another notes that every week now seems to set a new low.
The channel built its name on "100 Seconds of Code" explainers about languages and frameworks. This Code Report, dated November 3 on its title card, is about what happens when the tools developers trust turn against them. About 770,000 people watched it in its first eight hours.
The first case is close to home for programmers. A malicious version of the Claude Code extension appeared on the Cursor marketplace, searching for access tokens and opening SSH backdoors for around 5,000 users before it was taken down. "Unfortunately, they shipped it without actually knowing they shipped it," Delaney says. Next, a compromised script from DebugBear let attackers drain Polymarket accounts. The on-screen graphic puts the losses at $2.73 million across 737 accounts.
The largest case is Binance. The video reports a $6.3 billion theft across several blockchains, which began with a single compromised DevOps laptop. Tether and Circle froze about $3 billion of the stolen funds, and Binance covered the losses before it reopened withdrawals. Delaney's comment on those frozen billions is short: "Crypto isn't actually decentralized."
The ending is the part a wider audience will remember. A Linux kernel flaw that dates back to 2016, a race condition during TCP handshakes rated 9.8 out of 10, had gone unnoticed for a decade. Then Anthropic showed that an unreleased Claude model could exploit it in 53 minutes and gain root, the highest level of control over a machine. "The problem is that world no longer exists," Delaney says just before that segment.
A sponsored segment for CodeRabbit's security scanner closes the video.
Published on Trari
Where next?
What viewers say
I love how every week is a new level of worst week yet now
@formantaudioSee it on YouTubeIt's a good week. Worse than last week, that's true, but better than next week.
@auralsecktsSee it on YouTubeI for one am appreciating your slow migration into a cybersecurity format.
@randomfrequencySee it on YouTube
5 more comments
JS frameworks to LLMs to Security Exploits pipeline
this channel is going places@weeb3277See it on YouTubeDarn I was really looking forward to that latest javascript framework
@halneufmilleSee it on YouTubeMe: its good to touch grass
Claude: Im just gonna go straight to the root@figeroooooSee it on YouTubeThis week another decade passed this year.
@tkzsfenSee it on YouTubeIt's always a pointer
@ragibrownak5712See it on YouTube
Public comments from the video's page on YouTube
- Channel
- Fireship
- Subscribers
- 4,320,000
- Channel views, last 7 days
- 4,565,995
- Channel views, pace per day
- 117,769 (on a normal day: 957,827)
- Video published
- November 3, 2026
- Video views so far
- 772,812 (less than a day online)
- Video views, pace per day
- 1,502,503
The numbers
The video has drawn close to 800,000 views in its first eight hours, on a channel whose regular uploads often pass two million.
💡 Test your knowledge
Who created the Linux kernel?
Linus Torvalds released the first version of the Linux kernel in 1991, while he was a student in Helsinki.


