DEV Community: Jonathan Flower

How to not Loose $500k to a Malicious Cursor Extension

Jonathan Flower — Thu, 24 Jul 2025 10:12:00 +0000

Cursor’s open plugin marketplace allowed a malicious extension to steal $500,000;

The Issue with VS Code Plugins in Cursor

Cursor is an AI-powered code editor forked from Visual Studio Code, but unlike the official VS Code, it cannot use Microsoft’s proprietary extension marketplace. Instead, Cursor relies on the Open VSX registry—a more open, community-driven alternative with less strict security controls and review processes.

This openness allowed attackers to upload a fake “Solidity Language” extension that appeared legitimate (with a copied description and inflated download numbers). When installed, the extension executed malicious code, granting attackers remote access to the developer’s machine and ultimately leading to the theft of $500,000 in cryptocurrency. The attack exploited the fact that IDE extensions have deep system access, and the Open VSX marketplace’s ranking algorithm could be manipulated to make malicious extensions appear more trustworthy than legitimate ones.

Advice to Protect Against This Vulnerability

Install Extensions from Trusted Sources
- Prefer Microsoft’s official marketplace when possible. If you use Cursor or another VS Code fork, first install and test extensions in the official VS Code, then migrate them to Cursor. This reduces the risk of installing a malicious lookalike.
Be Wary of Non-Functional or New Extensions
- If an extension doesn’t work as expected, uninstall it immediately. New extensions are riskier—let them mature and gain community trust before adopting.
Scrutinize Publisher Details
- Check the publisher’s profile, history, and other published extensions. Attackers often use subtle name changes (like a capital “I” instead of a lowercase “l”) to impersonate trusted publishers.
Watch for Inflated Download Counts
- Don’t rely solely on download numbers or ratings; these can be faked.
Compartmentalize Sensitive Work
- Use minimal extensions in environments handling sensitive data (like crypto wallets). Consider separate systems for high-value activities.
Stay Informed and Use Security Tools
- Keep up with security advisories and use reputable antivirus or endpoint protection to detect suspicious activity.
Verify Extension Code When Possible
- Open-source does not guarantee safety. The distributed package may differ from the public code. If you’re highly security-conscious, build extensions from source or verify cryptographic signatures.

By following these practices, you can significantly reduce your risk when using VS Code plugins in Cursor or any similar open marketplace.

This is largely from Java Brains YouTube video about the issue.

Other sources:

⁠https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-500k-crypto-heist-through-malicious-packages-targeting-cursor-developers ⁠https://securelist.com/open-source-package-for-cursor-ai-turned-into-a-crypto-heist/116908/ ⁠https://www.webasha.com/blog/what-is-the-real-risk-behind-malicious-vscode-extensions-like-the-cursor-ide-incident

Build a GPT That Talks to Your Database in One Day

Jonathan Flower — Thu, 27 Jun 2024 01:52:13 +0000

Have you ever wondered how challenging it is to create a Custom GPT with user authentication and database access? I found the lack of examples of this disheartening. So, I create a comprehensive guide myself and am pleased to say, with a small amount of coding skills you can build your own in day.

Tech Stack

To achieve this, I used:

Clerk.com: for authentication
Vercel: for hosting
Prisma: for great database management UX
Neon: for serverless postgres
Typescript
Express.js

Who is this for?

This guide is perfect for developers looking to create an AI Agent or a Custom GPT that supports user authentication and database access with ease.

Why it matters

An AI Agent with user authentication unlocks numerous possibilities, enabling applications that require secure user data access and personalized experiences.

Prerequisites

Before diving in you will need:

Familiarity with DNS and configuring a Custom Domain Name
Familiarity with creating a REST API
Have a paid subscription to ChatGPT

Background Story

In my quest to build GPTs with authentication, I found the lack of examples disheartening. Despite extensive searches on Perplexity, Arc Search, and ChatGPT, the closest resources were:

Authenticate users in GPT actions: Build a personal agenda assistant - Too closely tied to Logto.io
How to add OAuth authorization for custom GPTs - Using PHP, Laravel, and looks overly complicated
GPT Action with Google OAuth) - Limited to Google APIs
GPT-Actions: GPT Auth - Not using OAuth2

Since I couldn’t find what I needed, I decided to create an example myself, hoping it would help others in similar situations.

The Challenge

After getting the basics working and configuring the GPT, I faced a frustratingly generic error when trying to save:

To troubleshoot, I built another Custom GPT using OAuth2 to access my Google Calendar, confirming the issue was specific to my project. The community shared similar frustrations:
"Error saving draft" when creating an authenticated action in a GPT

The Solution

The breakthrough came from an unusual requirement in the OpenAI docs: the OAuth2 server must share the same domain as the API server, except for Google, Microsoft, and Adobe OAuth domains.

Once I configured a custom domain on Clerk, everything worked beautifully! The result is a template project that any developer can fork, customize, and deploy in a single day.
* GitHub Repository: Custom GPT API OAuth

Demo

Check out the demo for a hands-on experience. Feel free to explore, and even spam the database - restoring it is easy with backups on Neon.

Demo: My Pizza Dough - OAuth Demo

Checkout the rest of my series on GPTs: ~Who Cares About Custom GPTs?~

How do I start to incorporate AI into my business?

Jonathan Flower — Tue, 04 Jun 2024 13:51:58 +0000

1. Spend at least 10 minutes playing with ChatGPT

Start chatting without needing to signup: https://chat.openai.com/
Type whatever comes to mind. A few ideas to get the conversation started:
- What were the last few things you Googled? Try typing those into ChatGPT.
- What is a topic you are curious about? Ask ChatGPT to tell you about it.
- Try to stump it by asking a hard question in your field of expertise.
There are a ton of AI tools out there. I suggest starting with ChatGPT because it is free and the best for many things.

2. Is it magic or an idiot?

This is largely dependent on the questions you asked and how you phrased them. The question is what types of questions can it answer, and how do I ask my questions in a way that helps it respond well?
The simplest advice is to imagine ChatGPT is a high school intern who has memorized the internet. Technically I don’t agree with personifying ChatGPT, but I have not found a better way to guide people with a simple concept. Let’s imagine giving a high school intern very brief instructions. Who knows what you are going to get from them! If you take the time to explain the goal, steps, any other relevant details or expectations, then you will be surprised if you don’t receive back something you can use or at least provide feedback on so that they can improve.

3. Practical uses

Now that you have some basic concepts, it is time to explore how it might be able to speed or enhance your work. You are on your way to becoming AI empowered.
We started this post with a question: “How do I start to incorporate AI into my business?” This is a perfect question to ask ChatGPT.

   I am in the [insert your industry] industry and my role is a [insert your role]. How do I start to incorporate AI in my business?

4. Ask ChatGPT to give you a lot of ideas for prompts:

   I am a [insert your profession]. Give me 50 ChatGPT prompts that can help me be more productive in my job.

Privacy

As you start to use ChatGPT, you should be cautious about uploading documents or entering text with sensitive information. Do not enter anything sensitive. The free version of ChatGPT will use this information to train their models. Here is a guide on how to protect your private information: How to Protect Your Data with ChatGPT | Jonathan Flower posted on the topic | LinkedIn

Automatically Close Apps That Drain your Battery

Jonathan Flower — Tue, 04 Jun 2024 11:51:48 +0000

Ever feel the need to close certain apps that drain your battery and then later on forget to relaunch them when connected to power?

I use an app called Rewind that records my screen much like the new Microsoft Copilot Recall. Unfortunately Rewind has been discontinued. But it still works great. The only issue is that it uses a fair amount of power and runs down my battery and so I turn it off when on Battery. I also have an app called Wave Link that connects to my Elgato Wave:3 Studio Mic. It runs audio filtering whether I am actively using the mic or not and again, runs down my battery.

Thus, I wrote an apple script that runs every minute and automatically launches or quits these apps. Hope this helps:

Open Automator
Create a New Application
Search and add Run AppleScript
Update the script below to fit your needs

-- Get current battery status
set batteryInfo to do shell script "pmset -g batt"
-- List of apps
set appsToClose to {"Rewind", "WaveLink"}
set appsToOpen to {"Rewind", "WaveLink"}

-- Check if on battery power
if batteryInfo contains "Battery Power" then
 -- Loop through apps and quit them
 repeat with appName in appsToClose
  tell application "System Events"
   -- Check if the app is running by its name

   if exists (processes whose name is appName) then
    tell application "System Events" to set appRunning to true
   else
    tell application "System Events" to set appRunning to false
   end if
  end tell
  if appRunning then
   tell application appName to quit
  end if
 end repeat
else
 -- Loop through apps and open them
 repeat with appName in appsToOpen
  tell application "System Events"
   -- Check if the app is running by its name
   if exists (processes whose name is appName) then
    if (appName is "WaveLink") then
     set appName to "Elgato Wave Link"
    end if
    tell application "System Events" to set appRunning to true
   else
    tell application "System Events" to set appRunning to false
   end if
  end tell
  if not appRunning then
   tell application appName to activate
  end if
 end repeat
end if

Plist file

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>Label</key>
        <string>com.jflow.closeapp</string>
        <key>ProgramArguments</key>
        <array>
                <string>/usr/bin/open</string>
                <string>/Users/jflowerhome/Documents/CloseOnBatteryV2.app</string>
                <string>--args</string>
                <string>--run-in-background</string>
        </array>
        <key>StartInterval</key>
        <integer>60</integer>
        <key>RunAtLoad</key>
        <true/>
</dict>
</plist>

Load the plist file so that macOS runs the app regularly

launchctl load ~/Library/LaunchAgents/com.jflow.closeapp.plist

Tips:

One key was to avoid a relative file path to the apple script.

One strange issue I ran into is that the WaveLink has a different launch name than it’s running name.

When updating the plist file unload and then load it again:

launchctl unload ~/Library/LaunchAgents/com.jflow.closeapp.plist

Troubleshooting

Search for the app in launchctl and note the second column. If it is a “1” then it errored out.

launchctl list | grep com.jflow
- 0 com.jflow.closeapp

Next Gen User Experiences – Vercel Ship 2024

Jonathan Flower — Mon, 03 Jun 2024 13:17:46 +0000

Jared Palmer presented on:

Next Gen User Experiences

The idea is to:

Give chatbots rich component based interfaces with what we’re calling Generative UI

This is supported by the power of Vercel’s AI SDK and React Server Components

See it in action:

Generative UI – interactive schedule component fully wired into the chat experience

This is the future because it greatly simplifies the interaction. Rather than having a different AI bot integrated into each app, my favorite apps are integrated into a single chat interface. This way the AI has the context it needs to act on requests such as “book a meeting with Lee @2pm today to talk about the movie “Her”.

AI and Sensitive Data: A Guide to Protect your Data

Jonathan Flower — Thu, 30 May 2024 14:46:27 +0000

Privacy and security come at the cost of convenience. Here is a guide to help you safeguard your data appropriately.

Level 1: ChatGPT Temporary Chat

The Promise:

This chat won’t appear in history, use or create memories, or be used to train our models. For safety purposes, we may keep a copy for up to 30 days.

Why It Matters: Temporary chats provide a layer of privacy by ensuring your conversations are not stored long-term or used for model training. This reduces the risk of data breaches and enhances your control over personal information.

Level 2: ChatGPT for Teams

https://openai.com/chatgpt/team

The Promise:

We never train on your data or conversations.

Why It Matters: For collaborative environments, ChatGPT for Teams offers a secure solution where your data remains private and is not utilized for training AI models. This ensures confidential business information stays within your organization.

Level 3: Azure AI

Data, privacy, and security for Azure OpenAI Service – Azure AI services

Why It Matters: Microsoft’s Azure AI provides extensive controls and guarantees around security and privacy, offering enterprise-grade protection. With robust compliance certifications, Azure ensures that your data is handled with the highest standards of security.

Level 4: Local AI Models

Running AI locally can significantly enhance your privacy. Here are some excellent options:

https://privatellm.app/en – Local AI chat for Mac and iOS
https://www.continue.dev – GitHub Copilot, but open source and using a local AI modal
https://pinokio.computer– Easiest way to discover and install a huge collection of local AI tools

Why It Matters: Using local models ensures your data never leaves your device, reducing the risk of interception or misuse. This layer is particularly beneficial for those handling highly sensitive information.

Additionally, Microsoft is innovating with Copilot+ PCs, betting big on running more AI locally to enhance privacy

Level 5: Hacker Proof

While local processing minimizes external threats, securing your hardware is paramount. If your device is compromised, no software solution can fully protect your data.

The Simplest Solution:

Dedicated AI Computer: Use a separate computer exclusively for AI tasks, disconnected from the internet.
Faraday Cage: For ultimate security, place the device in a Faraday cage to block any wireless signals.
Data Transfer: Use a USB drive to transfer data to and from this secure computer.

Why It Matters: This setup ensures that your AI processing environment is isolated from network-based threats, offering the highest level of security for your sensitive operations.

It has been my pleasure to guide you and empower you to work confidently and securely with AI.

GPTs that have clearly received a lot of love

Jonathan Flower — Wed, 29 May 2024 20:16:11 +0000

I hate wasting my time with AI tools that promise the world and end up being a complete disappointment. I love finding AI tools that actually solve problems better than more conventional tools.

Before we get into these excellent GPTs, even these powerful GPT will fail horribly when given a weak prompt. My favorite guiding principle is to think of the GPT as high school intern. If you do not provide detail, who knows what you are going to get! It helps a lot when you communicate the goal and provide steps to follow whenever possible.

Great GPTs

Grimoire

When starting a new coding project, I typically start here. Grimoire helps me think through architectural decisions and evaluate which technologies will be the best fit. The way Grimoire collaborates with me on the solution is a clear step above generic ChatGPT.

From the creator, Nick Dobos:

How is Grimoire different from vanilla GPT?

-Coding focused system prompts to help you build anything.

Combining the best tricks I’ve learned to pull correct & bug free code out from GPT with minimal prompting effort

Consensus

“search and synthesize information from over 200 million academic papers.” For example, I asked it if intermittent fasting is good for my heart health. I received back a detailed response with links to research papers supporting each point.

Universal Primer

I love learning and this GPT is my go to when I want to dive deeper on a concept. I love how it breaks things down concepts into easily digestible chunks and includes plenty of examples.

What are your favorite GPTs?

This article is part of a series: Who Cares About GPTs?

Personalize Your AI Experience: Reasons to Create a Private GPT

Jonathan Flower — Wed, 29 May 2024 19:41:01 +0000

Do you struggle to keep track of your favorite prompts? Despite saving them in my note-taking app, Bear, retrieving the right prompt when I need it and adding my personal information and documents remains a hassle. Surely, there must be a better way!

One of my favorite prompts is one I use to help draft cover letters.

My Cover Letter Process:

Search my chat history for an existing chat about cover letters, often I don’t find one quick enough and abandon the search.
Switch to searching Bear for the right prompt
Copy paste the prompt
Upload my CV
Wait a few seconds (at this point I often get distracted, 10 minutes later I remember I was supposed to be working on my cover letter. Sound familiar?)
Paste in the job description
Copy Paste the draft cover letter, revise, send it over.

Will this still saved me time and improved the quality of my cover letters, it is clunky.

Private GPT

That’s when I stumbled upon the game-changing concept of Private GPTs. How have I missed this? I can create a dedicated AI assistant that crafts personalized cover letters with a single prompt. No more distractions—just efficiency.:

How To Create a GPT

Creating a GPT | OpenAI Help Center

How to make it private:

when you click Create, make sure to select Only me
in Additional Settings, uncheck “Use conversation data in your GPT to improve our models” for more privacy.

Favorite Private GPTs

Private Cover Letter GPT

I uploaded my resume, chatted with the configuration tool telling it to create something that drafted a cover letter every time I provide a job description. Now, I can open my GPT, paste in a job description, and it immediately starts drafting a cover letter. So convenient and fast! The best part is, over time I have continued to “train” my GPT to better write in my voice and have it provide an ATS rating is so that I can quickly determine if this job is a good fit.

Private Chef GPT

I have another private GPT that helps with meal planning. I uploaded our family cookbook so that it can suggest creating our favorite meals. My wife will take a picture of the pantry and fridge and allow it to suggest what to cook for dinner. The meals have been excellent!

When meal planning, it started off by outlining complicated 3 course meals. This is where a private GPT is way better than a collection of favorite prompts. We were able to simply talk to the configuration tool and tell it we preferred more budget friendly and easy to cook meals. Now when we start a chat with our Private Chef GPT, it knows how big my family is, our favorite family recipes, and how we prefer to meal plan.

Here is what it looks like when editing the GPT. You literally have a conversation with the configuration tool, and it programs the GPT for you.

What Private GPT should I create next?

(featured image credit Dalle3)

Metacognition is susceptible to stochasticity

Jonathan Flower — Mon, 13 May 2024 16:34:42 +0000

Excellent advice from Sam Schillace, Deputy CTO of Microsoft, on building with AI. What does it mean?

metacognition is susceptible to stochasticity

In other words, LLMs are easily confused. Their outputs can be unpredictable. It’s better to offload the planning aspect to code, which can provide more structured and deterministic guidance for the LLM.

Sam Schillace goes on to explain:

the model’s good at thinking, but it’s not good at planning. So you do planning in code.

What an excellent guidance on how best to create value with AI models.

In a recent client project, we wondered what the right balance was between relying on the LLMs reasoning ability verses using code to help guide the LLM. When relying more on the LLM, the AI Agent was able to better handle unusual questions. However, its’ responses were less deterministic. The version that relied on code and predefined prompts, depending on the user’s objective, was much more predictable.

For instance, we wanted the AI Agent to ask questions about the user’s preferences before recommending a product. The model would randomly recommend a product earlier in the conversation than we wanted. What worked best was using code to wait to add the prompt about recommending products until specific conditions were met (such as how many questions the user had answered).

Here is a link to the episode and more of my favorite quotes:

Presenting the AI Engineer World’s Fair — with Sam Schillace, Deputy CTO of Microsoft

Sam Schillace:

This is a little bit of an anthropomorphism and an illusion that we’re having. So like when we look at these models, we think there’s something continuous there.

We’re having a conversation with chat GPT or whatever with Azure open air or like, like what’s really happened. It’s a little bit like watching claymation, right? Like when you watch claymation, you don’t think that the model is actually the clay model is actually really alive. You know, that there’s like a bunch of still disconnected slot screens that your mind is connecting into a continuous experience.

But what happens is when you’re doing plans and you’re doing these longer running things that you’re talking about, that second level, the metacognition is very vulnerable to that stochastic noise, which is like, I totally want to put this on a bumper sticker that like metacognition is susceptible to stochasticity would be like the great bumper sticker.

So what, these things are very vulnerable to feedback loops when they’re trying to do autonomy, and they’re very vulnerable to getting lost.

So what we’ve learned to answer your question of how you put all this stuff together is You have to, the model’s good at thinking, but it’s not good at planning. So you do planning in code. So you have to describe the larger process of what you’re doing in code somehow.

Having that like code exoskeleton wrapped around the model is really helpful, like it keeps the model from drifting off and then you don’t have as many of these vulnerabilities around memory that you would normally have.

Image credit: Dalle3 (I ran with Sam’s suggestion that this would look great as a bumper sticker. I selected the best out of 8 tries. Pretty hilarious how poorly it spells words like Metacognition and stochasticity. I was going to avoid including it in the post, but then I realized it illustrates Sam’s point perfectly.)

Retrieval Unleashed with OpenAI’s new Assistants API

Jonathan Flower — Wed, 08 May 2024 12:41:35 +0000

OpenAI released a new version of their Assistants API and made some really neat upgrades to retrieval.

https://platform.openai.com/docs/assistants/whats-new

Now we can ingest up to 10,000 files per assistant. Is that enough for you?

My favorite part is where they explain how the new file_search tool works:

How File Search Works

Rewrites user queries to optimize them for search.

Breaks down complex user queries into multiple searches it can run in parallel.

Runs both keyword and semantic searches across both assistant and thread vector stores.

Reranks search results to pick the most relevant ones before generating the final response.

⠀By default, the file_search tool uses the following settings:

Chunk size: 800 tokens

Chunk overlap: 400 tokens

Embedding model: text-embedding-3-large at 256 dimensions

Maximum number of chunks added to context: 20 (could be fewer) https://platform.openai.com/docs/assistants/tools/file-search/how-it-works

https://platform.openai.com/docs/assistants/tools/file-search/how-it-works

This is stinking awesome because the AI agent I architected a month ago for a client is satisfyingly similar. What took me over 120 hours and 600+ lines of LangChain, you get for free when you build your solution with Assistant API.

A few differences I find interesting. The number of chunks added to context is a lot higher and the overlap is higher. I was targeting around 5 chunks and only a 20% overlap. I suspect this is for two reasons, 1) I have not added reranking yet. 2) If I add up the chunks between the parallel RAGs, I am getting close to 20 total chunks. OpenAI did not specify if they are talking per RAG or total.

The large overlap in the chunks likely helps this solution work for a broader set of use cases. Which is exactly what OpenAI is targeting here. If you are building this all custom, you can tune each piece of this to your specific use case.

One clear limitation is that I chose to create separate vector databases because my client had two sets of data that were for very different purposes, however you can only configure an assistant with a single Vector Store.

Custom LangChain or Assistant API?

One aspect of building with OpenAI tools that fascinates me is the tradeoff between:

Custom LangChain : customization, dependability, privacy

Assistant API : limited customization, faster development, and rising with the tide.

What do I mean by rising with the tide? As OpenAI improves Assistant API, your solution will get better for free. You might need to update a few things to take advantage of the latest and greatest, but man is that a lot easier than potentially trying to replicate the new feature in your custom solution. When and for whom does this tradeoff make sense?

Gmail and ChatGPT in your Dock

Jonathan Flower — Thu, 02 May 2024 20:06:17 +0000

Did you know you can add web apps like ChatGPT to your dock in Sonoma?

I absolutely love this feature. Hands down, my favorite feature of Sonoma.

This means I can Command + Tab to select the Gmail app!

How to add a web app to your dock

Open Safari
Navigate to the website you want to add to your dock
Click: File -> Add to Dock…

React Server Components: A New Era of Web Development?

Jonathan Flower — Fri, 19 Apr 2024 14:21:02 +0000

Here is a great podcast that captures some of the history from Dan Abramov:

React Server Components with Dan Abramov (JS Party #311)

Part of what I found interesting is the misconception that RSC is all about server side rendering. There is some question about there potentially being a better name.

I like how Josh Comeau explains it:

React Server Components is not a replacement for Server Side Rendering. You shouldn’t think of React Server Components as “SSR version 2.0”.

Instead, I like to think of it as two separate puzzle pieces that snap together perfectly, two flavors that complement each other.

We still rely on Server Side Rendering to generate the initial HTML. React Server Components builds on top of that, allowing us to omit certain components from the client-side JavaScript bundle, ensuring they only run on the server.

Making Sense of React Server Components – Josh Comeau

And here is another great podcast about RSC: Simplifying Server Components by Mark Dalgleish

I am still on the fence about RCS. Clarifying that this is not simply SSR 2.0 is helping me get over some of my resistance. However, I am failing to see enough value add here for most web apps. An approach like this is complicated and presents its’ own set of challenges. This new approach requires adopting a novel mental model for how the app works. This means it will present a challenge for developers to adopt and troubleshoot effectively. If your solution can be delivered as an SPA or SSR, the developer experience and performance is pretty great these days. I wonder at what point does it start to make sense to add the complexity of RSC.

The other area I am researching is how to deploy offline first with RSC. I am a huge fan of offline first and optimistic UI patterns because of the massive performance and scalability advantages. It is not clear to me how to develop these patterns with RSC or if you would want to.

One very cool application of RSC is in AI agents. Since the AI models are server side, it makes sense to render components server side. Having the ability to dynamically render UI for each AI agent response has some very cool use cases. Checkout what Vercel is doing with what they are calling Generative UI: Introducing AI SDK 3.0 with Generative UI support