Part of AI Developer Tools Security Crisis · 2 stories · since Oct 28 · newest 8d ago
Fake Claude Code Extension on Cursor Marketplace Backdoored Up to 5,000 DevelopersMicrosoft publishes technical postmortem, confirms Anthropic not the source
8 Oct 31 · 11d ago · 19 articles · 21 posts · 5 comments · 8 sources · development 8 of 8
Microsoft's security team analyzes the backdoor's persistence and reconnaissance mechanics and states it confirmed with Anthropic that Anthropic did not develop the malicious package; later coverage (SecurityWeek) details the extension's host reconnaissance and attempted reverse SSH tunnel.
“It's like confirming the jewelry store didn't smash their own windows”
0xabad1dea, Mastodon user · mastodon ↗Anthropic Maker of Claude CodeCursor (Anysphere) Operator of the compromised extension marketplaceMichael Truell Cursor CEO (@mntruell)Phorion Security research firm that discovered the backdoorKevin Beaumont (GossiTheDog) Security researcher
The whole story articlespostscomments the bright band is this development · numbered dots are the others · click one to jump
What was reported 1 claim about this development
-
first by Microsoft, 12d ago
1 more headline
What people said 14 voices · best of 17 · verbatim
-
0
weirded out by Microsoft's security blog being like "we confirmed with Anthropic that they did not develop the malicious package." And the Cursor blog also said something similar. Like, yeah, uh, normally we take it for granted that these things are done by criminals who broke into something. It's like confirming the jewelry store didn't smash…
-
S
That Anthropic distributes malware without telling us does not come as a surprise: arstechnica.com/security/202... #security #ai
-
Fake Claude Code extension puts THOUSANDS of Cursor users at risk A fake Anthropic Claude Code extension slipped into Cursor’s marketplace for 11 HOURS, potentially exposing thousands of users to hackers. The malware contained a hidden backdoor targeting Windows, Mac, and Linux
-
The threat is that they're going to take software quality so low that we're going back to the 1990 :P
-
Wow, interesting issue. An issue with a VSC extension. And the path for this issue to even be a thing possibly a weakness in the way the extensions marketplace works (so frustrating that marketplaces and app stores are like spam folders in that you have loads of entries attempting to convince you that they are something they aren't.) And I often…
-
C
BIML had something to say about the Cursor backdoor as well...first thing. https:// berryvilleiml.com/2026/10/30/a nthropic-spearheads-supply-chain-attack/
-
S
AnthropicのClaude Code拡張が、Cursorのマーケットプレイスで約12時間バックドア入りでした。悪意ある版は2.1.313で、影響は最大5,000人。SSHの裏口を仕込もうとします。Anthropicは告知をまだしておらず、侵入経路も不明とのことです。 https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/ #サプライチェーン攻撃
-
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the...
-
How much do we trust Anthropic at this point... :thinking:
-
Nobody seems to be taking responsibility for the alluded-to credential leak. No ownership taken, and no explanation of how the leak occurred or how it will be prevented in the future.If y'alls systems were not compromised then it was Cursors?
-
E
Attackers backdoored the official Claude Code VS Code extension being distributed on the Cursor Marketplace. The malicious version of the extension, downloadable for 11 hours on Thursday, was designed to give attackers persistent SSH access to any endpoint on which the extension was installed. https://www. databreachtoday.com/cursor-con…
-
> tampered copy of the Claude Code extension, which we didn’t build or publishit looks like anthropic folks in this thread are throwing excuses instead of allocating one оr two FTE to make sure this will not happen
-
Anthropic denies breach as tampered Claude Code extension hits Cursor users https:// thenextweb.com/news/tampered-c laude-code-extension-cursor-ssh-backdoor?utm_source=flipboard&utm_medium=activitypub Posted into TNW - All Stories @ tnw-all-stories-thenextweb
-
RE: https:// cyberplace.social/@GossiTheDog /117528831681803563 lmao
All 8 developments of Fake Claude Code Extension on Cursor Marketplace Backdoored… →
MastodonHacker NewsNewswiresLobstersXGoogle NewsRedditBluesky