Fake Claude Code Extension on Cursor Marketplace Backdoored Up to 5,000 Developers
A trojanized Claude Code VS Code extension lived on Cursor's marketplace for about 12 hours, planting SSH backdoors before Anthropic and Cursor pulled it and traded blame.
Part of a larger narrative
AI Developer Tools Security Crisis
- Anthropic Quietly Blocks Claude From Reverse-Engineering Games and Hardware
- Fake Claude Code Extension on Cursor Marketplace Backdoored Up to 5,000 Developersyou are here
What to know
- A fake build of Anthropic's Claude Code VS Code extension, served only through Cursor's marketplace, dropped an attacker SSH key and tried to open remote access on up to 5,000 machines before being pulled.
- Anthropic and Cursor dispute the framing: both say the official extension and Anthropic's own release channels (OpenVSX, VS Code marketplace) were never compromised, only a fake version on Cursor's marketplace.
- It remains unknown how attackers obtained access to publish through Cursor's verified account, and a bug in the macOS enablement logic limited real-world impact on Macs without SSH already on.
- Online reaction split between researchers casting it as an Anthropic supply-chain failure with inadequate disclosure, and others insisting the evidence points to Cursor's marketplace alone being at fault.
The dispute Whether responsibility lies with Anthropic (which some say was effectively hacked and stayed quiet) or solely with Cursor's marketplace (which Anthropic staff and several commenters say is the only channel that was ever compromised). · positions read across 153 posts and comments
This looks like Anthropic being compromised and not being upfront with customers about it.
-
“Anthropic has not informed customers, and the malicious version was silently deleted the backdoored version without telling anybody”
nixCraft · Mastodon ↗
The evidence shows this was exclusively a Cursor marketplace compromise, not an Anthropic breach.
-
“To be clear: Anthropic is on HN clarifying that this was exclusively distributed by the Cursor marketplace to Cursor. It didn't come from Anthropic or any other marketplace.”
wrs · Lobsters ↗
The incident is being treated with dark humor / schadenfreude rather than alarm.
-
“lol. lmao.”
dzwdz · Lobsters ↗
This is a preview of much larger AI-enabled supply-chain attacks to come.
-
“How many distro maintainers are using Claude? ... Fuck it, why not grab some fresh 0days from some AI security companies? This could be the fucking mother lode if you play your cards right.”
dzwdz · Lobsters ↗
Anthropic Maker of Claude CodeCursor (Anysphere) Operator of the compromised extension marketplaceMichael Truell Cursor CEO (@mntruell)Phorion Security research firm that discovered the backdoorKevin Beaumont (GossiTheDog) Security researcherMicrosoft Security Independent analyst of the malware
How it unfolded 8 developments, newest first · click a bar or a number to jump articlespostscomments
-
8
Microsoft publishes technical postmortem, confirms Anthropic not the source
Microsoft's security team analyzes the backdoor's persistence and reconnaissance mechanics and states it confirmed with Anthropic that Anthropic did not develop the malicious package; later coverage (SecurityWeek) details the extension's host reconnaissance and attempted reverse SSH tunnel.
“It's like confirming the jewelry store didn't smash their own windows…”
— 0xabad1dea, Mastodon user · source -
first by Microsoft, 12d ago
1 more headline
-
0
weirded out by Microsoft's security blog being like "we confirmed with Anthropic that they did not develop the malicious package." And the Cursor blog also said something similar. Like, yeah, uh, normally we take it for granted that these things are done by criminals who broke into something. It's like confirming the jewelry store didn't smash…
2 more of the top 3 · 17 posts in this stretch
-
S
That Anthropic distributes malware without telling us does not come as a surprise: arstechnica.com/security/202... #security #ai
-
Fake Claude Code extension puts THOUSANDS of Cursor users at risk A fake Anthropic Claude Code extension slipped into Cursor’s marketplace for 11 HOURS, potentially exposing thousands of users to hackers. The malware contained a hidden backdoor targeting Windows, Mac, and Linux
-
-
7
Ars Technica reports backdoor was live for nearly 12 hours
Dan Goodin reports the compromised extension was available for close to 12 hours and that it remains unknown how attackers obtained access to Anthropic's verified Cursor publishing account.
“It's still unknown how attackers got access to Anthropic's verified Cursor account.”
— Dan Goodin -
As far as I can tell, you can't upload directly to Cursor's VSCode extension marketplace and there is no such thing as a "Cursor Marketplace account" (in the relevant sense; there is a separate marketplace not for VSCode extensions that you can upload to, but that's not where the compromised extension lived). You can only upload to OpenVSX, which…
2 more of the top 3 · 18 posts in this stretch
-
C
Dan wrote about the Cursor back door. As Brian chess said this morning, "...this is just vanilla software security. In that sense it's a distraction, but it's hard to get 2026 right if you're still struggling with the lessons from 2006." Right you are, Dr chess. # swsec # appsec # MLsec https:// arstechnica.com/security/2026/…
-
You can say that this isn't compromise of Anthropic, but it sort of is in the setup. Cursor Claude extension is marked as something made by Anthropic, so default assumption is that only people who can release that new extension would be a team at Anthropic.Since that is clearly not the case, that is just as much Anthropic's problem as it is…
-
-
6
Anthropic staff clarify the malicious build never touched official channels
Anthropic employee Dworken states on Hacker News that version 2.1.313 was never published on OpenVSX, the VS Code marketplace, or any official host, and that Anthropic skipped that version number and shipped 2.1.314 to disambiguate.
“1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace.”
— Dworken (Anthropic) -
To be clear: Anthropic is on HN clarifying that this was exclusively distributed by the Cursor marketplace to Cursor. It didn’t come from Anthropic or any other marketplace. The perpetrators incremented the version number to get it to update, so Anthropic skipped that version number and released a new one, but the malware was never in their…
2 more of the top 3 · 59 posts in this stretch
-
J
This is the best coverage I've found so far of the Claude Code for VS Code backdoor: https://www. stepsecurity.io/blog/claude-co de-extension-trojanized The compromised version made it into all of the extension registries. Don't be misled by the fact that it was discovered first in the Cursor registry; this does _not_ just impact Cursor users, it…
-
This is from the Cursor blog [1] linked in the description, but repeating it here because I found it useful:---Check whether you are impactedThe malicious extension appends the attacker's public key, labeled svc-telemetry, to your SSH authorized keys. To check for it:On macOS, run: grep -qs svc-telemetry ~/.ssh/authorized_keys && echo…
-
-
5
Researchers accuse Anthropic of staging a supply-chain attack, no customer notice
Security researcher Kevin Beaumont (GossiTheDog) publishes a post calling it a global supply-chain compromise and says Anthropic silently deleted the backdoored version without informing customers, fueling wide social alarm.
“Anthropic has not informed customers, and the malicious version was silently deleted the backdoored version without telling anybody…”
— nixCraft (quoting DoublePulsar) -
N
Yesterday, Anthropic were compromised and Cursor extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor. The malware allowed hands on and automated remote access to developer laptops and desktops, in a supply chain attack. Anthropic has not informed customers, and the…
2 more of the top 3 · 48 posts in this stretch
-
lol. lmao. If this is true, then this is way too good of a supply chain attack to waste on [some mere $6b crypto theft](https://cyberplace.social/@GossiTheDog/117529440075662184). How many distro maintainers are using Claude? Even these from "conservative" distros like Debian, which would usually be relatively hard to attack? How many folks are…
-
So if this happened to OpenAI it would've been instantly auto-updated everywhere? VS Code has an "auto update delay" which I have configured to a week, but I just found out that (https://code.visualstudio.com/updates/v1_123):> Note: This delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI. These…
-
-
4
Cursor CEO disputes that the 'official' extension was compromised
Michael Truell pushes back on framing from an earlier post, saying Cursor does not believe the official Claude Code VS Code extension itself was compromised.
“We've spoken with the author of this blog and do not believe the official Claude Code VS Code extension was compromised. We believe this is instead a report of this incident.”
— @mntruell -
G
Anthropic got compromised. Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops. https:// phorion.io/blog/offical-claude -code-vsx-compromise/
2 more of the top 3 · 7 posts in this stretch
-
@mattjay We've spoken with the author of this blog and do not believe the official Claude Code VS Code extension was compromised. We believe this is instead a report of this incident.
-
"Phorion has detected a backdoor in the official Claude Code for VS Code extension bundle on Open VSX that drops a persistent SSH backdoor across macOS, Linux, and Windows. This write-up focuses primarily on macOS, where the extension attempts to configure an SSH backdoor and establish persistence. Organisations should immediately review their…
-
-
3
Cursor says incident hit at most 5,000 users, not Anthropic's code
Cursor's official account states the malicious version was accessed through its marketplace, was not developed by Anthropic, and did not affect other extensions.
“We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users.”
— @cursor_ai -
first by Business Today, 12d ago · also Digit, The Decoder, Reuters, Business Standard, Channel News Asia, Elets CIO +3
8 more headlines
- Cursor's Marketplace Hands Developers a Backdoored Claude Code Implicator.ai · 12d ago
- Over 5,000 Cursor users at risk! Fake Claude Code extension can steal your data and let hackers control your PC Digit · 12d ago
- Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft The Decoder · 12d ago
- Cursor says up to 5,000 users affected by tampered Claude Code extension Reuters · 12d ago
- Trojanised Claude Code Update on Cursor's Marketplace Tried to Plant SSH Backdoors on Up to 5,000 Developer Machines Elets CIO · 10d ago
- Cursor Warns of Malicious Claude Code Packages in Marketplace KuCoin · 10d ago
- Cursor removes malicious Claude Code extension after SSH backdoor attempt CSO Online · 9d ago
- Malicious Claude Code Extension Served in Cursor Supply Chain Attack SecurityWeek · 9d ago
-
first by Dark Reading, 12d ago
-
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions
-
-
2
Phorion publishes backdoor discovery; Cursor pulls the versions
Security firm Phorion details an injected payload that writes an attacker Ed25519 key to authorized_keys, sets up persistence, and beacons host recon data, across macOS, Linux and Windows; Cursor removes 2.1.312/2.1.313.
“Phorion has discovered a compromise of the official Claude Code for VS Code extension on the Cursor Marketplace, where the backdoored extension bundle contains a persistent Secure Shell (SSH) backdoor.”
— Phorion -
The official Claude code VS Code extension was compromised and pulling it would’ve installed an ssh backdoor on your machine for a brief window today.
1 more of the top 2 · 2 posts in this stretch
-
F
"The official # Claude Code # VSCode extension was compromised today. Yes, you heard that right." Trojanized # ClaudeCode Extension Plants an SSH Backdoor https:// opensourcemalware.com/blog/tro janized-claude-code-extension-plants-persistent-ssh-backdoor # WTF # AI # malware # security
-
-
1
Malicious extension circulates on Cursor's marketplace for ~11-12 hours
Versions 2.1.312 and 2.1.313 of the Claude Code VS Code extension, modified to include a backdoor, were served through the Cursor Marketplace before being pulled.
-
first by Unite.AI, 12d ago · also RuntimeWire, The Hacker News, Help Net Security, The Register, Notebookcheck, Northeast Times
8 more headlines
- Tampered Claude Code extension in Cursor marketplace attempted a persistent SSH backdoor RuntimeWire · 12d ago
- Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor The Hacker News · 12d ago
- Claude Code extension poisoned with persistent SSH backdoor Help Net Security · 12d ago
- Anthropic: That Claude Code extension compromise... couldn't be us The Register · 12d ago
- Trojanized Claude Code Extension Plants an SSH Backdoor OpenSourceMalware.com · 12d ago
- Tampered Claude Code extension in Cursor planted an SSH backdoor Notebookcheck · 11d ago
- Tampered Claude Code Extension Put SSH Backdoor on Up to 5,000 Cursor Users' Computers Northeast Times · 11d ago
- Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor Mastodon · 10d ago
-
first by OX Security, 12d ago · also Rescana, Step Security, Firstpost, Sophos, BleepingComputer, India Today
6 more headlines
- Trojanized Claude Code Extension 2.1.313 in Cursor Marketplace Plants SSH Backdoor Rescana · 12d ago
- Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines Step Security · 12d ago
- Cursor shuts down extension marketplace after malicious Claude Code puts 5,000 users at risk Firstpost · 12d ago
- Malicious Claude Code extension distributed through Cursor marketplace Sophos · 12d ago
- Malicious Claude Code extension on Cursor planted SSH backdoors BleepingComputer · 12d ago
- Cursor shuts down marketplace after malicious Claude Code extension hits 5,000 users, offers fix India Today · 12d ago
-
C
RE: https:// cyberplace.social/@GossiTheDog /117519256602179261 PHP demystified
-
Also covered reported alongside — the timeline has no entry for these yet
-
first by Mastodon, 12d ago · also HN Best, HN Frontpage, DoublePulsar
2 more headlines
- Anthropic hacked to deliver remote access trojan HN Best · 12d ago
- Anthropic hacked to deliver remote access trojan to Claude developer laptops HN Frontpage · 12d ago
-
first by BigGo Finance, 12d ago · also HN Best, HN Frontpage
1 more headline
- Backdoors in official Claude Code extensions HN Best · 12d ago
and 1 smaller piece
What people are saying 10 voices from 5 sites · best of 153 · verbatim
- How did attackers get access to publish through Cursor's verified marketplace account?
- Was any other software besides the Claude Code extension affected by the same access?
- Did the attackers use the backdoor to pivot into other systems (e.g., distro maintainers, AI security firms) before discovery?
- Oct 31
-
S
AnthropicのClaude Code拡張が、Cursorのマーケットプレイスで約12時間バックドア入りでした。悪意ある版は2.1.313で、影響は最大5,000人。SSHの裏口を仕込もうとします。Anthropicは告知をまだしておらず、侵入経路も不明とのことです。 https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/ #サプライチェーン攻撃
-
Wow, interesting issue. An issue with a VSC extension. And the path for this issue to even be a thing possibly a weakness in the way the extensions marketplace works (so frustrating that marketplaces and app stores are like spam folders in that you have loads of entries attempting to convince you that they are something they aren't.) And I often…
- Oct 30
-
Yes, people are throwing around a lot of speculation in this thread without evidence, and Anthropic is pretty flatly denying nearly all of that speculation on the record. See [the statements from Anthropic employees](https://news.ycombinator.com/item?id=50304129) on HN. I think it is important to be accurate about security incidents on a technical…
-
There's statements from Anthropic employees over at [the orange site](https://news.ycombinator.com/item?id=50300683). Quoting a couple: > Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's…
-
I agree but this particular thing wasn't the fault of cursor, it would affect any IDE using open vsx which includes kiro, antigravity and windsurf on top of cursor
-
> but it wasn’t a compromise of Anthropic’s systems or employee laptops.Seems a bit early to say.> A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish.For a pretty limited definition of "we" true and obvious. For the interesting definition of "we", proven…
-
C
RE: https:// cyberplace.social/@GossiTheDog /117528831681803563 heh, well... I guess, not surprising at all. It's a supply chain attack but also, the amount of lack of knowledge of wtf is happening beneath the surface going on at Anthropic and at plenty of places like it... I wonder if this is just the tip of the iceberg
-
Somewhere on the planet, there is a secret club of guys with GNU/Linux 2.4, OS/2, BeOS and Windows XP, laughing at you.
-
D
RE: https:// cyberplace.social/@GossiTheDog /117528831681803563 the Pivot stories are just jumping into the boat this week today i'm probably doing Proton/Tuta going slop, let's see how this one cooks over the weekend
-
Cursor reporting this: https://cursor.com/blog/claude-code-extension-security-notic...What appears to be an official Binance account reporting it also: