Home · Technology · Oct 31 archive
Anthropic's Claude Code Extension Backdoored for 11 Hours
· ConfirmedShare on
In Short: An official extension for Anthropic’s Claude model was compromised and backdoored, potentially affecting up to 5,000 developers’ machines for about 11 hours on October 29, 2026.
On October 29, 2026, an official extension for Anthropic’s Claude model was compromised and backdoored, potentially affecting up to 5,000 developers’ machines for about 11 hours, according to multiple sources.
The compromised version, 2.1.313, was published under the extension's legitimate publisher identity and extension ID (anthropic.claude-code) on the Cursor marketplace.
According to Cursor, the extension – version 2.1.313 – was available to download for around 11 hours between 0227 and 1335 PT (0927 and 2035 UTC) on Thursday.
Researchers at OpenSourceMalware found that version 2.1.313 of the extension carried extra code, a 66-line loader placed in front of the real program.
The loader runs as soon as the extension loads, so users did not have to open a chat or click anything to activate it.
Errors are hidden, meaning the extension kept working as normal while the loader did its job.
The malicious code set up a LaunchAgent on macOS or a scheduled task called SysMon on Windows, with a Startup-folder script as a fallback to survive reboots.
The package identifies itself as anthropic.claude-code version 2.1.313, but its main JavaScript bundle contains a malicious 66-line loader inserted before the legitimate extension code.
According to Cursor, the extension could still add the attacker’s SSH key, install persistence mechanisms, and transmit system information even when the remote tunnel could not be established.
Anthropic pushed version 2.1.314 several hours after the previous version became available on Cursor, according to independent researcher Kevin Beaumont.
The malicious update was published under the extension's legitimate publisher identity and extension ID (anthropic.claude-code), effectively superseding 2.1.312.
The user doesn’t need to interact with the extension for the payload to fire.
What this adds
According to Cursor, the extension – version 2.1.313 – was available to download for around 11 hours between 0227 and 1335 PT (0927 and 2035 UTC) on Thursday.
Anthropic pushed version 2.1.314 several hours after the previous version became available on Cursor, according to independent researcher Kevin Beaumont.
Background
An official extension for Anthropic’s Claude model was compromised and backdoored, potentially affecting up to 5,000 developers’ machines for about 11 hours on October 29, 2026, according to multiple sources.
Chinese AI startup Moonshot has launched Kimi K3.1 Pro, a model that is rapidly closing in on Anthropic's Claude Opus 5.5 in benchmark tests, according to The Decoder.
What's confirmed
- To survive reboots, the code set up a LaunchAgent on macOS or a scheduled task called SysMon on Windows, with a Startup-folder script as a fallback.
- "The package identifies itself as anthropic.claude-code version 2.1.313, but its main JavaScript bundle contains a malicious 66-line loader inserted before the legitimate extension code," Jenn Gile, co-founder of OpenSourceMalware, said in a statement shared with The Hacker News.
What's still developing
- Social engineering explained How to report a phishing email: where to send it and what to do next On October 29, 2026, anyone whose Cursor code editor updated the Claude Code extension may have received a tampered copy that quietly gave an unknown attacker a way back into their computer.
- Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail.
- Una versione manomessa dell'estensione Claude Code è stata distribuita per 11 ore sul marketplace di Cursor.
- Il 29 ottobre 2026 una versione manomessa dell'estensione Claude Code di Anthropic è rimasta disponibile per circa 11 ore sul marketplace di Cursor, l'editor di codice con intelligenza artificiale.
- Help Net Security reported that the build was available for about 11 hours and that Cursor plans to contact those users directly.
- Cursor, which SpaceX acquired earlier this year, said Anthropic did not develop the code.
Sources
- 2-Spywarelink
- Ars Technicalink
- DoublePulsarlink
- Meteora Weblink
- Northeast Timeslink
- Technology Orglink
- The Hacker Newslink
- WIREDlink
- Cyberkendralink
- The420link
- Thenextweblink
- Theregisterlink
- Newslink
- WarpBeat — background on Official Anthropic Extension Backdoored for 11 Hours link
- WarpBeat — background on Moonshot Launches Kimi K3.1 Pro, Closing In On Anthropic's Claude Opus 5.5 link
- Caretta SHOW — video link