Home · Technology · Oct 31 archive
Official Anthropic Extension Backdoored for 11 Hours
· Confirmed
In Short: Ars Technica reports that an official extension for Anthropic’s Claude model was compromised, affecting up to 5,000 developers.
Ars Technica and Doublepulsar reported that a malicious version of Anthropic’s Claude Code extension, labeled 2.1.313, was distributed through the official Anthropic account on Cursor’s marketplace for about 11 hours on October 29, 2026. Both sources agree that the compromised package was a VS Code extension available in Cursor’s marketplace.
According to Ars Technica, the malicious version was posted to the official Anthropic account, effectively superseding the previous version 2.1.312. Ars Technica also noted that the malicious extension attempted to install a persistent SSH backdoor using an attacker-controlled SSH key, enabling the local SSH service, and opening a reverse SSH tunnel.
The malicious extension, version 2.1.313, was pulled from Cursor’s marketplace after it was found to have been tampered with. Cyber Kendra detailed that the extension contained a 66-line loader that collected host details, added an SSH key labeled svc-telemetry, and tried to open a reverse SSH tunnel to an attacker server.
Northeast Times and Rescana provided specific timing details, stating that the malicious build was available for about 11 hours between 5:27 a.m. And 1:35 p.m. PT on October 29, 2026. Rescana added that the malicious code was inserted into the start of the extension’s main JavaScript bundle.
The malicious version of the extension was not developed by Anthropic. The Hacker News noted that the package identified itself as anthropic.claude-code version 2.1.313, but its main JavaScript bundle contained a malicious 66-line loader.
Cursor’s security notice, reported by The420 and Ox, stated that the malicious extension’s attempt to enable SSH access would fail on most macOS and Windows computers due to the requirement for administrator privileges. Cursor also advised that uninstalling the extension may not be sufficient to remove the threat.
Anthropic has yet to issue a public notice of the incident to customers. Ars Technica noted that Anthropic pushed version 2.1.314 several hours after the previous version became available on Cursor.
Cursor’s security notice, reported by The420 and Ox, stated that the company audited access and found no evidence that other extensions were tampered with. Cursor also rotated its own keys before restoring the marketplace and worked with a cloud hosting provider to block the connection to the attacker's server.
In conclusion, Ars Technica, Doublepulsar, Cyber Kendra, Northeast Times, Rescana, The Hacker News, Sqmagazine, The420, and Ox all agree that a malicious version of Anthropic’s Claude Code extension was distributed through Cursor’s marketplace for about 11 hours on October 29, 2026. The compromised extension attempted to install a persistent SSH backdoor and collect host details, posing a significant threat to developers who downloaded or updated the extension during that period.
What this adds
The extent of the impact on developers and the full scope of the threat posed by the compromised extension remain unclear, as the sources have not established the exact number of affected users or the success rate of the malicious code in establishing a backdoor.
What's confirmed
- Cursor said that the malicious extension attempts to install a persistent SSH backdoor using an added attacker-controlled SSH key, enabling the local SSH service, and opening a reverse SSH tunnel.
What's still developing
- If this key is present, the machine is impacted. grep -qs svc-telemetry ~/.ssh/authorized_keys && echo “svc-telemetry key found” || echo “No key found; machine not impacted” $files = “$HOME.ssh\authorized_keys”, “C:\ProgramData\ssh\administrators_authorized_keys” | Where-Object { Test-Path $_ } Per Cursor’s guidance, if you installed or updated to Anthropic.claude-code 2.1.313 from the Cursor VS Code Extension Marketplace between 2:27 AM and 1:35 PM PT on October 29, 2026: From the victim’s side, nothing suspicious had to be clicked and no vulnerability had to be exploited.
- The company says the rogue extension was downloaded by “at most 5,000 users.” Cursor briefly shut down the extension marketplace while it investigated the situation, which the company says did not impact any other extensions.
- The company said the modified extension was not developed by Anthropic and that it would contact potentially affected users directly.
- Disrupt 2026: OpenAI, Anthropic, Replit, and more take over 6 industry stages. 25% off tickets now Back by popular demand: Save up to $300 on Disrupt UK-based manufacturing software startup CloudNC announced a $20 million B extension round on Wednesday, bringing its lifetime total raised amount to $128 million.
- Claudeshop fingers 'malicious actor' in targeted supply-chain attack on Cursor Anthropic has denied allegations that a malicious version of the official Claude Code extension published to Cursor’s marketplace was linked to any kind of compromise of its own systems.
- It also ran checks to confirm no other extensions were compromised in the same way, rotated its own keys before restoring the marketplace, and worked with a cloud hosting provider to block the connection to the attacker's server, it said. ® How the Uber-bound delivery giant tuned its mobile networking stack to cut latency PARTNER CONTENT: Michael Stonebraker and Bruce Momjian on why enterprise AI needs a database that no one controls, and what PostgreSQL 19 says about the road ahead Keeping secrets is difficult in an open world, but we've done it before and must do it again $220 million?