Home · Technology · Nov 3 archive
Anthropic's Claude Code Extension Backdoored for 11 Hours
· Confirmed
In Short: An official extension for Anthropic’s Claude model was compromised and backdoored, potentially affecting up to 5,000 developers’ machines.
An official extension for Anthropic’s Claude model was backdoored and threatened as many as 5,000 developers’ machines, multiple sources reported Friday. The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312, and was available in the marketplace of Cursor, a maker of AI-assisted developer tools, for about 11 hours on October 29.
Anthropic pushed version 2.1.314 several hours after the previous version became available on Cursor, according to independent researcher Kevin Beaumont. Both Beaumont and the CTO and co-founder of security firm Phorian confirmed that version 2.1.313 was distributed through Anthropic’s official account on Cursor.
The compromised package was a VS Code extension available in the marketplace of Cursor, a maker of AI-assisted developer tools. Cursor said that the malicious extension attempts to install a persistent SSH backdoor using an added attacker-controlled SSH key, enabling the local SSH service, and opening a reverse SSH tunnel.
Researchers found a 66-line loader prepended to the extension’s main JavaScript bundle that collected host details, added an SSH key labelled svc-telemetry, tried to open a reverse SSH tunnel to an attacker server, and installed persistence on macOS and Windows.
Cursor has pulled a tampered build of Anthropic’s Claude Code extension, version 2.1.313, after its own extension marketplace served it for about 11 hours on October 29. The build was available for about 11 hours and Cursor plans to contact those users directly.
Developers who installed or updated Anthropic's Claude Code extension through the Cursor code editor between 5:27 a.m. And 1:35 p.m. PT on October 29 may have been impacted. According to Cursor and to analysis by OpenSourceMalware, code added to the start of extension.js adds an attacker's SSH key, tries to turn on the machine's SSH service, tries to open a reverse SSH tunnel to 134.209.82.225, sets up persistence, and sends host details to the same server.
Cursor said a tampered Claude Code extension in its VS Code marketplace tried to plant an SSH backdoor on developer machines on 29th October, 2026. Uninstalling the extension may not be sufficient. Cursor says it audited access and found no evidence that other extensions were tampered with.
Neither Anthropic nor Cursor has said how the attacker got access. Cursor disclosed the incident on October 29, identifying the affected package as Anthropic.claude-code version 2.1.313. Cursor said the malware’s attempt to enable SSH access would fail on most macOS and Windows computers because the operation required administrator privileges that the extension generally did not have.
What this adds
The incident adds to the ongoing concerns about supply-chain attacks in the software industry. It remains unclear how the attackers gained control of Anthropic’s verified Cursor account.
Background
An official extension for Anthropic’s Claude model was compromised and backdoored, potentially affecting up to 5,000 developers’ machines for about 11 hours on October 29, 2026.
What's confirmed
- Anthropic pushed version 2.1.314 several hours after the previous version became available on Cursor, according to independent researcher Kevin Beaumont.
- The compromised package was a VS Code extension available in the marketplace of Cursor, a maker of AI-assisted developer tools, the company said Friday.
- Both Beaumont and the CTO and co-founder of security firm Phorian said that version 2.1.313 was distributed through Anthropic’s official account on Cursor.
- Cursor said that the malicious extension attempts to install a persistent SSH backdoor using an added attacker-controlled SSH key, enabling the local SSH service, and opening a reverse SSH tunnel.
- Researchers found a 66-line loader prepended to the extension’s main JavaScript bundle that collected host details, added an SSH key labelled svc-telemetry, tried to open a reverse SSH tunnel to an attacker server, and installed persistence on macOS and Windows.
- Cursor has pulled a tampered build of Anthropic’s Claude Code extension, version 2.1.313, after its own extension marketplace served it for about 11 hours on October 29, and the code planted an attacker’s SSH key on the machines of up to 5,000 developers.
- "The package identifies itself as anthropic.claude-code version 2.1.313, but its main JavaScript bundle contains a malicious 66-line loader inserted before the legitimate extension code," Jenn Gile, co-founder of OpenSourceMalware, said in a statement shared with The Hacker News.
- You may notice 2.1.313 is missing from OpenVSX, Visual Studio Marketplace and Cursor: a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace.
- Claudeshop fingers 'malicious actor' in targeted supply-chain attack on Cursor Anthropic has denied allegations that a malicious version of the official Claude Code extension published to Cursor’s marketplace was linked to any kind of compromise of its own systems.
- According to Cursor, the extension – version 2.1.313 – was available to download for around 11 hours between 0227 and 1335 PT (0927 and 2035 UTC) on Thursday.
- Neither Anthropic nor Cursor has said how the attacker got access.
- Anthropic says nobody breached its own systems or staff laptops.
What's still developing
- Anthropic has yet to issue public notice of the incident to customers.
- If this key is present, the machine is impacted. grep -qs svc-telemetry ~/.ssh/authorized_keys && echo “svc-telemetry key found” || echo “No key found; machine not impacted” $files = “$HOME.ssh\authorized_keys”, “C:\ProgramData\ssh\administrators_authorized_keys” | Where-Object { Test-Path $_ } Per Cursor’s guidance, if you installed or updated to Anthropic.claude-code 2.1.313 from the Cursor VS Code Extension Marketplace between 2:27 AM and 1:35 PM PT on October 29, 2026: From the victim’s side, nothing suspicious had to be clicked and no vulnerability had to be exploited.
- The company says the rogue extension was downloaded by “at most 5,000 users.” Cursor briefly shut down the extension marketplace while it investigated the situation, which the company says did not impact any other extensions.
- Disrupt 2026: OpenAI, Anthropic, Replit, and more take over 6 industry stages. 25% off tickets now Back by popular demand: Save up to $300 on Disrupt UK-based manufacturing software startup CloudNC announced a $20 million B extension round on Wednesday, bringing its lifetime total raised amount to $128 million.
- It also ran checks to confirm no other extensions were compromised in the same way, rotated its own keys before restoring the marketplace, and worked with a cloud hosting provider to block the connection to the attacker's server, it said. ® How the Uber-bound delivery giant tuned its mobile networking stack to cut latency PARTNER CONTENT: Michael Stonebraker and Bruce Momjian on why enterprise AI needs a database that no one controls, and what PostgreSQL 19 says about the road ahead Keeping secrets is difficult in an open world, but we've done it before and must do it again $220 million?
- “Everyone was so lucky here, this was potentially a really dangerous foothold for an attacker,” says Calum Hall, cofounder and CEO of the detection firm Phorion, the first researchers to spot the malicious extension after detecting it on a customer's Mac.
- Il 29 ottobre 2026 una versione manomessa dell'estensione Claude Code di Anthropic è rimasta disponibile per circa 11 ore sul marketplace di Cursor, l'editor di codice con intelligenza artificiale.
- It also ran checks to confirm no other extensions were compromised in the same way, rotated its own keys before restoring the marketplace, and worked with a cloud hosting provider to block the connection to the attacker's server, it said. ® Wants more local AI, without Big Tech getting open access to everything PARTNER CONTENT: Michael Stonebraker and Bruce Momjian on why enterprise AI needs a database that no one controls, and what PostgreSQL 19 says about the road ahead PLUS: Brake pedals break on Huawei-made cars; North Korea named as source of Binance hack; and more!