Home · Technology · Nov 3 archive

Official Anthropic Extension Backdoored for 11 Hours

5:00 AM ETConfirmedShare via:      

Technology Desk

In Short: An official extension for Anthropic’s Claude model was backdoored and threatened as many as 5,000 developers’ machines, multiple sources reported Friday.

An official extension for Anthropic’s Claude model was backdoored and threatened as many as 5,000 developers’ machines, multiple sources reported Friday. The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312.

Cursor said at most 5,000 users were affected, and the build was available for about 11 hours. Developers who installed or updated Anthropic's Claude Code extension through the Cursor code editor between 5:27 a.m. And 1:35 p.m. PT on October 29, 2026, were impacted.

The malicious extension added an attacker's SSH key, tried to turn on the machine's SSH service, and attempted to open a reverse SSH tunnel to 134.209.82.225. It also set up persistence mechanisms and sent host details to the same server.

Uninstalling the malicious extension may not be sufficient because the payload drops standalone persistence scripts that can continue running after the extension is removed. Cursor removed version 2.1.313, blocked further distribution, and shut its whole VS Code marketplace down as a precaution.

According to Cursor and analysis by OpenSourceMalware, the rogue extension could still add the attacker’s SSH key, install persistence mechanisms, and transmit system information even when the remote tunnel could not be established.

What this adds

Background

What's confirmed

• Cursor, the maker of the editor, said at most 5,000 users were affected.
• Importantly, uninstalling the malicious extension may not be sufficient, because the payload drops standalone persistence scripts that can continue running after the extension is removed.
• The compromised package was a VS Code extension available in the marketplace of Cursor, a maker of AI-assisted developer tools, the company said Friday.

What's still developing

• Anthropic pushed version 2.1.314 several hours after the previous version became available on Cursor, according to independent researcher Kevin Beaumont.
• Cursor says it audited access and found no evidence that other extensions were tampered with.
• If this key is present, the machine is impacted. grep -qs svc-telemetry ~/.ssh/authorized_keys && echo “svc-telemetry key found” || echo “No key found; machine not impacted” $files = “$HOME.ssh\authorized_keys”, “C:\ProgramData\ssh\administrators_authorized_keys” | Where-Object { Test-Path $_ } Per Cursor’s guidance, if you installed or updated to Anthropic.claude-code 2.1.313 from the Cursor VS Code Extension Marketplace between 2:27 AM and 1:35 PM PT on October 29, 2026: From the victim’s side, nothing suspicious had to be clicked and no vulnerability had to be exploited.
• Cursor said the extension took the OS, CPU architecture, home directory path, working directories, and environment variable names.
• Cursor said the malware’s attempt to enable SSH access would fail on most macOS and Windows computers because the operation required administrator privileges that the extension generally did not have.
• "The package identifies itself as anthropic.claude-code version 2.1.313, but its main JavaScript bundle contains a malicious 66-line loader inserted before the legitimate extension code," Jenn Gile, co-founder of OpenSourceMalware, said in a statement shared with The Hacker News.
• Felix Rieseberg, an Anthropic engineering manager, said that "we're working with Cursor on this incident" and reiterated it did not involve a compromise of Anthropic's systems or employee laptops.
• “Everyone was so lucky here, this was potentially a really dangerous foothold for an attacker,” says Calum Hall, cofounder and CEO of the detection firm Phorion, the first researchers to spot the malicious extension after detecting it on a customer's Mac.
• It also ran checks to confirm no other extensions were compromised in the same way, rotated its own keys before restoring the marketplace, and worked with a cloud hosting provider to block the connection to the attacker's server, it said. ® How the Uber-bound delivery giant tuned its mobile networking stack to cut latency PARTNER CONTENT: Michael Stonebraker and Bruce Momjian on why enterprise AI needs a database that no one controls, and what PostgreSQL 19 says about the road ahead Keeping secrets is difficult in an open world, but we've done it before and must do it again $220 million?
• Il 29 ottobre 2026 una versione manomessa dell'estensione Claude Code di Anthropic è rimasta disponibile per circa 11 ore sul marketplace di Cursor, l'editor di codice con intelligenza artificiale.
• Background scripts retried the connection roughly every 60 seconds.

Sources

• Ars Technicalink
• Cyber Kendralink
• Meteora Weblink
• Northeast Timeslink
• OX Securitylink
• Rescanalink
• SQ Magazinelink
• THE ELEC, Korea Electronics Industry Medialink
• The 420.inlink
• The Hacker Newslink
• WIREDlink
• Technologylink
• Doublepulsarlink
• WarpBeat — background on Official Anthropic Extension Backdoored for 11 Hours link
• WarpBeat — background on Anthropic's Claude Code Extension Backdoored for 11 Hours link
• Eli the Computer Guy — video link