Home · Technology · Nov 6 archive
Official Claude Extension Backdoored, Affects Up to 5,000 Developers
· Confirmed
In Short: An official extension for Anthropic’s Claude model was compromised, potentially affecting up to 5,000 developers’ machines.
An official extension for Anthropic’s Claude model was backdoored and threatened as many as 5,000 developers’ machines, multiple sources reported Friday. The compromised package was a VS Code extension available in the marketplace of Cursor, a maker of AI-assisted developer tools.
Between about 2:27am PT and 1:35pm PT on October 29, a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code Extension Marketplace.
Researchers found a 66-line loader prepended to the extension’s main JavaScript bundle that collected host details, added an SSH key labeled svc-telemetry, tried to open a reverse SSH tunnel to an attacker server, and installed persistence on macOS and Windows.
The malicious extension attempts to install a persistent SSH backdoor using an added attacker-controlled SSH key, enabling the local SSH service and opening a reverse SSH tunnel.
The company said the modified extension was not developed by Anthropic and that it would contact potentially affected users directly.
For persistence, the Claude Code payload installed a LaunchAgent named com.apple.sysmond on macOS and, on Windows, a scheduled task called SysMon that tries to run as SYSTEM, with a sysmon.cmd script in the Startup folder as a fallback.
Uninstalling the extension may not be sufficient, as the code set up persistence mechanisms.
The malicious version was posted to the official Anthropic account, effectively superseding 2.1.312. Extensions auto-update in Cursor by default, but users can configure this in settings.
Cursor briefly shut down the extension marketplace while it investigated the situation, which the company says did not impact any other extensions.
The company pulled the tampered build of Anthropic’s Claude Code extension, version 2.1.313, after it served the code for about 11 hours on October 29.
According to Stack Overflow’s 2026 Developer Survey, released in early October, Cursor accounted for 26% of the AI coding tools or AI agents used by surveyed developers.
What this adds
The malicious version, 2.1.313, was posted to the official Anthropic account, effectively superseding 2.1.312. Extensions auto-update in Cursor by default, but users can configure this in settings.
Uninstalling the extension may not be sufficient, as the code set up persistence mechanisms.
Background
An official extension for Anthropic’s Claude model was backdoored and threatened as many as 5,000 developers’ machines, multiple sources reported Friday.
Uninstalling the extension may not be sufficient, as the code set up persistence mechanisms.
What's confirmed
- The compromised package was a VS Code extension available in the marketplace of Cursor, a maker of AI-assisted developer tools, the company said Friday.
- Cursor said that the malicious extension attempts to install a persistent SSH backdoor using an added attacker-controlled SSH key, enabling the local SSH service and opening a reverse SSH tunnel.
- “Between about 2:27am PT and 1:35pm PT today, a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code Extension Marketplace,” Cursor said in a security notice.
- Researchers found a 66-line loader prepended to the extension’s main JavaScript bundle that collected host details, added an SSH key labelled svc-telemetry, tried to open a reverse SSH tunnel to an attacker server, and installed persistence on macOS and Windows.
- Background scripts retried the tunnel roughly every 60 seconds.
- The company said the modified extension was not developed by Anthropic and that it would contact potentially affected users directly.
- Turning on the SSH service needs administrator rights, which the extension lacked on most macOS and Windows machines.
What's still developing
- Try searching for other cybersecurity topics or keywords.
- A short loader was added in front of its code and runs as soon as the editor starts, so nobody has to open a Claude chat for it to trigger.
- The researchers identified the altered extension.js file as the difference from the normal package.
- In a post on X, the company said it took its whole extension marketplace offline, reinstated it after confirming no further risk, and asked customers to update to Claude Code for VS Code version 2.1.314.
- “A malicious actor used access to Cursor’s marketplace to publish a tampered extension targeting Cursor’s users, we were not involved with building, publishing, or hosting this” The extension itself auto updated in Cursor to the malicious version.
Sources
- Ars Technicalink
- Hackreadlink
- Step Securitylink
- Warpbeatlink
- Csoonlinelink
- Technologylink
- Cyberkendralink
- Theleclink
- Doublepulsarlink
- Sqmagazinelink
- Northeasttimeslink
- Notebookchecklink
- WIREDlink
- The420link
- WarpBeat — background on Official Anthropic Extension Backdoored for 11 Hours link
- WarpBeat — background on Malicious Claude Code Extension Affects Up to 5,000 Developers link
- Reveal Wire — video link