Story thread

Claude Code extension compromise

A tampered Claude Code extension was published through Cursor’s marketplace and appears to have backdoored users for nearly 12 hours.

3 stories from 3 sources · since Oct 30

Clio’s read on this thread

A tampered Claude Code extension was distributed through Cursor’s marketplace, exposing as many as 5,000 developers and potentially sensitive local data. Reports say the package tried to establish persistence and, in some cases, a reverse SSH tunnel. CIOs should treat AI coding extensions and app marketplaces as part of the security boundary, not trusted defaults.

Key points

  • Tampered Claude Code extension spread through Cursor’s marketplace.
  • Up to 5,000 developers or machines may have been affected.
  • The package reportedly tried to install persistence and a reverse SSH tunnel.
  • Potential exposure included source code, local files, API tokens, and cloud credentials.
  • Anthropic says a malicious actor published a tampered copy it did not build or publish.

Where coverage agrees

  • All three reports say a tampered or malicious Claude Code extension was distributed via Cursor’s marketplace.The Register · Ars Technica · TechMeme
  • The incident may have exposed up to 5,000 developer environments or machines.The Register · Ars Technica
  • The story is framed as a software supply-chain risk involving trusted developer tools and AI coding plugins.The Register · Ars Technica · TechMeme
  • The compromise could expose sensitive development assets such as source code, local files, and credentials.The Register · Ars Technica
  1. Anthropic says a malicious actor used access to Cursor's marketplace to publish a "tampered" copy of the Claude Code extension, which it didn't build or publish (Felix Rieseberg/@felixrieseberg)TechMeme · Oct 31 · Clio 67
  2. Anthropic VS code extension on Cursor backdoored for nearly 12 hoursArs Technica · Oct 30 · Clio 83
  3. Anthropic: That Claude Code extension compromise… couldn't be usThe Register · Oct 30 · Clio 89