Claude Code VS Code extension compromised in supply chain attack
This story is from 2026-10-31. It is preserved in the archive; the latest stories are on the live feed.
A backdoor was found in Claude Code VS Code extension versions 2.1.312 and 2.1.313, which sat live in Cursor's marketplace for about eleven hours before a security advisory was issued.
Read the full story at Runway Research ↗
Timeline · 43 reports
- 2026-11-03 09:16 · DEV Community — AI
How to test a web app built with Claude Code or Cursor before you ship - 2026-11-03 07:19 · DEV Community — AI
T3 Code: A Free, Open-Source Control Panel for Claude Code, Codex and Other Coding Agents - 2026-11-03 05:48 · DEV Community — AI
The Claude Code Extension Backdoor That Lived in Cursor's Own Marketplace for 11 Hours - 2026-11-03 05:42 · DEV Community — AI
One API Key, One Balance: Wiring Models and Data APIs into Claude Code, Cursor and Codex - 2026-11-03 03:26 · DEV Community — AI
Is there a cheap API for Claude Code? Run a three-request test on any candidate before you pay - 2026-11-03 03:08 · DEV Community — AI
MCP server managers for Claude Code, Codex and Gemini CLI (2026) - 2026-11-03 02:11 · DEV Community — AI
Let Claude Code query your database read only with the DBX MCP server - 2026-11-03 01:43 · DEV Community — AI
Where Claude Code and Codex keep /goal state, and how one open-source app reads both - 2026-11-03 00:03 · r/ClaudeAI
Official Claude Code Extension Compromise: Security Advisory - 2026-11-02 20:39 · DEV Community — AI
Unslop Brings Staged UI Review to Claude Code and Codex - 2026-11-02 20:32 · DEV Community — AI
Your MCP server can read ~/.ssh. Here is how I put it in a jail - 2026-11-02 20:07 · DEV Community — AI
Go from idea to tested feature in Claude Code or Cursor with /spec, /plan and /build - 2026-11-02 16:41 · DEV Community — AI
Why we built Pilothouse: One inbox and PreToolUse rules for Claude Code, Codex, OpenCode, and Grok Build - 2026-11-02 15:00 · Runway Research
Runway Dev is in Claude Code, Codex and Cursor - 2026-11-02 15:00 · Runway Research
Runway News | Runway Dev is in Claude Code, Codex and Cursor - 2026-11-02 11:42 · InfoWorld AI
Cursor removes malicious Claude Code extension after SSH backdoor attempt - 2026-11-02 09:21 · DEV Community — AI
PingCode AI - Unified API for Claude Code, Codex & More - 2026-11-02 09:19 · DEV Community — AI
Claude Code hooks on Windows: when a Bash matcher sees nothing - 2026-11-02 08:38 · DEV Community — AI
How I run many Claude Code and Codex agents at once with a Chief that assigns the work - 2026-11-02 07:42 · DEV Community — AI
Run Claude Code for FREE with Ollama - 2026-11-02 06:05 · DEV Community — AI
Claude Code for Free in VS Code: No Login, No API Key (Ollama + Qwen 3.8) - 2026-11-02 02:34 · DEV Community — AI
Subscription Cancellation MCP Server: 4 Read-Only Tools for Claude, Cursor and VS Code - 2026-11-01 20:24 · DEV Community — AI
8 rules for Claude Code hooks that never get in Claude's way - 2026-11-01 20:15 · AlphaSignal
Kanzo Gives Coding Agents a Shared open-source Kanban Board in 4MB - 2026-11-01 20:01 · DEV Community — AI
Let Claude Code or Cursor debug your page in a real Chrome browser - 2026-11-01 16:01 · DEV Community — AI
Cloned a Stranger's Repo? Check 6 Agent Config Files Before Claude Code or Codex Opens It - 2026-11-01 15:52 · DEV Community — AI
Coincide: Claude Code, Codex, Cursor and more, side by side on your Mac - 2026-11-01 14:22 · DEV Community — AI
Using Claude Code, Codex and Gemini CLI on the same repository - 2026-11-01 13:48 · DEV Community — AI
Malicious Claude Code Extensions in the Wild: Why AI Agents Need Deterministic Outbound Gates - 2026-11-01 10:54 · DEV Community — AI
I gave Claude Code a crew. Codex and Gemini found a race in the plugin that runs them. - 2026-11-01 10:19 · r/ClaudeAI
I built a live file tree for Claude Code so I can see what it reads and edits (free, open source) - 2026-11-01 07:05 · DEV Community — AI
How to stop Claude Code, Cursor and Codex reading your .env file - 2026-10-31 23:43 · DEV Community — AI
"Buddy: let Claude Code, Codex and other AI agents use your Android phone - 2026-10-31 23:27 · DEV Community — AI
How to install and use agent skills in Claude Code, Cursor and Codex (with a free plugin marketplace) - 2026-10-31 21:00 · DEV Community — AI
I Let Claude Code Write a 20-Lesson Tutorial Course for My App From Its Codebase - 2026-10-31 19:02 · DEV Community — AI
Stop Claude Code from building the same generic landing page - 2026-10-31 15:10 · DEV Community — AI
How to Stop Claude Code From Reading Your .env File (Deny Rules Aren't Enough) - 2026-10-31 14:01 · DEV Community — AI
Your AI coding transcripts are a secret store: where Claude Code, Codex, Cursor, Copilot and Antigravity keep them - 2026-10-31 13:20 · DEV Community — AI
Claude Code Extension Backdoor in Cursor: Uninstalling Won't Remove the SSH Key - 2026-10-31 11:46 · DEV Community — AI
Building a read-only MCP server where a connector token can never become a login - 2026-10-31 11:30 · DEV Community — AI
How to Tell What Claude Code and Codex Forget When They Compact a Session - 2026-10-31 11:27 · The Next Web
Anthropic denies breach as tampered Claude Code extension hits Cursor users - 2026-10-31 09:38 · DEV Community — AI
A trojanized Claude Code extension reached the Cursor Marketplace too — here's a 7-point audit for your machine