Tampered Claude Code extension with SSH backdoor reached up to 5,000 Cursor users
A malicious actor used access to Cursor's marketplace to publish a tampered copy of Anthropic's Claude Code extension on October 29, affecting up to 5,000 users. The fake update planted SSH keys and a persistent backdoor; Anthropic denied being breached.
Read the full story at Microsoft Research Blog ↗
Timeline · 19 reports
- 2026-10-31 18:30 · DEV Community — AI
A fake "official" Claude Code update planted SSH backdoors through Cursor's marketplace - 2026-10-31 13:20 · DEV Community — AI
Claude Code Extension Backdoor in Cursor: Uninstalling Won't Remove the SSH Key - 2026-10-31 11:27 · The Next Web
Anthropic denies breach as tampered Claude Code extension hits Cursor users - 2026-10-31 09:38 · DEV Community — AI
A trojanized Claude Code extension reached the Cursor Marketplace too — here's a 7-point audit for your machine - 2026-10-31 08:15 · DEV Community — AI
Claude Code for VS Code 2.1.313 backdoor: how to check your machine and clean up - 2026-10-31 05:00 · Techmeme
Anthropic says a malicious actor used access to Cursor's marketplace to publish a "tampered" copy of the Claude Code extension, which it didn't build or publish - 2026-10-31 01:02 · Microsoft Research Blog
Inside a malicious Claude Code-branded extension and its persistent SSH backdoor - 2026-10-30 21:58 · Reuters AI
Cursor says up to 5,000 users affected by tampered Claude Code extension - 2026-10-30 21:09 · Ars Technica AI
Anthropic VS code extension on Cursor backdoored for nearly 12 hours - 2026-10-30 18:16 · The Decoder
Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft - 2026-10-30 17:29 · Fast Company AI
Hackers hijacked a Claude Code extension, exposing yet another new AI security risk - 2026-10-30 16:27 · The Register AI/ML
Anthropic: That Claude Code extension compromise… couldn't be us - 2026-10-30 14:36 · BleepingComputer
Malicious Claude Code extension on Cursor planted SSH backdoors - 2026-10-30 12:59 · r/ClaudeAI
A backdoored Claude Code extension hit up to 5,000 Cursor users - 2026-10-30 11:18 · r/LocalLLaMA
Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor - 2026-10-30 08:55 · The Hacker News (security)
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor - 2026-10-30 08:05 · Unite.AI
Cursor Discloses SSH Backdoor Attempt in Malicious Claude Code Extension - 2026-10-30 07:46 · AlphaSignal
Cursor's Claude Code Extension Was Hijacked, Exposing 5,000 Developers to SSH Backdoor - 2026-10-30 07:09 · Hacker News Front Page
Backdoor in Claude Code for VS Code extension on the Cursor Marketplace