According to a 30 October advisory by security firm Phorion, tampered builds 2.1.312 and 2.1.313 of Anthropic's Claude Code extension for VS Code, served on Cursor's extension marketplace on 29 October, ran before activation, appended a key to ~/.ssh/authorized_keys and set up a reverse SSH tunnel with persistence surviving reboots. Cursor says it removed the versions, temporarily shut the marketplace and rotated keys; Anthropic denied any compromise of its systems or employee devices, saying a third party with marketplace access published a copy it did not build. How the package reached the marketplace and who was behind it remain unidentified, and updating or uninstalling does not remove the persistence.
From developments to evidence and analysis
Background
No explicit relationship is recorded.
Evidence
No explicit relationship is recorded.
Follow-ups / later versions
No explicit relationship is recorded.
Related questions
Cite this article
AI & Security Observatory（2026-10-30）「Cursorの拡張機能ストアでAnthropic製コーディング拡張の改ざん版が約11時間配布 SSHの裏口を設置」『AI & Security Observatory』、第1.0版、最終更新2026-11-01。https://ai-security-observatory.org/ja/brief/brief-20261101-09/
AI & Security Observatory (2026-10-30). A tampered "Claude Code" extension served for about 11 hours on Cursor's marketplace planted SSH backdoors; Anthropic says its systems were not breached . AI & Security Observatory, version 1.0. Updated 2026-11-01. https://ai-security-observatory.org/en/brief/brief-20261101-09/
Version 1.0 · Publication date 30 Oct 2026 · Updated 1 Nov 2026
Revision history
- Earlier revisions have not been recorded.