Malicious Claude Code Extension Triggers Security Alert

A compromised version of Anthropic's Claude Code extension for Visual Studio Code-compatible editors has triggered a cybersecurity alert after researchers discovered malicious code designed to install a persistent SSH backdoor on developers' computers.

The incident involved version 2.1.313 of the extension, identified as anthropic.claude-code. According to security researchers, the modified package contained a malicious loader inserted before the legitimate extension code.

Cursor clarified that the malicious version was not developed by Anthropic. The incident is being investigated as a software supply-chain security attack.

How the Malicious Extension Worked

According to cybersecurity researchers at OpenSourceMalware, the compromised extension contained a 66-line malicious loader designed to execute before the legitimate Claude Code functionality.

Once activated, the malicious code attempted to collect information about the affected computer and establish persistent remote access.

The attack involved several activities:

  • SSH key injection: The malware attempted to add an attacker-controlled public key to the user's SSH authorised keys file.

  • Remote access: It attempted to establish a reverse SSH tunnel to an external server.

  • System persistence: It installed platform-specific startup mechanisms, including LaunchAgents on macOS and scheduled tasks on Windows.

  • System information collection: It collected details such as the computer's hostname, username, operating system, architecture and public IP address.

  • Environment reconnaissance: It collected names of selected environment variables associated with credentials and cloud services.

The malicious SSH key used the label svc-telemetry, making it appear like a legitimate system service.

Up to 5,000 Users Potentially Affected

Cursor identified the affected distribution window as approximately 2:27 a.m. to 1:35 p.m. Pacific Time on October 29, 2026.

The company said that up to 5,000 users may have encountered the malicious extension during this period.

However, this figure represents the maximum potential exposure rather than a confirmed number of infected computers.

Cursor also explained that enabling the local SSH service requires administrator privileges. On most macOS and Windows systems, the malicious extension would not have those permissions, meaning the remote login attempt could fail.

Nevertheless, the extension could still add the unauthorised SSH key, install persistence mechanisms and transmit system information.

Cursor Removes the Malicious Version

Following the discovery, Cursor removed the malicious extension from its marketplace and temporarily shut down the marketplace as a precaution.

The company also stated that it audited access, confirmed that other extensions had not been tampered with, rotated its keys and worked with the hosting provider to take the attacker's server offline.

Anthropic subsequently published version 2.1.314 as the updated extension version.

Cursor advised potentially affected users to investigate their systems, remove unauthorised SSH keys and persistence mechanisms, and rotate credentials and sessions accessible from affected computers.

Simply uninstalling the extension may not be sufficient because the malicious code was designed to leave behind separate persistence mechanisms.

Why Developer Tools Are Becoming Attractive Attack Targets

The incident highlights the security risks associated with software supply-chain attacks, particularly those targeting developer tools and extension marketplaces.

Coding extensions often operate with access to source code, terminal environments, project files and development configurations. A malicious extension can therefore create opportunities for attackers to access sensitive information or establish remote control over developer systems.

AI coding assistants are increasingly integrated into everyday software development workflows. This makes the security of their distribution channels, update mechanisms and extension dependencies especially important.

For development teams, the incident reinforces the need to verify extension publishers, monitor software updates, apply endpoint security controls and review permissions granted to development tools.

A Warning for the AI Development Ecosystem

The Claude Code extension incident demonstrates how attackers can exploit trusted software distribution channels to reach developers.

Although the malicious version was removed and its command-and-control server was taken offline, the event raises broader questions about extension marketplace security and software verification.

As AI coding tools become more widely adopted, protecting the systems that distribute and update these tools will be essential.

For developers and organisations, the priority is not only choosing secure AI tools but also ensuring that the extensions and dependencies surrounding them remain trustworthy.