Tampered Claude Code extension served on Cursor marketplace with persistent SSH backdoor; Anthropic denies breach
AI coding assistants run inside developer environments that hold source code, cloud keys and production access, so a poisoned update under a trusted publisher name is a direct route into the software supply chain. Enterprises that allow AI extensions should inventory them now, restrict installation to pinned and reviewed versions, and hunt for unauthorised SSH persistence on developer machines. The unanswered question of how the package reached the marketplace is the next thing to watch, because it decides whether the fix sits with marketplace operators, publishers or both.
What Happened
On October 29, 2026, Cursor reported that a tampered copy of the Claude Code extension (versions 2.1.313 and 2.1.312) was served in its extension marketplace for a few hours in a supply-chain attack on Cursor users. The package contained a persistent SSH backdoor written for Windows, macOS and Linux. Microsoft confirmed the malicious packages were not published through the Visual Studio Marketplace or the npm package, and Anthropic told Microsoft its systems were not compromised; neither company has said how the package reached the marketplace.
Why It Matters
AI coding assistants run inside developer environments that hold source code, cloud keys and production access, so a poisoned update under a trusted publisher name is a direct route into the software supply chain. Enterprises that allow AI extensions should inventory them now, restrict installation to pinned and reviewed versions, and hunt for unauthorised SSH persistence on developer machines. The unanswered question of how the package reached the marketplace is the next thing to watch, because it decides whether the fix sits with marketplace operators, publishers or both.
Sources
- Microsoft Security Blog (opens in a new tab): Inside a malicious Claude Code-branded extension and its persistent SSH backdoor (2026-10-30)
- The Register (opens in a new tab): Anthropic: That Claude Code extension compromise… couldn't be us (2026-10-30)
More From This Briefing
- Google, Microsoft, OpenAI and Anthropic to honour a single robots.txt opt-out for AI training
- Aramco takes 49% of Saudi AI company HUMAIN with $2.6bn cash and AI assets
- CISA adds two exploited Ivanti Connect Secure vulnerabilities to its KEV catalog
- Willis Re completes acquisition of US reinsurance broker BMS Re US
More on Frontier AI
- Contractor's personal AI coding agent reportedly ran on a Pentagon NIPRNet system for two months (1 November 2026)
- GSA to issue final version of its AI contract data-safeguarding clause ahead of formal rulemaking (1 November 2026)
- Mistral releases weights of trillion-parameter Large 4 model, positioned for coding and cyber defence (31 October 2026)
- Google announces Gemini 4 Carbon, ranked first on Artificial Analysis Index at 59 (30 October 2026)
Key Terms
- Software supply chain attack: A software supply chain attack compromises a widely used component, package, update channel or service provider in order to reach the many...
Filed under Cybersecurity and AI Threats, Frontier AI Models, Cursor, Anthropic.
This story is part of the Laurenceo Intelligence briefing for 2 November 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.