Fake Claude Code extension installs backdoor on 5,000 dev machines

This incident follows the established pattern of software supply chain attacks targeting developer tooling ecosystems, specifically through dependency confusion and typosquatting in open package registries. Historically, attackers have exploited the gap between official vendor releases and open mirrors like Open VSX or npm, where automated validation is less stringent than in curated stores. Previous cases involving malicious VS Code extensions have similarly relied on brand impersonation to trick developers into installing compromised packages that exfiltrate credentials or establish persistence via SSH keys. These attacks typically leverage the high-trust permissions granted to coding assistants, which require filesystem and terminal access to function legitimately. The recurrence of such incidents highlights systemic verification gaps in decentralized extension marketplaces used by AI-native IDEs, where rapid adoption of new tools often outpaces security vetting processes.

On October 30, 2026, a supply chain security incident involving a malicious Visual Studio Code extension impersonating Anthropic’s Claude Code tool was identified and amplified across security communities. The sequence of events began at approximately 09:08 UTC when Bluesky user Famebot posted an alert claiming that Anthropic had been compromised and that the official Claude Code extension contained malware creating remote access Trojans on developer desktops [2]. This initial warning cited a post by security researcher GossiTheDog, who had flagged 'Backdoors in official Claude Code extensions' on cyberplace.social, linking to technical analysis of the alleged compromise [1][2].

By 10:14 UTC, further investigation clarified the scope and nature of the threat. CryptoNews Poster reported on Bluesky that the specific malicious artifact was version 2.1.313 of the extension found within the Cursor marketplace, rather than a direct breach of Anthropic’s internal infrastructure [3]. According to this report, the extension affected approximately 5,000 users by harvesting host information and attempting to install an SSH backdoor [3]. Crucially, CryptoNews Poster stated that the malicious package did not originate from Anthropic and confirmed that Cursor had already removed the offending extension, advising users to update immediately to version 2.1.314 [3].

At 10:36 UTC, Hacks.gr provided additional technical verification via Bluesky, confirming that the compromise occurred specifically through the Open VSX registry as well as the Cursor Marketplace [4]. This distinction is significant because Open VSX serves as an open-source alternative to Microsoft’s proprietary VS Code marketplace, often used by AI-integrated IDEs like Cursor. Hacks.gr corroborated the installation of an SSH backdoor and the estimate of up to 5,000 affected users, reinforcing that the attack vector was a third-party registry compromise rather than a first-party vendor breach [4].

The incident gained broader industry traction at 11:05 UTC when a Hacker News discussion titled 'Backdoors in official Claude Code extensions' began amplifying the alerts [1]. The community discourse highlighted the risks inherent in open extension ecosystems where automated vetting may be less rigorous than in curated marketplaces. While early alarms suggested a direct compromise of Anthropic, subsequent reporting established that the attacker exploited trust in the brand by publishing a typosquatted or hijacked package on secondary registries.

Anthropic’s position, as reflected in the clarification that the extension was 'Not from Anthropic,' places the liability on the distribution platforms and the attackers rather than the model provider itself [3]. Cursor’s response involved the immediate takedown of the malicious version to protect its user base [3]. Security researchers have since recommended patching to v2.1.314 as the primary remediation step [3]. The incident underscores the fragility of trust in AI development toolchains, where developers grant extensions deep access to local environments and codebases based largely on brand recognition and marketplace placement.

Throughout the timeline, the narrative shifted rapidly from 'vendor compromise' to 'supply chain impersonation.' Initial fears of a breached AI company were replaced by the more common, yet equally dangerous, reality of dependency confusion and registry poisoning. The speed of identification—from first alert to platform removal and version confirmation—occurred within a three-hour window, suggesting effective community-based threat intelligence despite the initial alarmist framing. However, the exposure window for the ~5,000 potentially affected machines remains a critical concern for enterprise security teams relying on these tools.

Approximately 5,000 developers using Cursor and Open VSX were exposed to a malicious Claude Code impersonator capable of installing SSH backdoors and harvesting host information. While Cursor removed the extension and a patched version (v2.1.314) was released within hours, the incident risks lingering enterprise codebase compromise if affected machines remain unpatched. The primary harm falls on individual developers and small teams relying on open registries; larger enterprises with pinned dependencies likely avoided exposure. Magnitude is moderate in scale but high in symbolic impact, as it targets the intersection of AI tool adoption and developer trust. Financial exposure is indirect, stemming from potential intellectual property theft or remediation costs rather than regulatory fines.