{"slug": "anthropic-that-claude-code-extension-compromise-couldn-t-be-us", "title": "Anthropic: That Claude Code extension compromise… couldn't be us", "summary": "Anthropic technical staff member Felix Rieseberg denied that a tampered Claude Code extension published to Cursor's marketplace, which infected up to 5,000 developers, resulted from a compromise of Anthropic's systems or employee laptops, attributing it instead to \"a malicious actor\" who used access to Cursor's marketplace to publish a version Anthropic \"didn't build or publish.\" Cursor said version 2.1.313 of the extension was downloadable for about 11 hours between 0227 and 1335 PT on Thursday and carried a persistent SSH backdoor for Windows, macOS and Linux that collected usernames, configured Git emails and public IP addresses; the tunnel required admin rights it usually lacked, but the extension still exfiltrated host data, dropped the attacker's SSH key and installed persistence, so installing the latest version does not clear the infection. Cursor removed the malicious version immediately, shut down the VSCode Marketplace as a precaution, rotated its keys and worked with a cloud hosting provider to block the attacker's server, while neither company has explained how the package reached the official marketplace.", "body_md": "# Anthropic: That Claude Code extension compromise… couldn't be us\n\n[The Register](https://www.theregister.com)\n\nClaudeshop fingers 'malicious actor' in targeted supply-chain attack on Cursor\n\n[Anthropic](https://www.machinebrief.com/glossary/anthropic) has denied allegations that a malicious version of the official [Claude](https://www.machinebrief.com/glossary/claude) Code extension published to [Cursor](https://www.machinebrief.com/compare/github-copilot-vs-cursor)’s marketplace was linked to any kind of compromise of its own systems.\n\nThe company was forced to issue a statement after prominent figures in the cybersecurity industry alleged that the extension, which infected up to 5,000 developers, was uploaded to Cursor’s marketplace following a breach at Claudemaker Towers.\n\nFelix Rieseberg, a member of Anthropic’s technical staff, [Xeeted](https://x.com/felixrieseberg/status/2116170451466543578) today: \"We're working with Cursor on this incident, but it wasn’t a compromise of Anthropic's systems or employee laptops. \n\n\"A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish. The versions on our official channels are not affected, and this only impacts Cursor users.\"\n\nFirst spotted by EDR vendor [Phorion](https://phorion.io/blog/offical-claude-code-vsx-compromise/), an unknown party pushed an update to Cursor's official Claude Code extension for [Visual Studio Code](https://www.theregister.com/devops/2026/05/20/github-says-internal-repos-exfiltrated-after-poisoned-vs-code-extension-attack/5243206) that contained a persistent SSH backdoor written for Windows, macOS, and Linux.\n\nAccording to Cursor, the extension – version 2.1.313 – was available to download for around 11 hours between 0227 and 1335 PT (0927 and 2035 UTC) on Thursday.\n\nThe vendors' analyses of the implant revealed that it collected information about the host machine and user, including usernames, configured [Git](https://www.theregister.com/devops/2026/08/24/how-cursor-beat-gits-scalability-shortcomings/5291479) emails, and public IP addresses, as well as attempting to open a reverse SSH tunnel.\n\nCrucially, Cursor echoed Phorion's assessment that the package contained a critical flaw.\n\nThe script responsible for opening the SSH tunnel required admin rights on macOS and Windows to do so, and in the vast majority of cases it did not have these, resulting in failure.\n\nRegardless, the extension still forwards the collected host and user data to the attacker, as well as dropping the attacker's SSH key and installing the persistence mechanism, so developers must go threat hunting in case their instance allows for the SSH tunnel to be created successfully.\n\nSimply installing the latest version of the extension is not enough to clear the persistence mechanism, either.\n\nThe full details of how to remediate the issue, and links to download scripts to wipe the infection, are laid out in [Cursor's account of the situation](https://cursor.com/blog/claude-code-extension-security-notice).\n\nAside from Rieseberg's statement today, neither Cursor nor Anthropic have commented on how the malicious package made its way to the official marketplace.\n\nAnthropic's position is that a malicious actor uploaded the tampered copy to [Cursor](https://www.theregister.com/software/2026/01/22/cursor-shows-ai-agents-capable-of-shoddy-code-at-scale/4941616), but the latter has not outlined how it reached the marketpplace.\n\n\"[We] removed the malicious version from the marketplace immediately upon detection and blocked further distribution,\" Cursor said in the advisory. \"We followed with a full shutdown of the VSCode Marketplace out of an abundance of caution.\"\n\nIt also ran checks to confirm no other extensions were compromised in the same way, rotated its own keys before restoring the marketplace, and worked with a cloud hosting provider to block the connection to the attacker's server, it said. ®\n\nGet AI news in your inbox\n\nDaily digest of what matters in AI.", "url": "https://wpnews.pro/news/anthropic-that-claude-code-extension-compromise-couldn-t-be-us", "canonical_source": "https://www.machinebrief.com/news/anthropic-that-claude-code-extension-compromise-couldnt-be-u-ctru", "published_at": "2026-10-30 16:27:00+00:00", "updated_at": "2026-10-30 22:48:28.150167+00:00", "lang": "en", "topics": ["ai-tools", "ai-safety", "developer-tools"], "entities": ["Anthropic", "Cursor", "Claude Code", "Felix Rieseberg", "Phorion", "Visual Studio Code"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/anthropic-that-claude-code-extension-compromise-couldn-t-be-us", "markdown": "https://wpnews.pro/news/anthropic-that-claude-code-extension-compromise-couldn-t-be-us.md", "text": "https://wpnews.pro/news/anthropic-that-claude-code-extension-compromise-couldn-t-be-us.txt", "jsonld": "https://wpnews.pro/news/anthropic-that-claude-code-extension-compromise-couldn-t-be-us.jsonld"}}