Hackers hijacked a Claude Code extension, exposing yet another new AI security risk

A tampered version of Anthropic's Claude Code extension was available on Cursor's VS Code extension marketplace for roughly 11 hours, Cursor disclosed in a blog post, after hackers modified it to collect information about users' computers and attempt to install a persistent SSH backdoor that would reconnect to their server every minute even after removal. Cursor said it removed the compromised extension, worked with the server's hosting provider to take the server offline, temporarily shut down and rebuilt its marketplace, and found no evidence other extensions were compromised, while Anthropic said the incident "only impacts Cursor users" and was unrelated to its own systems. Cursor urged anyone who installed the affected version on October 29 to check their machines for signs of infection and consider changing potentially compromised credentials, as security experts including University of Surrey professor Alan Woodward warned that LLMs and their associated tools are "increasing the attack surface across some very sensitive IT estates.

The world can feel particularly unsafe these days, with AI https://www.fastcompany.com/section/artificial-intelligence agents running rampant within private networks https://chatgpt.com/c/6ae4d37b-4cf0-83ea-8d50-84432f6e91ee and billions of dollars disappearing from crypto wallets https://www.fastcompany.com/91632923/binance-hack-today-historic-attack-rattles-crypto-bitcoin-price-falls in less time than it takes to watch a sitcom episode. But while the world was watching Binance’s massive crypto heist, another potentially consequential security breach was unfolding largely under the radar. For roughly 11 hours, a malicious version of Anthropic’s Claude Code extension was available on Cursor’s VS Code extension marketplace. The extension, which allows developers to use Anthropic’s AI coding assistant within Cursor to write, edit, and debug software, had been tampered with to collect information about users’ computers and attempt to install a persistent backdoor. That backdoor used SSH, a tool for remotely accessing computers, and could potentially have allowed hackers to access victims’ machines even after the extension was removed. Cursor disclosed the breach in a blog post https://cursor.com/blog/claude-code-extension-security-notice , saying it removed the compromised extension as soon as it discovered the problem. The company also emphasized that the mechanism intended to give hackers remote access was unlikely to have worked in many cases because of flaws in its code. Anthropic, meanwhile, said in a statement https://x.com/search?q=cursor&src=typed query that the incident “only impacts Cursor users” and was unrelated to Anthropic’s own systems. According to Cursor’s security notice https://cursor.com/blog/claude-code-extension-security-notice , the malicious extension was designed to leave behind scripts that would attempt to reconnect to the hackers’ server every minute, even after the extension had been removed. Cursor says it has since worked with the server’s hosting provider to take the server offline, temporarily shut down and rebuilt its extension marketplace, and found no evidence that other extensions were compromised. Still, the company is urging anyone who installed the affected version on October 29 to check their computers for signs of infection, remove any unauthorized access, and consider changing potentially compromised credentials. The hackers’ identities remain unknown, but security experts say the incident illustrates an increasingly troubling risk as AI coding tools become embedded in developers’ workflows. “The scenario of Claude sending out poisoned agents everywhere makes me even more worried than I already was,” says Eerke Boiten, a professor of cybersecurity at De Montfort University. Gwen van der Velden, a professor of education working on a program to help rebuild Ukraine, says the choice of the Claude Code extension is particularly “interesting” given the potential for such tools to be exploited in hybrid warfare. “We know from the Russian side it is of great interest to them,” she says. “If you were to go for hybrid warfare, where you use this kind of technology, then actually getting 5,000 bits of malware reproducing itself through AI agents is a powerful thing.” The broader concern isn’t simply that a malicious extension could compromise individual computers. It’s that the growing ecosystem of AI coding assistants and their associated tools is creating new pathways into sensitive systems. “This is a classic example of how everyone has been focussing on LLMs attacking other systems, yet forgetting about the fact that LLMs and their associated tools are increasing the attack surface across some very sensitive IT estates,” says Alan Woodward, a professor of cybersecurity at the University of Surrey in the U.K. And even a relatively limited breach could carry outsized consequences when the targets are software developers with access to sensitive code and infrastructure. “While 5,000 users might sound relatively small, these are developers who have access to highly sensitive systems and source code so the potential impact will be far greater than the numbers suggest,” says Jake Moore, a cybersecurity expert at ESET. “Software extensions have eased their way into many people’s workflows, but the concern is how easily trusted software extensions can become a vehicle for malicious code.”