Hijacked Claude Code Extension Exposed Developers to Backdoor for 11 Hours

A tampered version of Anthropic's Claude Code extension sat on Cursor's VS Code marketplace for roughly 11 hours, collecting data on users' computers and attempting to install a persistent backdoor. Cursor disclosed the breach in a security notice and removed the compromised extension as soon as it discovered the problem.

The extension lets developers run Anthropic's AI coding assistant inside Cursor to write, edit and debug software. The malicious copy had been modified to gather information about victims' machines and to plant an SSH-based backdoor. SSH is a standard tool for remotely accessing computers. Cursor said the backdoor could potentially have given hackers access even after the extension was removed, though the mechanism was unlikely to have worked in many cases because of flaws in its code.

Anthropic responded quickly to distance itself. The company said in a statement that the incident "only impacts Cursor users" and was unrelated to Anthropic's own systems.

What did the malicious extension actually do?

According to Cursor's security notice, the tampered extension left behind scripts designed to reconnect to the hackers' server every minute, even after a user deleted the extension. That persistence mechanism is what turned a routine supply-chain incident into a potential long-term compromise.

Cursor has since taken several steps:

• Worked with the server's hosting provider to take the attackers' server offline
• Temporarily shut down and rebuilt its extension marketplace
• Found no evidence that any other extensions were compromised
• Urged anyone who installed the affected version on October 29 to check their computers for signs of infection, remove any unauthorized access, and consider changing potentially compromised credentials

The hackers' identities remain unknown. Security experts say the incident exposes a growing risk as AI coding tools embed themselves in developers' daily workflows.

Why does a hijacked coding extension matter?

The concern is not one compromised laptop. It is the attack surface that AI assistants and their tooling now create across sensitive IT estates.

"The scenario of Claude sending out poisoned agents everywhere makes me even more worried than I already was," said Eerke Boiten, a professor of cybersecurity at De Montfort University.

Alan Woodward, a professor of cybersecurity at the University of Surrey in the U.K., framed the mechanism plainly. "This is a classic example of how everyone has been focussing on LLMs attacking other systems, yet forgetting about the fact that LLMs and their associated tools are increasing the attack surface across some very sensitive IT estates," he said.

Gwen van der Velden, a professor of education working on a program to help rebuild Ukraine, called the choice of the Claude Code extension "interesting" given how such tools could be exploited in hybrid warfare. "We know from the Russian side it is of great interest to them," she said. "If you were to go for hybrid warfare, where you use this kind of technology, then actually getting 5,000 bits of malware reproducing itself through AI agents is a powerful thing."

Who was exposed, and how bad is it?

The number of affected users appears small by breach standards. The potential impact is not. Jake Moore, a cybersecurity expert at ESET, put the arithmetic in perspective. "While 5,000 users might sound relatively small, these are developers who have access to highly sensitive systems and source code so the potential impact will be far greater than the numbers suggest," he said. "Software extensions have eased their way into many people's workflows, but the concern is how easily trusted software extensions can become a vehicle for malicious code."

That is the mechanism worth watching. Developers trust extension marketplaces the way office workers trust app stores. One hijacked listing converts that trust into a delivery channel for malicious code aimed at the people who hold the keys to corporate source code and infrastructure.

The breach unfolded largely under the radar while the industry watched the Binance crypto heist drain billions from wallets in under half an hour. Cursor has rebuilt its marketplace and found no further compromises, but the attackers remain unidentified. Expect scrutiny of extension marketplaces for AI coding tools to intensify as these assistants become default infrastructure in software teams.