Executive Summary
A malicious update to Anthropic's Claude Code extension was reportedly distributed through the Cursor Marketplace and attempted to install a persistent SSH backdoor. Organizations using AI coding tools, developer marketplaces, or AI agents should assess exposure to compromised extensions and updates.
What Happened
Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems. The malicious update, version 2.1.313, was distributed under the extension's legitimate publisher identity, prompting Cursor to temporarily shut
Affected Products
- Anthropic Claude Code extension
- Cursor Marketplace
- Claude Code
Vulnerability / Attack Technique
Trojanized software update with persistent SSH backdoor
Technical Mechanism
The malicious version, identified as 2.1.313, was distributed through the Cursor Marketplace as a legitimate update under the extension's legitimate publisher identity. The update attempted to install a persistent SSH backdoor on affected systems.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
AI agents and LLM applications often depend on extensions, plugins, package registries, and developer tools that can provide broad access to source code and host environments. A compromised AI development extension can therefore create a pathway from the AI tool supply chain to developer workstations and connected systems, making inventory, provenance verification, and least-privilege controls important.
Recommended Controls
- Maintain an inventory and software bill of materials for AI coding extensions, plugins, and agent dependencies.
- Verify extension publisher identity, package provenance, signatures, hashes, and release versions before deployment.
- Restrict AI development tools and extensions to approved allowlists and enforce controlled update channels.
- Run extensions with least privilege and isolate them from sensitive credentials, source repositories, and production systems.
- Monitor endpoint and network activity for unexpected SSH configuration changes, persistence mechanisms, and outbound connections.
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-31.