Claude Code VS Code extension with backdoor released on Cursor marketplace
- ID
- 41226
- Status
- summarized
- Published
- 30 Oct 2026, 6:22 PM
- Fetched
- 30 Oct 2026, 11:40 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2
- Source URL
- https://hnrss.org/best
Summary
- Score
- 9.2
- Created
- 30 Oct 2026, 11:40 PM
- Tags
- Audience
- developersvibe_codersai_agent_userssaas_founders
What happened
Version 2.1.313 of the official Claude Code for VS Code extension, distributed through the Cursor Marketplace, shipped with malicious code that auto-updated onto developer machines: it collected hostname, username, OS, architecture, home directory, environment variable names, working directories, configured Git email and public IP, then tried to append an attacker-controlled key to authorized_keys, enable local SSH and open a reverse SSH tunnel. Persistence was attempted via a macOS LaunchAgent or a Windows scheduled task running as SYSTEM with a Startup-script fallback, retrying the tunnel roughly every 60 seconds. Cursor says around 5000 developer systems were impacted and that the SSH step would fail outside unusual cases where Cursor was started with administrator privileges; Phorion detected the activity first, Anthropic replaced 2.1.313 with 2.1.314 about 8 hours before the write-up and silently deleted the bad version without notifying customers, and Beaumont notes 2.1.314 does not remove a backdoor or prior recon artifacts from already-infected machines.
Why it matters
If anyone on your team runs Claude Code inside Cursor, treat this as an incident response task today, not a news item: grep ~/.ssh/authorized_keys for keys you did not add, check macOS LaunchAgents and Windows scheduled tasks on those laptops, and look for outbound SSH tunnels retrying every ~60 seconds. Because 2.1.313 was silently pulled and customers were reportedly not notified, you cannot wait for a vendor email — and because 2.1.314 only cleans the extension package, you have to decide whether to rotate SSH keys and credentials on any machine that ran the auto-updated 2.1.313. It also settles an argument for your team: auto-update on IDE extensions is remote code execution with your dev credentials attached, so pin extension versions in any shared or high-privilege environment.
Discussion angle
Your editor marketplace is a supply chain you don't control — walk through what an inventory of auto-updating extensions would look like for a small Malaysian team, and whether anyone here would have noticed a new key in authorized_keys without this article.