Trojanized Claude Extension Plants Persistent Backdoor on Thousands of Developer Machines

Software developers turning to artificial intelligence to speed up programming found themselves in the crosshairs of an acute supply chain compromise on October 29, 2026, when an official plugin for AI startup Anthropic was poisoned with a persistent remote access backdoor. The incident struck users of Cursor, the breakout AI code editor built on open source Visual Studio Code architecture, after a rogue build of the Claude Code extension was uploaded directly to the platform's extension marketplace^[1].

For roughly eleven hours, the malicious bundle masqueraded as an authentic update, reaching an estimated 5,000 developer machines before platform maintainers yanked it offline. The breach highlights the precarious trust assumptions underpinning modern development environments, where coding tools are routinely granted expansive filesystem privileges and network access.

Anatomy of the Malicious Extension

Security researchers at macOS security firm Phorion were among the first to detail the attack mechanism, tracking how the poisoned extension package, tagged as version 2.1.313, executed malicious code immediately upon launch. Unlike standard malware that relies on user prompts or interaction within the IDE interface, the payload fired the moment the editor host processed the script.

The injected prefix pulls in standard Node.js modules and executes as soon as Node loads the file, before the extension's normal activate callback even runs. The user doesn't need to interact with the extension for the payload to fire.

Calum Hall, CEO of Phorion

According to analysis from StepSecurity and security vendor Sophos, the payload executed a multi-stage intrusion^[1]:

• Harvested system reconnaissance data including hostnames, usernames, local environment variables, home directory paths, configured Git email addresses, and public IP addresses^[7].
• Appended an attacker-controlled public key, labelled under an telemetry identifier, into the user's local authorized keys configuration file.
• Attempted to activate the local SSH daemon and open a reverse shell tunnel to external command-and-control infrastructure.
• Configured boot persistence across major operating systems, deploying a fake Apple-branded LaunchAgent on macOS, a scheduled task on Windows, and crontab entries on Linux.

The Execution Error That Averted Disaster

Despite the sophisticated reach of the supply chain compromise, the attackers stumbled on local privilege boundaries, blunting the full impact of their remote access tool. In a technical advisory, Phorion observed that the malware's script attempted to query macOS remote login settings using administrative system tools that require elevated root permissions^[8].

When executed under a standard user account, the tool returned a permission error rather than standard status text. Because the malicious script's control logic was hardcoded to enable SSH only if the query explicitly reported the service as inactive, the error triggered a premature exit, preventing the local SSH daemon from turning on. Similar permission constraints limited automated enablement on Windows workstations^[6].

As Cursor clarified in an incident disclosure, the attacker could not achieve an active inbound shell on most machines unless the IDE had been launched with administrator permissions or the target had already enabled incoming SSH services. Cursor also stated that it partnered with the hosting provider behind the attacker's command-and-control server at IP address 134.209.82.225 to dismantle the infrastructure, terminating active tunnels and exfiltration endpoints.

Accountability and the Ecosystem Fracture

The incident ignited immediate friction over developer ecosystem security and account controls. VS Code extensions distributed through Microsoft's official Visual Studio Marketplace were entirely unaffected. However, Microsoft's licensing terms restrict third-party editor forks like Cursor and Windsurf from directly using the proprietary Microsoft marketplace, driving alternative editors to rely on third-party registries such as Open VSX or self-hosted distribution hubs.

In public statements, Anthropic distanced itself from the compromised code. An Anthropic representative confirmed that a malicious actor used unauthorized access inside Cursor's marketplace apparatus to push a forged package that Anthropic never compiled, signed, or released. To clear version confusion across downstream registries, Anthropic quickly issued clean release version 2.1.314 to restore clean states on official repositories^[5].

Nevertheless, independent security analysts at DoublePulsar cautioned that silence and fragmented marketplace moderation present severe systemic risks. Because IDEs often auto-update extensions silently in the background, thousands of developers consumed the payload without any manual prompt^[5].

Remediation and Ongoing Exposure

Security teams across enterprise environments are now auditing internal developer fleets. Cybersecurity firms warn that simply updating or uninstalling the Claude Code extension inside Cursor will not scrub machines clean. Once planted, the LaunchAgent plist files, registry keys, and altered authorized keys files remain entrenched on the disk.

Engineering departments whose workstations checked in during the active window are being instructed to conduct manual forensics, flush unauthorized keys from their SSH configuration files, delete scheduled persistence artifacts, and immediately rotate all cloud and repository tokens accessible from affected workstations.