Anthropic Confirms Malicious Claude Code Extension Distributed Through Cursor

Anthropic has confirmed a security incident involving a maliciously modified version of its Claude Code extension that was distributed through the Cursor marketplace. The compromised versions were made available on October 29, 2026, and reportedly remained accessible for approximately 11 hours before being discovered and removed. According to security reports, the incident could have affected up to 5,000 users who downloaded the compromised extension. The development has raised fresh concerns about software supply-chain attacks, particularly as developers increasingly depend on third-party marketplaces to obtain coding tools, plugins and AI-powered extensions. Anthropic clarified that the malicious versions were not developed or distributed through its official channels.

The compromised extension reportedly contained malicious code designed to establish persistent remote access to affected computers. Security researchers found that the modified software attempted to install an attacker-controlled SSH key, enable local SSH access and create a reverse connection to an external server. SSH, or Secure Shell, is commonly used by developers and system administrators to access computers remotely. Although the technology itself is legitimate, attackers can abuse it to maintain unauthorised access to compromised machines. If successful, such access could potentially expose source code, development projects, stored credentials and other sensitive information. The incident is particularly concerning because developers often work with valuable intellectual property and access credentials for production systems.

Anthropic’s technical staff member Felix Rieseberg explained that the incident did not involve a compromise of Anthropic’s internal systems or employees’ computers. Instead, the attacker reportedly gained access to Cursor’s marketplace publishing infrastructure and used it to distribute the modified extension. Cursor subsequently removed the affected versions, identified as 2.1.312 and 2.1.313, from its marketplace. Anthropic also confirmed that extensions distributed through its official channels were not affected. The distinction is important because the incident involved an unauthorised modification of a legitimate product rather than a malicious update released directly by Anthropic.

The incident highlights the growing security risks associated with software supply chains. Developers frequently install extensions to improve productivity, automate coding activities and connect their development environments to external services. However, when attackers compromise a marketplace or publishing account, they may be able to distribute malicious software under the appearance of a trusted product. This makes it difficult for users to distinguish legitimate updates from dangerous modifications. Security experts therefore recommend downloading extensions only from trusted sources, checking publisher identities, reviewing unexpected permission requests and keeping development environments updated. Organisations should also monitor unusual SSH connections and investigate suspicious changes to authentication keys.

The latest incident adds to growing concerns about cybersecurity across the artificial intelligence industry, where AI coding assistants are becoming increasingly integrated into software development. Claude Code is designed to help developers write, analyse and modify code, making trust in its distribution channels particularly important. Although Anthropic says its official distribution channels were unaffected, the breach demonstrates that even established technology companies can face risks through external platforms and third-party infrastructure. Cursor and Anthropic have been working to address the incident, while affected developers are being encouraged to review their systems for signs of unauthorised access. The episode serves as a reminder that the security of AI development tools depends not only on the capabilities of their underlying models but also on the marketplaces, software packages and infrastructure through which they reach users.