Twelve Hours and Five Thousand Machines: The Claude Code Extension That Wasn't Anthropic's

Sometime on Thursday, a build of the Claude Code extension sitting in Cursor's marketplace stopped being the thing it claimed to be. Two versions — 2.1.312 and 2.1.313 — carried a persistent SSH backdoor. It stayed listed for nearly twelve hours. Cursor's own count of affected developers is "up to 5,000."

The details come from a cluster of security write-ups published within a day of each other: Step Security, Sophos, BleepingComputer, Microsoft's security blog, and Ars Technica, which framed the timeline most precisely. According to those reports, the tampered extension did what a backdoor is supposed to do — it opened a way in that survives a reboot, in this case via SSH. The Verge's summary of the incident notes that the payload collected hostnames, usernames and IP addresses.

That's the short version. The longer version is about what an extension marketplace is, and why this was always going to happen.

What was actually compromised

Not Anthropic's servers. Not the Claude model. A distribution channel.

Claude Code ships as a CLI and as editor extensions. Cursor runs its own marketplace for extensions, the same way VS Code does, and the listing in question was branded as the official Claude Code extension. For a developer browsing for "claude code" inside their editor, the listing looked right: right name, right icon, right description.

What ran on install was a trojanized build. The mechanism described in the reports is a persistent SSH backdoor — a modification that lets an attacker log into the machine later, over SSH, without needing the user to do anything else. For a developer laptop, that's close to the worst possible payload. It isn't a crypto miner that shows up in Activity Monitor. It's a quiet door.

Why developers are the ideal target

A compromised developer machine isn't just one laptop. It's a set of credentials with unusually wide reach: source code for private repos, CI tokens, cloud keys, database connection strings in a .env file that someone meant to clean up in March, SSH keys that trust each other across a fleet.

An SSH backdoor is specifically well-suited to that environment, because developer machines already run SSH, already have authorized_keys files, and already expect inbound connections from other machines. A new key in that file doesn't look anomalous in the way a new outbound connection to an unknown IP would.

Add the timing: Thursday, during a workday, in the middle of a launch cycle for a lot of teams. The window wasn't long, but twelve hours is enough for a few thousand installs if the listing is near the top of a search result.

The part nobody wants to say out loud

Extension marketplaces are not app stores in the sense that consumers understand them. They're closer to package registries. There's a review process, but it's oriented toward catching obviously malicious behavior at submission time, not toward continuously verifying that the publisher is still the publisher and the binary is still the binary.

This is not a Cursor-specific failure. It's the structural weakness of every ecosystem that lets third parties publish code that runs with full local privileges: npm, PyPI, VS Code extensions, browser extensions, and now the marketplaces that have grown up around AI coding tools. The attack surface isn't the model. It's the installer.

What made this case notable is the branding. An extension named after a well-known AI product, in a marketplace where most users are looking for that exact product, is a trust shortcut that's hard to defend against. The name does the social engineering.

What the response looked like

The listing came down, and Cursor published a user count. Security vendors published indicators. Anthropic, per the coverage, was not the party that shipped the bad build — the extension on Cursor's marketplace was a separate distribution channel from Anthropic's own.

That distinction matters for blame but not for risk. From a developer's perspective, "I installed the Claude Code extension from the marketplace inside my editor" is a single action, and the chain of custody behind it is invisible.

What to do this week

If you use Cursor, or any editor with a third-party marketplace, this is a good week to do three boring things.

First, list your installed extensions and check the publishers. Not the names — the publishers, and ideally the install source. Anything you don't recognize, remove it. Anything that duplicates functionality you already have from a first-party source, remove it.

Second, inspect ~/.ssh/authorized_keys on your development machines. You're looking for keys you don't recognize. On a laptop that only ever connects outward, that file is often empty or nonexistent, which makes an unexpected entry easy to spot.

Third, rotate the credentials that machine could reach. This is the expensive step, and it's the one people skip. If you can't rotate everything, rotate the things that would hurt most: cloud provider keys, package registry tokens, and anything with write access to a production repo.

For teams, add one more: pin extension versions and install from a reviewed list rather than letting individuals install whatever ranks well in search. That's a policy most teams already have for npm dependencies and almost none have for editor plugins.

Why nobody noticed for half a day

Twelve hours is not a long time in absolute terms, but it's a very long time in the life of a distribution channel. During that window the extension was installable, installable meant executable, and executable meant every developer who clicked install during a normal workday was potentially exposed.

The detection, notably, came from outside. Security vendors watching for suspicious behavior flagged it; the marketplace did not. That's not a knock on Cursor specifically — it's how these ecosystems work. Registries are optimized for availability, not for continuous behavioral monitoring of every artifact they host. The economics of scanning every update of every extension in real time are brutal, and the incentive to do it is weak until something breaks.

The recovery was faster than the detection. Listing pulled, advisories published, indicators shared. But the sequence matters: exposure first, explanation second. For anyone who installed during the window, the useful information arrived after the decision that mattered.

The uncomfortable takeaway

The AI coding tool category has spent two years competing on capability: context windows, agent loops, how many files the thing can edit without losing the plot. It has spent almost no time competing on supply chain integrity, because until now the threat model was "the model writes bad code," not "the extension is malware."

Five thousand machines and twelve hours is a small incident by the standards of the last decade of software supply chain attacks. It's also a preview. The next one will be an MCP server, or a skill package, or a plugin that a popular agent recommends by name. The pattern is the same: a trusted name, a distribution channel with light verification, and a payload that doesn't need to be loud.

The lesson isn't "don't use extensions." It's that "official" in a marketplace listing means approximately nothing, and the only defense that scales is treating editor plugins with the same suspicion you already apply to a random npm install from a package you've never heard of.