Anthropic Claude Code VS Code Extension Compromised: Persistent SSH Backdoor Installed

Summary:The official Anthropic Claude Code VS Code extension was compromised on the Cursor Marketplace, with attackers leveraging it to install a persistent SSH backdoor on infected hosts. This incident poses a significant security threat to users relying on Claude Code as a local LLM harness, highlighting potential vulnerabilities in AI toolchains.

---

Overview

The official Claude Code VS Code extension developed by Anthropic was compromised on the Cursor Marketplace. Attackers exploited the extension to install a persistent SSH backdoor on infected hosts, posing a significant security threat to users relying on Claude Code as a local LLM harness.

Technical Details and Impact

1. Attack Method: The attackers tampered with the Claude Code extension's code to implant a malicious SSH backdoor. This allows attackers to remotely access infected hosts and potentially steal sensitive data or execute other malicious operations.
2. Impact Scope: All users who downloaded and used the extension from the Cursor Marketplace may be affected. Anthropic has not disclosed the exact number of affected users, but it is recommended that all users immediately check and update their extension version.
3. Security Vulnerability Analysis: This incident exposes potential security vulnerabilities in AI toolchains, particularly in the lack of robust security review mechanisms when distributing software through third-party marketplaces.

Recommendations and Mitigation

1. Immediate Update: Users of the Claude Code extension should immediately check their version and update to the latest version to patch the vulnerability.
2. Security Review: It is recommended that AI tool developers strengthen security reviews of third-party marketplaces and implement stricter code signing and verification mechanisms.
3. User Education: Users should increase their security awareness, regularly check and update their software, and avoid downloading extensions from untrusted sources.

Future Outlook

This incident highlights the importance of security in AI toolchains. Anthropic and other AI companies need to strengthen security controls over software distribution to prevent similar incidents from occurring in the future. Additionally, users should remain vigilant and take necessary security measures to protect their systems.

---

Source: Reddit r/LocalLLaMA (2026-10-30)

— END —

Tags: #Anthropic Follow #Claude Code Follow #Security Vulnerability Follow #AI Toolchain Follow #Cybersecurity Follow