Anthropic Claude
Malicious Claude Code extension on Cursor planted SSH backdoors
At a glance
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
There is no written leader briefing for this story yet. The summary below says what is known so far.
Next steps
Monitor- For awareness — no fixed action deadline for this reporting
No technical write-up beyond the summary below yet.
Next steps
Monitor- No immediate technical action — track if your estate depends on the products or vendors discussed
Summary
- A malicious version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for approximately 11 hours on 29 October, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors.
Read the original reportBleepingComputer(opens in a new tab)
Products and services involved
- Anthropic Claude88% match confidence
Pulse
Last change 30 Oct · Recheck overdue since 31 Oct 2026, 15:16 UK time
- Story30 Oct 2026, 15:16 UK time · 30 Oct
Linked reporting from BleepingComputer (independent original reporting).
Read source (BleepingComputer)
1 entry so far. The timeline chart appears once this story has more history.
Sources
- BleepingComputerNews
Malicious Claude Code extension on Cursor planted SSH backdoors
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
Malicious Claude Code extension on Cursor planted SSH backdoors
- ProbableSummary fact75% confidence
A malicious version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for approximately 11 hours on 29 October, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors.