Trojanized Anthropic Claude VS Code Extension Targeted Up to 5,000 Developer Machines with Reverse SSH Tunnels

Anthropic's official VS Code extension on the Cursor marketplace was compromised with malicious code for nearly 12 hours before being removed.

A backdoor sat inside a verified, official-looking software extension for nearly half a day — and thousands of developers may have downloaded it without knowing. Attackers injected malicious code into Anthropic's Claude Code extension on Cursor, a popular AI-focused code editor built on VS Code, where the listing carried Cursor's verified publisher badge. The compromised version was live for approximately 12 hours before it was identified and taken down. Security firm Morphisec has since issued a critical advisory confirming the extension was trojanized and designed to plant SSH backdoors on developer machines, with up to 5,000 developer endpoints potentially targeted. The malicious build was distributed through both the Cursor marketplace and Open VSX, broadening the potential exposure beyond what was initially reported. Additional technical analysis confirms the malicious extension performed host reconnaissance on infected machines and attempted to establish a reverse SSH tunnel, which would have granted attackers persistent, stealthy remote access to compromised developer systems. Anthropic's extension is used by developers to integrate the company's Claude AI models directly into their coding environment, making it a high-value target for supply chain attacks. The method by which attackers gained access to Anthropic's verified Cursor publisher account remains unknown. Gaining control of a verified account is significant because it lends the malicious package an air of legitimacy — users and automated systems are less likely to flag or scrutinize extensions from publishers that have passed a verification process. The incident is a textbook software supply chain attack, where adversaries target the distribution pipeline of trusted software rather than end-user systems directly. Developers who downloaded or updated the extension during the roughly 12-hour window were potentially exposed to SSH backdoor implants that could grant attackers persistent remote access to their machines. The breach raises questions about how marketplace verification processes can be hardened, and how quickly publishers and platform operators can detect and respond when a trusted account is silently compromised. The full number of users who downloaded the malicious version has not been publicly confirmed.

Why it matters

Supply chain attacks targeting developer tools are especially dangerous because they can expose not just individual machines but entire codebases and downstream applications built by affected developers. A verified-badge compromise undermines one of the primary trust signals users rely on in software marketplaces.

What's next

It remains to be seen whether Anthropic or Cursor will disclose how the verified account was accessed, how many users were affected, and what the malicious payload was designed to do.

Key facts

Bias & framing notes

Only a single source — Ars Technica — is available for this story. While Ars Technica is a reputable technology outlet with strong reporting on security topics, the story itself notes that key facts (attack vector, payload details, affected user count) remain unknown, limiting confidence in the full picture. The score reflects a credible single outlet reporting on a real, specific event, tempered by significant unresolved gaps in the available information.

NewsClear — neutral news & congressional tracking · Bill of the Week