Anthropic Claude Code Extension Security Incident: What You Need to Know

Incident Overview

On October 30, 2026, security researchers identified a supply chain attack targeting developers using the Claude Code extension. A malicious version of the extension (version 2.1.313) was published to the Cursor marketplace, which automatically updated thousands of developer environments. This malicious code established a persistent remote access trojan (RAT) by injecting an attacker-controlled SSH key into the user's ~/.ssh/authorized_keys file, granting the threat actor command-line access to the host machine.

Scope and Impact

The incident primarily affected users of the Cursor IDE, which maintains its own extension marketplace. While initial reports suggested a broader compromise of Anthropic's official infrastructure, Felix from Anthropic clarified that the company's systems were not breached. Instead, the actor leveraged unauthorized access to the Cursor marketplace to distribute the tampered extension. Approximately 5,000 developer systems are estimated to have been impacted. The malicious payload performed reconnaissance, collecting hostnames, usernames, OS details, home directory paths, environment variables, and configured Git emails before establishing a reverse SSH connection.

Remediation and Security Recommendations

Because the malicious extension modified system-level SSH configurations, simply updating to the patched version (2.1.314) does not automatically remove the backdoor or the attacker's access. Affected users must manually audit and remediate their systems.

Security experts recommend the following steps for potentially impacted machines:

• Isolate the system: Disconnect the affected machine from all networks and remove known Wi-Fi connections.
• Manual cleanup: Inspect ~/.ssh/authorized_keys for unauthorized public keys and remove them. Ensure directory permissions are correctly set to 0700 and file permissions to 0600.
• Rotate credentials: Assume all API keys, tokens, and active sessions on the machine are compromised. Rotate all secrets, including Git credentials, cloud provider keys, and service tokens, from a known-clean machine.
• Verify integrity: Given the nature of the persistence, a full wipe and re-image of the development environment is the only way to ensure complete eradication of the threat.

Industry Implications

This incident highlights the fragility of modern development workflows that rely on automated extension updates. The ease with which a supply chain attack can gain remote access to developer environments has prompted renewed calls for stricter security practices.

"Development must occur in an isolated VM, with no access to the publishing workflow. CI operations must happen in a separate VM or on the host system after scanning all files. Thus, even if the development tools are compromised, the impact is limited."

Developers are encouraged to treat IDE extensions with the same level of scrutiny as any other third-party software, as these tools often operate with high-level permissions on the host system.