Claude Code backdoor

Malicious Claude Code Extension Distributed via Cursor Marketplace, SSH Backdoors Exposed

A malicious version of Anthropic's Claude Code visual studio code extension was distributed through Cursor's extension marketplace for approximately 11 hours on October 29, 2026. The compromised extension was designed to install persistent SSH backdoors on developer machines, potentially exposing development environments and connected systems. Both Anthropic and Cursor are working to remove the malicious listing and distribute clean versions.