The world can feel particularly unsafe these days, with AI agents running rampant within private networks and billions of dollars disappearing from crypto wallets in less time than it takes to watch a sitcom episode.
But while the world was watching Binance’s massive crypto heist, another potentially consequential security breach was unfolding largely under the radar.
For roughly 11 hours, a malicious version of Anthropic’s Claude Code extension was available on Cursor’s VS Code extension marketplace. The extension—which allows developers to use Anthropic’s AI coding assistant within Cursor to write, edit, and debug software—had been tampered with to collect information about users’ computers and attempt to install a persistent backdoor. That backdoor used Secure Shell (SSH), a tool for remotely accessing computers, and could potentially have allowed hackers to access victims’ machines even after the extension was removed.
Cursor disclosed the breach in a blog post, saying it removed the compromised extension as soon as it discovered the problem. The company also emphasized that the mechanism intended to give hackers remote access was unlikely to have worked in many cases because of flaws in its code. Anthropic, meanwhile, said in a statement that the incident “only impacts Cursor users” and was unrelated to Anthropic’s own systems.
According to Cursor’s security notice, the malicious extension was designed to leave behind scripts that would attempt to reconnect to the hackers’ server every minute, even after the extension had been removed. Cursor says it has since worked with the server’s hosting provider to take the server offline and to temporarily shut down and rebuild its extension marketplace. The company found no evidence that other extensions were compromised. Still, it is urging anyone who installed the affected version on October 29 to check their computers for signs of infection, remove any unauthorized access, and consider changing potentially compromised credentials.
The hackers’ identities remain unknown, but security experts say the incident illustrates an increasingly troubling risk as AI coding tools become embedded in developers’ workflows.
“The scenario of Claude sending out poisoned agents everywhere makes me even more worried than I already was,” says Eerke Boiten, a professor of cybersecurity at De Montfort University in England.
Gwen van der Velden, a professor of education at the University of Warwick who’s working on a program to help rebuild Ukraine, says the choice of the Claude Code extension is particularly “interesting” given the potential for such tools to be exploited in hybrid warfare.
“We know from the Russian side, it is of great interest to them,” she says. “If you were to go for hybrid warfare, where you use this kind of technology, then actually getting 5,000 bits of malware reproducing itself through AI agents is a powerful thing.”
The broader concern isn’t simply that a malicious extension could compromise individual computers. It’s that the growing ecosystem of AI coding assistants and their associated tools is creating new pathways into sensitive systems.
“This is a classic example of how everyone has been focussing on LLMs attacking other systems, yet forgetting about the fact that LLMs and their associated tools are increasing the attack surface across some very sensitive IT estates,” says Alan Woodward, a professor of cybersecurity at the University of Surrey.
And even a relatively limited breach could carry outsized consequences when the targets are software developers with access to sensitive code and infrastructure.
“While 5,000 users might sound relatively small, these are developers who have access to highly sensitive systems and source code, so the potential impact will be far greater than the numbers suggest,” says Jake Moore, a threat adviser with the global cybersecurity firm ESET. “Software extensions have eased their way into many people’s workflows, but the concern is how easily trusted software extensions can become a vehicle for malicious code.”