Claude Code Extension Compromised, Installing Persistent SSH Backdoor

On Friday, October 30 2026, cybersecurity researchers announced that the official Claude Code extension for Anthropic’s AI platform had been compromised on the Open VSX package registry. The attackers installed a persistent SSH back‑door on affected machines, allowing continued access even after initial indicators were removed ¹.

The breach was traced to the Cursor Marketplace, which Anthropic uses to distribute its coding extensions. In response, Cursor briefly shut down service to remove the malware and prevent further spread ¹. “We identified a security incident,” the team said in their statement.

This supply‑chain attack echoes earlier incidents such as the 2018 compromise of the Atom package registry, which caused widespread infections across open-source projects. It also recalls the SolarWinds Orion update hack in 2020, where malicious code was injected into software updates delivered to thousands of organizations. Developers often run with elevated privileges on systems they build, so an intrusion at this level can expose sensitive data or give attackers a foothold for later attacks.

A key concern is the persistence mechanism. By leveraging standard Secure Shell (SSH) traffic over TCP port 22, the back‑door operates within normal session protocols, making it difficult for traditional network anomaly detectors to flag. This technique mirrors tactics seen years ago from APT35, who employed Living‑off-the-Land binaries during Operation Clandestine Fox to infiltrate U.S. defense contractors and logistics firms. Attackers likely aim to exfiltrate confidential information or launch additional exploits once inside compromised machines.

The incident underscores the growing risk posed by third-party extensions in development environments. Even well-known platforms are vulnerable when their supply chains are breached. As developers increasingly rely on prebuilt modules, scrutiny around these tools must intensify. The Claude extension case serves as a reminder that security extends beyond core applications to every component integrated into a workflow.

Although no known data breaches have been reported yet, the potential for persistent access raises significant privacy concerns. If attackers gain long-term control over developer systems, they could harvest source code, credentials, or customer data stored within those environments. The industry may see increased adoption of runtime application self-protection (RASP) solutions and more frequent use of network segmentation to isolate critical services from general development workflows.

Ultimately, this event highlights how quickly a single vulnerability can cascade through an ecosystem, turning trusted tools into vectors for stealth intrusion. Developers, platform maintainers, and end users alike need to remain vigilant about where code originates and how it is deployed.