Skip to content
Threat Feed
Subscribe
high advisory

Anthropic Claude VS Code extension malicious update distribution

An unknown actor compromised an official Anthropic distribution channel to push a malicious version of the Claude VS Code extension, enabling persistent SSH backdoors and credential theft on developer workstations.

Triage facts

Revision 1
Applicability
Claude Code Extension (v2.1.313), Cursor IDE +1
Evidence
Unknown
Severity
High
Action
Elevated
Sources
4 public sources
Freshness
Revision 1Oct 30, 22:04 UTC
Source quality
D3Roughly even chance

What's new

  • 1. added coverage for Claude VS Code Extension (2.1.313) Oct 30, 22:04 via ars-security

Between approximately 05:27 and 16:35 ET on October 29, 2026, a malicious version (2.1.313) of the Anthropic Claude VS Code extension was distributed via the official Cursor marketplace. The compromise was a supply-chain attack resulting from unauthorized access to Anthropic's distribution account. The malicious extension executed host reconnaissance, attempted to establish persistent SSH access, and exfiltrated environment variables and configuration files. Anthropic has since released version 2.1.314, though this update does not remove persistence mechanisms installed by the malicious 2.1.313 version.

Attack Chain

  1. Unauthorized access to the Anthropic official account on the Cursor extension marketplace.
  2. Publication of malicious extension version 2.1.313, superseding the legitimate 2.1.312 version.
  3. Automatic distribution to developer workstations configured for auto-updates.
  4. Execution of reconnaissance commands to collect host/user data and environment variable inventory.
  5. Attempted modification of SSH configurations (authorized_keys) and initialization of a reverse SSH tunnel.
  6. Persistence established via platform-specific mechanisms (LaunchAgents on macOS; scheduled tasks on Windows).
  7. Exfiltration of configuration and credential data via HTTP POST beacons on port 8099.

Impact

Up to 5,000 developers' workstations were potentially exposed. Confirmed impact includes local host information gathering, potential theft of cloud credentials and API tokens stored in environment variables, and unauthorized persistence via SSH and system-level scheduled tasks.

Recommendation

  1. Audit all developer workstations for the presence of the malicious extension version 2.1.313.
  2. If version 2.1.313 was present, perform a full forensic sweep; updating to version 2.1.314 does not remediate established persistence.
  3. Rotate all API keys, cloud credentials, and SSH keys present on affected developer machines.
  4. Check for unauthorized entries in ~/.ssh/authorized_keys (Linux/macOS) or Windows-equivalent SSH configurations.
  5. Inspect system-level persistence mechanisms, specifically checking for newly created LaunchAgents on macOS or suspicious scheduled tasks running as SYSTEM on Windows.
  6. Monitor network egress for HTTP POST traffic on port 8099.

Immediate actions

Inventory all developer workstations for Cursor IDE extension installations

SOC 24h

Identify all workstations where the Cursor Claude extension was updated on Oct 29, 2026.

IT Operations 4h

Force credential rotation for any secrets or tokens identified on affected developer machines.

Development Team 24h

Threat Hunt

Search for unauthorized modifications to SSH configuration files (~/.ssh/config) on developer endpoints

T1546.001 high high confidence hunt now

Data: File integrity monitoring logs, Endpoint audit logs for configuration changes

Monitor for newly created scheduled tasks or LaunchAgents related to development tools or unrecognized scripts

T1053.005 high high confidence hunt now

Data: Windows Scheduled Task creation logs, macOS LaunchAgent/LaunchDaemon directory monitoring

Identify unauthorized HTTP POST traffic to /beacon on port 8099 from developer endpoints.

T1071.001 high high confidence hunt now

Data: Network firewall/proxy logs

Identify unexpected LaunchAgent creation or modifications on macOS endpoints.

T1543.001 high high confidence hunt now

Data: EDR process creation/file events

Mitigations

Upgrade Cursor IDE to the latest version to patch browser-based arbitrary code execution

immediate IT Operations

Cursor browser RCE vulnerability

Verify and remove persistence artifacts (LaunchAgents/Scheduled Tasks) on all machines that had extension 2.1.313 installed.

immediate IT Operations

Persistence mechanisms