Claude Code Extension Trojanized on Cursor: Inside the 11-Hour SSH Backdoor That Hit 5,000 Developers
Posted on 31st Oct 2026 11:05:22 in Artificial Intelligence, Machine Learning
Tagged as: Claude Code, Cursor, supply chain attack, SSH backdoor, Anthropic, developer security
A tampered build of Anthropic's official Claude Code extension sat in Cursor's marketplace for eleven hours on October 29, 2026, pushing a persistent SSH backdoor toward up to 5,000 developers. Anthropic denies its own systems were breached, and neither company has explained how the attacker got publish access.
