A tampered version of Anthropic's official Claude extension sat in the marketplace of the AI coding tool Cursor for about 11 hours on Thursday, October 29, reaching up to 5,000 users and attempting to install a persistent SSH backdoor on their machines, according to a Cursor security notice and reporting by Ars Technica. The malicious build, version 2.1.313, tried to add an attacker-controlled SSH key and open a reverse SSH tunnel, though bugs stopped it from working on some computers.
The most alarming detail is how it arrived. The tampered extension came through Anthropic's own verified account on Cursor, not an impostor. Cursor auto-updates extensions by default, so developers could have been infected without taking any action, and extensions run with the editor's permissions, giving them reach into local files, source code and developer tools. Anthropic pushed a clean version, 2.1.314, several hours later, but neither Anthropic nor Cursor has explained how the official account was compromised, and Anthropic has not publicly warned customers, Ars Technica reported.
Developers who installed or updated the Claude extension in Cursor between 5:27 a.m. and 4:35 p.m. Eastern time on Thursday should check whether they received version 2.1.313 and compare their systems against the indicators of compromise, including IP addresses and file hashes, published by Cursor and the security firm Phorion. Because the window was short and the backdoor often failed, the number actually compromised may be well below the 5,000 who were exposed.
The episode is a supply-chain attack of a familiar kind, a trusted software channel turned against its users, but aimed at a new and sensitive target: the AI coding assistants that now sit inside developers' editors with broad access to their work. It arrives alongside a second, unrelated incident that points at the same expanding attack surface from the opposite direction. Wired reported that a contractor at the consulting firm Accenture connected a personal Claude Code account to a secure Department of Defense network used by multiple intelligence agencies.
According to Wired's sources, the Claude Code agent sent information about that system and login credentials to a high-risk third-party website, and ran inside the Defense Department network for two months before anyone noticed. The system holds sensitive unclassified information that, combined, could amount to classified material. Accenture said the allegations were investigated and found to be without merit, and the Defense Department said it does not comment on the status of its networks. Wired's reporters stressed they do not know that anything malicious was intended; the contractor appeared to be trying to write and deploy code.
Taken together, the two incidents show the two ways agentic coding tools now widen risk. One is the software channel itself, where a single compromised publisher account can push code that auto-installs with an editor's full privileges. The other is routine misuse, where an engineer used to agents logging in, committing code and reaching the open internet connects one to a place it should never touch. How the Cursor account was breached, and whether the Defense Department incident was benign, both remain unresolved.