Critical impact
Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
What happened
Phorion discovered a backdoor in the official Claude Code for VS Code extension hosted on the Cursor Marketplace. The compromised extension bundle drops a persistent SSH backdoor on macOS, Linux, and Windows, with the write‑up focusing on macOS persistence logic.
Why it matters
Because extensions run with the IDE and user’s permissions, the backdoored extension can immediately access local files, source code, and developer tools, prompting organizations to check for versions 2.1.312 or 2.1.313 and respond if found.
Is this a big deal?
Get stories like this every morning
The day's AI news in plain English, in your inbox at 8:30 IST. Free.
More from Anthropic
Anthropic Upgrades Claude Code Projects to Run Parallel AI Workers Hands-FreeAnthropic · 14 Nov 2026Claude designed FPGA scaler board for 6th-gen consolesAnthropic · 13 Nov 2026I asked Claude Fable 5.2 to turn my site into a 90s Silicon Graphics workstationAnthropic · 13 Nov 2026Anthropic is endorsing SB 53Anthropic · 13 Nov 2026Understanding and addressing AI harmsAnthropic · 13 Nov 2026This page was collected from phorion.io and summarised automatically by AIPulsee's pipeline. See how it runs.