Fake Anthropic Extension on Cursor Hit 5,000 Developers With SSH Backdoors
What happened
A malicious version of Anthropic's Claude Code tool was published to Cursor's developer marketplace on October 29, 2026. It remained available for approximately 11 hours before removal, according to reporting by Bleeping Computer. The extension installed software on affected machines that opened a persistent channel giving attackers remote access without any user action after installation. It also collected environment details including the Git email addresses, public network addresses, and names of variables commonly used to store API keys and cloud credentials. Up to 5,000 developers may have installed it during that window. Cursor responded by removing the extension and temporarily closing its marketplace for a security audit. It also rotated its own access keys but has not publicly explained how attackers were able to publish under Anthropic's identity. This incident follows a pattern of AI developer tool vulnerabilities, including a prior Claude Code flaw that let malicious files steal developer credentials without a click and the Plugin4Shell flaw that broke approved-plugin controls across four major AI coding agents.
Why it matters
- ·Developer machines are privileged entry points: they typically hold source code, cloud access keys, and deployment credentials that can reach production systems. A compromised developer machine is effectively a supply chain breach, not just a single workstation incident.
- ·Enterprises that maintain approved-tool lists for AI coding assistants face a structural control gap: if a marketplace cannot authenticate publisher identity, an approved vendor name offers no real protection. Governance programs that rely on curated marketplaces as a trust boundary need to revisit that assumption.
- ·The credential harvesting described mirrors the technique used in the LiteLLM supply chain attack that stole AI and cloud credentials. Specifically, attackers collected environment variable names linked to API keys and cloud secrets. Organizations that have not rotated credentials on affected developer machines face ongoing exposure even after the extension was removed.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
- Regulators, litigants, and attackers are all moving faster than most organizations' AI governance frameworks, shifting leverage away from deployers and toward those who can prove control, accountability, and honest disclosure.21 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Ask your security team to identify every developer who had Cursor installed between October 28 and October 30, 2026, and whether they installed or auto-updated any Claude Code extension during that window.
- ☐Rotate all API keys, cloud access credentials, and service account secrets stored as environment variables on machines belonging to developers who may have been affected, treating those machines as potentially compromised until confirmed otherwise.
- ☐Review your approved AI developer tool policy to determine whether it relies on marketplace publisher names as a trust signal, and if so, add a requirement for out-of-band verification before installation is permitted.
- ☐Ask your IT and security teams whether AI coding extensions installed on developer machines are subject to the same software inventory and change-detection monitoring as other privileged software, and close any gap.
- ☐Contact Cursor directly to ask what publisher identity verification controls exist in their marketplace, what the audit found, and whether they will notify affected users with specific remediation guidance.
What to watch next
Cursor has not yet disclosed how the attacker published an extension under Anthropic's identity. That explanation will be material for organizations assessing whether marketplace trust controls have been fixed or remain open. Enterprises should also watch for guidance from Anthropic on whether any of its own systems or signing credentials were involved. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services is directly relevant here. Regulators referencing that guidance may use incidents like this one to push for mandatory publisher verification standards in AI developer tool marketplaces. Watch also for follow-on incidents, as attackers who gained remote access to developer machines during the 11-hour window may not have acted immediately.