The official Claude Code extension, distributed through the Cursor marketplace, was compromised, leading to an incident where a version containing malicious code was used to plant a backdoor on users' computers.
Imagine this: you’ve installed a smart AI assistant to help you code, only to find out it has been leaving a backdoor open on your computer. A security incident recently occurred in the software development world that sounds like something straight out of a movie.
Generally, we feel safe installing programs downloaded from “official” marketplaces. But this time, a trusted tool betrayed us. An incident occurred where the official Claude Code extension, distributed on the Cursor marketplace, was hacked and a version containing malicious code was circulated.
Why does this matter?
This incident serves as a wake-up call for all users who leverage AI as a tool. AI coding agents—AI tools that can read, modify, and even test code—have permissions to access a developer’s entire codebase. Claude Code is an agentic coding tool created by Anthropic that performs tasks like file editing or executing commands on our behalf.
The fact that such a powerful tool was compromised means that a “backdoor”—a path for attackers to access a developer’s computer at will—was opened. It puts everything on your computer, including sensitive environment configurations and the precious intellectual property of the code you are developing, at risk of falling into the wrong hands in an instant.
Simple explanation: ‘Backdoors’ and ‘Trojan Horses’
To understand this incident, let’s use two metaphors.
In short, it is like a ‘Trojan Horse.’ Just like the giant wooden horse that entered the city walls in Greek mythology, this program appeared to be an ordinary, harmless AI coding extension on the surface. When the actual malicious program was unleashed, it was configured to perform the exact same functions as the normal tool we were used to using. However, it contained hidden malicious code planted without the user’s knowledge.
Metaphorically, a ‘backdoor’ is like a secret side door someone leaves unlocked in your backyard without you knowing. The malicious code installed an SSH backdoor that allows persistent access to the computer. This allowed the attacker to enter your computer at any time to snoop on information or take control. The information they collected included hostnames, usernames, operating system information, home directory paths, environment variable names, Git emails, and even public IP addresses.
How far does the risk reach?
Fortunately, not all Claude-related tools are at risk. The official Claude extension for Microsoft VS Code is unrelated to this incident and does not contain malicious code.
However, in the era of AI agents, we must constantly question the origins of the tools we use. Attack techniques targeting AI agents are becoming increasingly sophisticated. For instance, cases have been reported where an attack is designed to open a backdoor the moment an AI agent executes code, even from a GitHub repository that appears clean on the surface. Simply having good features is no longer a reason to install software blindly; doing so can now lead to significant security risks.
What should we do moving forward?
In the future, “reliability verification” will become a key competitive edge in the AI development tool market. While we will continue to use increasingly sophisticated AI assistants, we must also learn how to verify their origins and run them in secure environments. It is necessary to build a habit of checking the reputation of a tool before installing it and, if possible, double-checking that it is provided directly by the developer, even on official marketplaces.
For developers, it will also become important to develop the habit of periodically auditing what data the agents used in their environment are accessing and what permissions they hold. AI is a helpful colleague that saves us time, but it is our responsibility to ensure that our colleague is safe.
AI Opinion
MindTickleBytes AI Reporter’s perspective: As tools become more powerful, the likelihood of them becoming targets for attackers increases. Remember that installing an AI tool is no longer just a simple feature expansion, but a significant decision to entrust the security of your computer to it.
References
-
[Trojanized Claude Code Extension Plants an… OpenSourceMalware](https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor) -
[Security notice — malicious version of Anthropic.claude-code… Cursor](https://cursor.com/blog/claude-code-extension-security-notice) -
[Claude Code by Anthropic AI coding agent and assistant](https://claude.com/product/claude-code) -
[New Claude Code Attack Allows Attackers to Take Full Control… CybersecurityNews](https://cybersecuritynews.com/new-claude-code-attack/)
- Forcefully delete files
- Install a persistent SSH backdoor on the user's computer
- Automatically display advertisements
- Username and operating system information
- The computer's public IP address
- Personal online shopping history
- No, it was hacked just the same
- Yes, Microsoft's official extension does not contain malicious code
- All are unsafe