A Popular Claude Extension Hid a Secret Backdoor

A popular Claude AI coding extension was compromised to install a persistent SSH backdoor, giving attackers full access to developers' machines.

Cybersecurity researchers discovered a malicious version of the official Anthropic Claude Code extension for VS Code, as reported by The Hacker News. The compromised extension was distributed through the Open VSX registry, a popular open-source alternative to Microsoft's official Visual Studio Marketplace. Investigators found that the tampered software was designed to install a persistent SSH backdoor on any machine where it was installed. The incident was later traced back to a security breach at the Cursor Marketplace, an AI-native code editor platform. In response, Cursor briefly took its service offline to identify and remove the malicious code, confirming that its own systems had been compromised, leading to the distribution of the malware.

This attack exploited the trust developers place in their tools. The malicious extension worked by creating a persistent backdoor using Secure Shell (SSH), a standard protocol for secure remote access. Once installed, the malware would likely add an attacker-controlled public SSH key to the user's `authorized_keys` file. This action grants the attacker passwordless, remote access to the developer's machine. This access persists across reboots and can be difficult to detect for those not actively monitoring their SSH configurations. With this level of access, an attacker could steal source code, API keys, and other sensitive credentials stored on the machine. They could also use the compromised computer as a pivot point to move deeper into a company's internal network, escalating a single developer's infection into a major corporate breach.

This incident is a classic example of a software supply chain attack, a threat that has become increasingly common in recent years. Attackers are shifting their focus from targeting companies directly to compromising the third-party software and tools that companies trust and rely on. Developers are particularly high-value targets because of their privileged access to critical systems and intellectual property. We have seen similar attacks targeting popular package repositories like npm and PyPI, but this incident highlights a newer, growing attack surface: AI-powered coding assistants. As these tools become more integrated into daily developer workflows, they also become more attractive targets for malicious actors seeking to infiltrate secure development environments. The use of a third-party registry like Open VSX also underscores the varying security levels across different software distribution platforms.

For engineering and security leaders, this event serves as a critical reminder to enforce strict security hygiene for developer tooling. Teams should be cautious about the extensions and plugins they install, especially from unofficial or third-party marketplaces which may have less rigorous security vetting processes than official ones. It is essential to have policies that favor well-vetted tools from trusted sources. Additionally, organizations should implement endpoint monitoring to detect suspicious activities, such as unexpected modifications to critical system files or unusual outbound network connections. Moving forward, the security of AI development tools and their distribution channels will become an even more critical area of focus. We can expect to see platform owners like Microsoft, Open VSX, and Cursor invest more in security scanning and verification to rebuild trust and prevent similar attacks.

This supply chain attack turns a trusted AI coding assistant into a direct threat. It demonstrates how attackers can compromise developer environments through popular extensions, gaining persistent remote access to source code, credentials, and internal networks, bypassing traditional security perimeters.

A compromised developer machine is a gateway to a full corporate breach. This attack vector can lead to intellectual property theft, customer data exposure, and significant financial and reputational damage. It forces companies to re-evaluate the security risks of third-party developer tools.