--- title: Backdoors in official Claude Code extensions | daily.dev description: The official Claude Code extension for Visual Studio Code and Cursor shipped with a backdoor that created a reverse SSH remote access trojan on developer... canonical: https://daily.dev/posts/backdoors-in-official-claude-code-extensions-kzegz0lci twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Backdoors in official Claude Code extensions | daily.dev og:description: The official Claude Code extension for Visual Studio Code and Cursor shipped with a backdoor that created a reverse SSH remote access trojan on developer... og:url: https://daily.dev/posts/backdoors-in-official-claude-code-extensions-kzegz0lci og:image: https://api.daily.dev/og/posts/kzegz0lci.png og:image:alt: Backdoors in official Claude Code extensions og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Backdoors in official Claude Code extensions **[Hacker News](https://daily.dev/sources/hn)** · 7 min read · 0 upvotes · 0 comments ## Summary The official Claude Code extension for Visual Studio Code and Cursor shipped with a backdoor that created a reverse SSH remote access trojan on developer machines. The affected VS Code extension has 29 million installs. Version 2.1.313 was the compromised release; Anthropic silently pushed 2.1.314 as a fix without disclosing an incident, according to Kevin Beaumont. The backdoor's C2 server collected hostname, username, OS, architecture, environment variables and Git email from victims, then opened a reverse SSH tunnel for hands-on-keyboard access. Beaumont says the 'fixed' versions don't remove existing backdoors, so every impacted system needs manual remediation. Cursor says about 5,000 developer systems were affected. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is the Claude Code extension for VS Code and Cursor compromised with malware? Yes, version 2.1.313 of the official Claude Code extension contained a backdoor that created a reverse SSH remote access trojan on macOS, Linux and Windows. It affected both the Visual Studio Code and Cursor marketplaces, and the extension has 29 million installs. Anthropic replaced it with version 2.1.314 but did not publicly disclose the incident. _Developers relying on Claude Code can track fast-moving supply chain security incidents like this on daily.dev._ ### Does updating to Claude Code extension version 2.1.314 remove the backdoor from an already infected machine? No, updating alone does not remove the prior backdoor or reconnaissance activity. The reverse SSH connection keeps calling out even after the auto-update, so every impacted VS Code and Cursor system needs manual remediation rather than relying on the patched version. _Teams patching compromised dev tools can follow remediation guidance threads like this via daily.dev._ ### What data did the attackers collect from machines compromised through the Claude Code extension backdoor? The command and control server collected the hostname, username, operating system, architecture, home directory path, environment variable names, working directories and configured Git email for each victim endpoint, then opened a reverse SSH tunnel giving attackers selective hands-on-keyboard access to chosen machines. _Developers assessing their exposure to dev-tool supply chain attacks can keep up with incident details on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 133 comments across hackernews, lobsters (as of 2026-10-30). **TL;DR:** The discussion is dominated by sharp criticism of Anthropic over the backdoored extension, mixing dark humor about AI coding tool hype with genuine alarm over supply-chain security, unclear scope across marketplaces, and confusion/distrust around Cursor's 'not developed by Anthropic' framing. **Sentiment:** 2% positive · 28% mixed · 70% skeptical **The pushback** - Many feel the incident undercuts claims that AI coding agents make development faster and more secure. - Commenters criticize the lack of extension signing/verification on Open VSX as enabling this kind of compromise. - Several see Cursor's statement that the extension 'was not developed by Anthropic' as disingenuous deflection. - There's confusion and distrust about which marketplaces (VS Code, Cursor, Open VSX) were actually affected, with incomplete official disclosure. - Some argue the 'fixed' versions don't remove existing backdoors, requiring manual remediation that most users won't do. - Concern that this reflects a broader pattern of supply-chain attacks the industry handles poorly. **By community** - hackernews (heated): A large, sprawling thread mixes sarcastic jabs at AI-coding hype with serious debate over attribution, scope across marketplaces, and how such a backdoor could ship undetected. - lobsters (skeptical): Smaller thread leans darkly humorous and distrustful, questioning the true scope of the compromise and speculating about CI/supply-chain weaknesses. **Hottest debate:** Whether the compromise was limited to the Cursor Marketplace/Open VSX or also touched the official VS Code marketplace, and what Anthropic's actual responsibility/knowledge was. **Open questions** - Which marketplaces (VS Code, Cursor, Open VSX) were actually compromised versus just rumored to be? - How did the malicious code get published — a compromised account, CI pipeline, or third-party dependency? - Is the reported link between this backdoor and the Binance crypto theft accurate? - Why does VS Code auto-update certain 'trusted publishers' instantly, bypassing normal update delays? **Highlights** > The original Phorion report really should be up here. It even details what exactly happened. So they simply added a ssh key to the authorized keys. https://phorion.io/blog/offical-claude-code-vsx-compromise/ > — [yubblegum on hackernews · 1 comments](https://news.ycombinator.com/item?id=50303141) > > Cursor: "This malicious version of the extension was not developed by Anthropic." Wtf does that mean. > — [yubblegum on hackernews · 9 comments](https://news.ycombinator.com/item?id=50302927) > OpenVSX has no extension signing, no verification, nothing... So really, there's no way to say what was compromised and where. This could have been avoided by having extensions signed by company doing them with their own keys and have them reviewed > — [AdrianCX on hackernews](https://news.ycombinator.com/item?id=50302952) > The 2.1.313 tag is missing from https://github.com/anthropics/claude-code/ too, in both `CHANGELOG.md` and as a git tag. This makes me think it might have been Claude Code's CI that was compromised > — [k0nserv on lobsters · 2 points, 1 comments](https://lobste.rs/s/ttp7aq/backdoors_claude_code_for_vs_cursor#c_pgtsn0) > It does. The compromised extension was published about 11 hours before Binance's coins went zoop, Binance blamed a compromised developer laptop, and OP pointed out that their hiring page explicitly notes developers will be using Cursor with Claude Code for "development efficiency". > — [anonymous908213 on hackernews](https://news.ycombinator.com/item?id=50303508) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50302334) · 331 points · 123 comments - [lobsters](https://lobste.rs/s/ttp7aq/backdoors_claude_code_for_vs_cursor) · 44 points · 10 comments ## Similar posts on daily.dev - [Security Flaws in Anthropic’s Claude Code Risk Stolen Data, System Takeover](https://daily.dev/posts/security-flaws-in-anthropic-s-claude-code-risk-stolen-data-system-takeover-j81sidgwk) · DevOps.com · 1 upvotes · 0 comments - [Claude's collaboration tools allowed remote code execution](https://daily.dev/posts/claude-s-collaboration-tools-allowed-remote-code-execution-jt8sizuec) · The Register · 0 upvotes · 0 comments - [Flaws in Claude Code Put Developers' Machines at Risk](https://daily.dev/posts/flaws-in-claude-code-put-developers-machines-at-risk-pkmhpix9s) · Dark Reading · 0 upvotes · 0 comments - [Using Claude to reduce the attack surface of code](https://daily.dev/posts/using-claude-to-reduce-the-attack-surface-of-code-7kvnh94yi) · Hacker News · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#anthropic](https://daily.dev/tags/anthropic), [#claude-code](https://daily.dev/tags/claude-code) [View this post on daily.dev](https://daily.dev/posts/backdoors-in-official-claude-code-extensions-kzegz0lci) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Backdoors in official Claude Code extensions","url":"https://daily.dev/posts/backdoors-in-official-claude-code-extensions-kzegz0lci","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/backdoors-in-official-claude-code-extensions-kzegz0lci"},"datePublished":"2026-10-30T11:55:51.516Z","dateModified":"2026-10-30T14:09:38.744Z","description":"The official Claude Code extension for Visual Studio Code and Cursor shipped with a backdoor that created a reverse SSH remote access trojan on developer...","image":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","thumbnailUrl":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/backdoors-in-official-claude-code-extensions-kzegz0lci","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,anthropic,claude-code","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Backdoors in official Claude Code extensions"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/backdoors-in-official-claude-code-extensions-kzegz0lci#faq","mainEntity":[{"@type":"Question","name":"Is the Claude Code extension for VS Code and Cursor compromised with malware?","acceptedAnswer":{"@type":"Answer","text":"Yes, version 2.1.313 of the official Claude Code extension contained a backdoor that created a reverse SSH remote access trojan on macOS, Linux and Windows. It affected both the Visual Studio Code and Cursor marketplaces, and the extension has 29 million installs. Anthropic replaced it with version 2.1.314 but did not publicly disclose the incident. Developers relying on Claude Code can track fast-moving supply chain security incidents like this on daily.dev."}},{"@type":"Question","name":"Does updating to Claude Code extension version 2.1.314 remove the backdoor from an already infected machine?","acceptedAnswer":{"@type":"Answer","text":"No, updating alone does not remove the prior backdoor or reconnaissance activity. The reverse SSH connection keeps calling out even after the auto-update, so every impacted VS Code and Cursor system needs manual remediation rather than relying on the patched version. Teams patching compromised dev tools can follow remediation guidance threads like this via daily.dev."}},{"@type":"Question","name":"What data did the attackers collect from machines compromised through the Claude Code extension backdoor?","acceptedAnswer":{"@type":"Answer","text":"The command and control server collected the hostname, username, operating system, architecture, home directory path, environment variable names, working directories and configured Git email for each victim endpoint, then opened a reverse SSH tunnel giving attackers selective hands-on-keyboard access to chosen machines. Developers assessing their exposure to dev-tool supply chain attacks can keep up with incident details on daily.dev."}}]} ```