Poisoned Claude Code extension planted backdoors on thousands of developer machines

Security teams have uncovered a supply chain attack targeting software developers who use artificial intelligence tools. A poisoned version of Anthropic's Claude Code extension appeared on the Cursor marketplace and the Open VSX registry, affecting up to 5,000 developers before operators took it down.

Microsoft Threat Intelligence published technical guidance detailing how the malicious code worked. When a developer loaded the extension, it ran immediately without waiting for any user interaction. The script injected an unauthorised Secure Shell key into the local computer, turned on the machine's remote login features, and established an outbound connection back to an attacker-controlled server. It also gathered basic device details, user information and names of system environment variables that often store sensitive secrets.

Security firm Phorion noted that the payload established persistence on macOS, Windows, and Linux systems. On Apple computers, for example, it created a background startup file disguised as a standard system service. As a result, simply uninstalling the extension from an editor does not remove the backdoor.

Anthropic confirmed its internal systems were not breached, and official versions distributed through Microsoft's Visual Studio Marketplace and npm were clean. The tampered packages specifically targeted external marketplaces that serve alternative coding editors such as Cursor, Windsurf and VSCodium.

What this means for Australian businesses

Many Australian small and medium businesses rely on internal programmers or external contractors who have adopted AI coding assistants to build software faster. This incident shows that developer tools are now prime targets for corporate infiltration.

• Check developer setups. Ask internal technical staff and contractors whether they use alternative code editors such as Cursor or Windsurf, and check if they installed or updated Claude Code between 29 October and 30 October.
• Deleting the plugin is not enough. If someone installed the affected builds (versions 2.1.312 or 2.1.313), uninstalling the extension leaves the attacker's access keys and background services intact. Systems must be inspected manually to clear authorised keys and background jobs.
• Rotate business credentials immediately. Developer laptops frequently hold access tokens for corporate databases, cloud hosting accounts and customer databases. Treat any exposed laptop as fully compromised and change every shared password, API key and token accessible from that machine.
• Review software extension policies. Avoid allowing staff to install unofficial plugins or pull from open community registries onto work devices without review. Where possible, stick to official enterprise app stores and locked-down developer environments.