Cases › security breach › LR-2026-0281
Backdoored Anthropic Claude VS Code extension on Cursor marketplace (v2.1.313) installs SSH backdoor for up to 5,000 developers
Preliminary Why: 1 report: Ars Technica · subject to change · 1 independent report
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Severity major: A live production compromise of up to 5,000 users who downloaded the backdoored extension from the Cursor Marketplace.
Earliest source we hold 2026-10-30 · Captured by AI Risk Wire 2026-10-31 01:31 UTC
A malicious version 2.1.313 of Anthropic's official Claude Code VS Code extension was posted to the Cursor Marketplace and was downloadable for about 11 hours, reaching at most 5,000 users.
Risks this incident falls under
| Risk | Role | NIST AI 600-1 | Incidents | Last 6 quarters |
|---|---|---|---|---|
| Supply-chain compromise | Primary | Value Chain and Component Integration | 9 | |
| AI used to run a cyber attack | Also | Information Security | 25 | |
| AI system attacked or breached | Also | Information Security | 1 |
Sorted by rule from the case's fields; not yet read from the sources.
Control failure chain
L1 · ModelProvider not namedModel provider
Sources not yet read for controls.
Model version not linked to a model card.
L2 · HarnessHarness not namedAgent framework vendor
Sources not yet read for controls.
1 more for this risk at this layer
L3 · ApplicationDeployer not namedDeployer
Sources not yet read for controls.
6 more for this risk at this layer
L4 · Infrastructure / targetOrganisation hitOrganisation hit
Sources not yet read for controls.
1 more for this risk at this layer
HeldFailedGot aroundMissingNot mentionedNot read yetAttacker's ownOrder: model · harness · application · target
The same controls in other incidents of this risk
| Control | Layer | Here | Held elsewhere | Did not hold elsewhere |
|---|---|---|---|---|
| Sandboxed code execution | L2 Harness | Not read yet | – | – |
| Least-privilege access for the agent | L3 Application | Not read yet | – | 1 |
| Signed and verified components | L3 Application | Not read yet | – | – |
| AI bill of materials | L3 Application | Not read yet | – | – |
| Vetting of plug-ins, skills and dependencies | L3 Application | Not read yet | – | – |
| Vulnerability scanning of AI components | L3 Application | Not read yet | – | – |
| Model provenance checks | L3 Application | Not read yet | – | – |
| Secrets scanning | L4 Infrastructure / target | Not read yet | – | – |
Remediation
Fix reported
“Marketplace taken down and reviewed, attack server taken offline with the cloud provider, marketplace reinstated, users contacted, instructions published, and Anthropic issued version 2.1.314 omitting the malicious code.”
No later incident for Anthropic under this risk on record.
Risk grouping: Not yet classified
No source we hold states: who caused it, intended or not, before or after release, the ai's part.
The story
What the sources state
- Other parties affected 5,000
No source states: when it happened, when it was found, how many records were exposed, the direct loss, any court case, the cause, what set it off.
Others like this
CyberXero AI-augmented initial access campaign using Claude Code and PentAGI agents 2026-10-12
Aur0ra hackers use Cursor AI agent to breach Belgian chemical firm and at least six other companies 2026-09-01
AI-assisted exploitation of PHP2Shell and Fragnesia flaws to breach 25 servers across four countries 2026-10-29
Show every field, with its source and grade
The AI system
What happened
Impact
Context
Notes on gaps
UTC Thursday) and computed by the pipeline.
LR-2026-0281 · version 2 · published 2026-10-31 after automatic checks; not yet checked field by field by a person · changes to this case · JSON