Anthropic's official Claude Code extension for Visual Studio Code and Cursor shipped with a backdoor that installed a persistent reverse SSH trojan on developer machines, according to security researcher Kevin Beaumont, writing on Mastodon as @GossiTheDog. The compromised build, version 2.1.313, was pulled from distribution and replaced with 2.1.314, which Beaumont says he has confirmed does not remove the existing backdoor or halt the reconnaissance activity already running on infected machines.
The extension is one of the most popular in the DevOps category, with what Beaumont describes as millions of installs, and because it auto-updates, he says every organization running it will have received the malicious version. Phorion, a macOS endpoint detection and response vendor cited in Beaumont's post, says it detected a backdoor in the official Claude Code extension bundle on Open VSX that drops a persistent SSH backdoor across macOS, Linux and Windows. Cursor's own security notice, also linked in Beaumont's thread, names the affected package as Anthropic.claude-code version 2.1.313 in the Cursor extension marketplace. A separate write-up from opensourcemalware.com, also cited by Beaumont, describes a loader embedded in 2.1.313 that executes ahead of the extension's real code, adds an attacker-controlled key, opens a reverse tunnel, and establishes persistence.
Beaumont describes the mechanism as a classic supply-chain attack: the threat actor gained reverse SSH command-line connectivity into Anthropic customer environments at scale, with the operator able to selectively pick which compromised endpoints to access interactively. According to Beaumont, the attacker's command-and-control server collected, for every victim machine, the hostname, username, operating system, architecture, home directory path, environment variable names, working directories and configured Git email address before establishing the reverse SSH channel. He reports that the C2 server is now offline, but says that does not undo the access or persistence already planted on affected systems.
There is no patch-and-move-on fix here, by Beaumont's account: he states that the replacement versions Anthropic published overnight, which arrive via the same auto-update mechanism, still leave the prior backdoor and reconnaissance tooling intact, meaning SSH connections keep calling out even after the update lands. His recommendation, repeated in the thread, is that every impacted VS Code and Cursor installation needs manual remediation rather than reliance on the automatic update path. He also reports having confirmed that Binance runs Claude Code on Cursor with the affected extension, and says Anthropic has not commented publicly and that its account managers are also not responding to inquiries.
There is disagreement in the replies to Beaumont's thread over exactly which marketplaces were affected: one commenter notes that Cursor's own notice claims only its marketplace was hit, not Open VSX, while another user, Winter, replies that version 2.1.313 was available on Open VSX as well, though it has since been yanked. Beaumont's thread does not resolve whether the Microsoft VS Code Marketplace proper carried the compromised build or only the cleaned-up 2.1.314, and no official Anthropic advisory is cited anywhere in the material confirming scope, root cause, or a timeline for full remediation.
For teams running Claude Code today, the operational reality described in this thread is blunt: an update alone does not close this hole. Anthropic has not published its own incident disclosure as of this reporting, so architects should treat every machine that ever ran 2.1.313 as compromised, pull it off the network, rotate every credential and session token it touched, and rebuild from clean media rather than trusting the auto-updater to clean up after itself.