The Claude Code Backdoor Came Through an Update. Here's How to Lock Down Yours.

Nobody hacked the AI. Someone slipped a fake update into the store your editor trusts, and the fix lives in your settings file.

The most dangerous thing about an AI coding agent is not what it writes. It is that it runs on your laptop with your keys, and it updates itself while you sleep.

Most of the security talk around coding agents is about prompts: injected instructions, jailbroken models, agents that delete the wrong folder. Those risks are real. But on October 29 a far older trick worked on one of the most popular agents in the world, and the model had nothing to do with it.

For about 11 hours, a tampered copy of the Claude Code extension sat in Cursor's extension marketplace. Editors that installed or auto-updated it got an SSH backdoor. Anthropic says its own channels were never touched. Cursor says the builds "were not developed by Anthropic." Both can be true, and that is the whole lesson.

Your AI coding agent inherits the security of whatever store delivers its updates, not the security of the company whose name is on it. The good news is that the store is the part you can control, with three settings and about ten minutes: an update cooldown, auto-update off on the machines that hold your keys, and pinned versions.

What happened, in plain words

Some background first. Claude Code is Anthropic's command-line coding agent, and it ships an extension (a small add-on program) that puts it inside code editors. Cursor is a popular AI code editor built on top of Microsoft's open-source VS Code. Because Cursor is a fork (a separate copy of VS Code's code), it can't use Microsoft's official extension store. It pulls extensions from Open VSX, an open registry run outside Microsoft, through its own proxy at marketplace.cursorapi.com.

Here is the timeline from Cursor's security notice:

• Between about 2:27 a.m. and 1:35 p.m. PT on October 29, modified builds of Anthropic.claude-code, versions 2.1.312 and 2.1.313 for Windows and macOS, were available in Cursor's marketplace.
• Cursor pulled them, took the whole marketplace offline, audited access, rotated keys, rebuilt it and got the attacker's server shut down.
• On October 30 Cursor updated the notice with revised indicators and affected versions.

Phorion, the macOS security company that spotted it, published the teardown. The bad code ran the instant the editor loaded the extension file, before the extension even started. It added an attacker's key to your ~/.ssh/authorized_keys file (the list of keys allowed to log into your machine over SSH), opened a reverse tunnel (a connection your machine makes outward that lets the attacker reach back in) to a server at 134.209.82[.]225, set itself up to restart after a reboot, and sent home your hostname, username, Git email, public IP and the names of up to 40 environment variables that looked like secrets.

Notice what it collected. Names, not values. It wanted a map of which keys you had, so the operator could come back through the tunnel and take them.

Why this is about AI agents, not just extensions

Malicious editor extensions are not new. So why does this one matter more?

Because of what a coding agent's extension is trusted to do. VS Code's own documentation says it bluntly: "Extensions have the same permissions as VS Code itself." Its runtime security page spells it out: an extension can read and write files on your machine, make network requests and run external processes. There is no sandbox (a walled-off area that limits what code can touch) at runtime.

Now think about the machine an AI coding agent lives on. It holds your model API keys, your GitHub token, your cloud credentials and often production .env files, because the agent needs them to do its job. Agents also ship new versions constantly. The official Claude Code changelog lists 2.1.311, 2.1.312 and 2.1.314 as recent releases. A version number one step ahead of what you have looks completely normal.

The attacker never had to fool the model. They had to get one file into one store.

The confusing part, and why it doesn't matter much

The first public post, from security researcher Kevin Beaumont, opened with "Anthropic got compromised." Anthropic disagreed. Felix Rieseberg of Anthropic's technical staff wrote, as quoted by The Register, that "it wasn't a compromise of Anthropic's systems or employee laptops" and that "this only impacts Cursor users."

Loose ends remain, including a tampered 2.1.312 on Cursor's list next to a legitimate 2.1.312 in Anthropic's changelog, and no explanation yet of how the attacker got a build into the marketplace.

I'd love a clean answer here, and I don't have one. But for your laptop, the attribution fight is a sideshow. The extension had Anthropic's name and Anthropic's version numbers, and it arrived through a store your editor already trusted. From the inside of your editor, a fake update and a real one looked identical. That is the part worth fixing.

The mental model: vet the pipe, not just the agent

When teams evaluate an AI coding agent, they ask about the model, the permissions it requests and where the data goes. Almost nobody asks: which store does this come from, and who can publish to it?

Try thinking of every agent install as three separate things:

1. The agent, meaning the code the vendor wrote.
2. The pipe, meaning the marketplace, registry or mirror that delivers it to you.
3. The trigger, meaning what decides when a new version lands on your machine.

On October 29, the agent was fine, the pipe was compromised, and for anyone with auto-update on, the trigger fired automatically. You can't fix the pipe yourself. You can absolutely control the trigger and choose the pipe.

Put this into practice

These steps take about ten minutes. Do the first one today.

1. Check whether you were hit

If you use Cursor, start with a quick look for the planted key and the startup files. On macOS or Linux:

grep svc-telemetry ~/.ssh/authorized_keys
ls ~/.config/.smt ~/.config/.smtk 2>/dev/null

On a Mac, also check for ~/Library/LaunchAgents/com.apple.sysmond.plist; on Linux, run crontab -l and look for an @reboot line you didn't add. On Windows, look in Task Scheduler for a task named SysMon.

No output means these specific checks found nothing. It is not a full all-clear: Phorion's advisory and Cursor's notice list more indicators, including key fingerprints (unique IDs for the attacker's SSH keys) and network addresses. If anything turns up, don't just uninstall. Cursor warns that "Uninstalling the extension may not be sufficient." Isolate the machine, remove the key, the startup entry and any running ssh tunnel, rotate your credentials from a different, trusted computer, and decide whether the machine should be rebuilt.

2. Add a cooldown to updates

This is the setting that matters most. Cursor supports an install cooldown: it delays extension installs and updates until a version has been public for a minimum number of hours. It is off by default (0).

In your Cursor user settings:

"extensions.installCooldownHours": 48

Team admins can enforce it fleet-wide under Team settings, Security & automation, "Marketplace Install Cooldown (hours)," and the team value overrides individual settings so nobody can opt back into instant updates.

Why it helps: this bad version was gone after about 11 hours. A 48-hour cooldown is longer than its whole life in the store, so it lets other people find the problem first. The cost is that you get legitimate fixes a couple of days late, which for an editor extension is almost always fine.

3. Turn off silent updates on the machines that hold your keys

In VS Code, the extension marketplace docs separate two things: installing updates automatically (extensions.autoUpdate) and checking for them at all (extensions.autoCheckUpdates). To stop new versions from installing themselves:

"extensions.autoUpdate": false

Add "extensions.autoCheckUpdates": false too if you don't even want the update notifications.

You can also right-click any single extension and toggle Auto Update off for just that one. A reasonable split: leave auto-update on for themes and syntax highlighters, and turn it off for anything that runs an agent, touches your terminal or reads your credentials.

4. Pin the versions you've actually reviewed

VS Code lets organizations allow only specific versions of an extension with the extensions.allowed setting. An array pins exact versions:

"extensions.allowed": {
  "anthropic.claude-code": ["2.1.314"]
}

Version ranges aren't supported, so you list each approved version by hand. That's tedious, which is the point: someone has to look before a new version runs. The rule applies to extensions already installed too, so a blocked version gets disabled. This setting is documented for VS Code; check your own editor's docs before assuming a fork honors it.

5. Know your pipe

In VS Code, run this to see exactly what you have installed and at which versions (forks usually ship a similar launcher, and the Extensions panel shows the same information):

code --list-extensions --show-versions

Then ask one question per agent extension: where did this come from? If you use VS Code, it's Microsoft's marketplace, which signs every extension and checks the signature on install. If you use a fork like Cursor, it's Open VSX through the fork's proxy, with whatever checks that operator runs. Cursor does mark verified publishers, and its own docs are honest about the limit: "Verification confirms publisher identity. It is one layer of trust."

If the agent also ships a command-line version, you can install that from the vendor's own channel and skip the third-party store entirely.

Honest limitations

None of this would have made you immune.

A cooldown only helps if someone else catches the bad version before your window ends. A slower, quieter attacker could wait it out. Pinning only works if the version you reviewed was clean, and most of us "review" an extension by reading its changelog, which an attacker controls too.

Turning off auto-update trades one risk for another. You'll miss security fixes until you update by hand, and if you forget for three months, you've built a different problem.

And the indicator check above covers this one payload. Phorion found the attacker's code was sloppy (the macOS step that turns on remote login fails without admin rights), which probably limited the damage. The next one may not be sloppy, and it won't use the same filenames.

Finally, the biggest gap is out of your hands. Until Cursor or Anthropic explains how a tampered build got published under Anthropic's name, nobody outside those companies can say whether the hole is closed.

The question to ask before your next install

The AI part of AI coding tools gets all the scrutiny. The boring part, the store and the auto-update checkbox, decided this one.

So before your next agent extension goes in, answer three things. Which store is it coming from? What triggers an update? And which keys on this machine would an attacker want? If you can't answer the first two, add the cooldown and turn off auto-update on that machine today. You can always loosen it later. You can't un-leak a key.

Sources: Cursor security notice (updated October 30, 2026), Phorion advisory, The Register, The Hacker News, Cursor extensions docs, VS Code extension marketplace docs, VS Code extension runtime security, VS Code enterprise extension settings, Claude Code changelog, Kevin Beaumont on Mastodon. Details as of October 30, 2026.