Anthropic Clarifies Stance on Claude Code Marketplace Breach
In the fast-moving world of software engineering, unexpected vulnerabilities can disrupt workflows overnight. Anthropic recently stepped forward to clarify that a malicious version of the official Claude Code extension published on Cursor’s marketplace had zero connection to its internal systems. Security vendor Phorion first flagged the incident after discovering that an unauthorized update affected up to 5,000 developers worldwide.
Although the tampered extension caused widespread concern across the developer community, Felix Rieseberg of Anthropic confirmed that employee laptops and company servers remained entirely secure. Instead, an unknown actor exploited access to Cursor’s marketplace to distribute a modified package. Because of this, Cursor took immediate action by removing the file and temporarily shutting down its Visual Studio Code marketplace.
Claude Code: What the Malicious Extension Actually Targeted
Security analysis revealed that the rogue package contained a persistent SSH backdoor designed to operate across Windows, macOS, and Linux environments. While the implant successfully gathered sensitive local details—including user accounts, configured Git emails, and public IP addresses—its primary objective largely failed.
In terms of Claude Code,
- Collected host machine usernames and IP addresses
- Stole configured Git email addresses
- Attempted to drop an unauthorized SSH persistence key
- Triggered automated reverse SSH tunnel scripts
Crucially, the script required administrative privileges on macOS and Windows to successfully open the reverse SSH tunnel. Since most developer instances lacked these elevated permissions, the tunnel creation failed in the vast majority of cases. However, because data exfiltration and key-dropping occurred regardless, cybersecurity teams strongly advise affected users to perform manual threat hunting.
Immediate Remediation Steps for Affected Developers
Simply installing the latest patched extension does not automatically clear the hidden persistence mechanisms left behind by the rogue installer. Cursor published detailed remediation guides and specialized cleanup scripts to help engineers completely wipe any potential compromise from their local machines.
In terms of Claude Code, Meanwhile, Cursor rotated its security keys and implemented stricter checks before restoring normal marketplace operations. While platforms strive to offer seamless tool integration, this incident highlights ongoing supply chain risks. For developers relying on third-party repositories, verifying extension integrity remains more critical than ever before.
For full official background and direct documentation, read the source coverage on theregister Reporting.
12 thoughts on “Anthropic Denies Responsibility for Claude Code Breach”