decrypted · 31 october 2026 · vulnerabilities and patching · supply chain · ai and llm security

A fake Claude Code extension sat in Cursor's marketplace for eleven hours

For about eleven hours on Thursday 29 October, developers who installed Claude Code from the Cursor editor's marketplace could be handed a counterfeit. Cursor says versions 2.1.312 and 2.1.313 carried Anthropic's name but were not developed by Anthropic. They worked as normal while leaving a back door open for someone else. The attacker's code was clumsy. The design weakness it exploited is not.

What the fake did

The attackers put a short loader at the top of the extension's main file and left the genuine code untouched. Think of a courier who delivers your parcel perfectly while copying your front door key. It ran the moment the editor loaded the extension, with no click required.

According to Phorion, the researchers who analysed it, it added the attacker's key to the list allowed to log in over SSH, the encrypted way administrators reach machines. It then tried to switch SSH on and opened a reverse tunnel, a connection the laptop makes outwards so the attacker can walk back in past the firewall. It installed persistence, and sent a beacon with the hostname, username, public address, Git email and the names, not values, of environment variables that look like keys or tokens.

Why it mostly failed

Phorion found bugs. On macOS a command lacked the rights it needed, so SSH was never enabled. On Windows the setup script went to the wrong interpreter and failed. Cursor says that unless the editor ran with administrator privileges the login step would fail, though the key, the persistence and the beacon still landed. It says the attacker's server no longer functions, and that it rotated keys and rebuilt the marketplace.

BleepingComputer put the exposure at up to 5,000 developers. I could not corroborate that figure elsewhere, so treat it as an estimate.

What a defender sees

An entry commented svc-telemetry in the SSH authorised keys file.
On macOS, a launch agent named com.apple.sysmond.plist; on Windows, a scheduled task called SysMon.
Outbound connections to 134.209.82[.]225 on ports 22 and 8099.

Uninstalling the extension removes none of this. Remove the persistence and the key, then rotate credentials.

The design lesson

BleepingComputer says how the attackers published under Anthropic's name is unexplained. Whatever the answer, the shape is old: an editor extension runs with everything the developer can do, and the marketplace listing is the only check. Marketplaces should verify that a publisher is who it claims before showing a vendor's name, and editors should ask before an extension touches SSH settings or creates start-up tasks.

Secure by Design says a tool that installs code from strangers should not inherit your whole account. UK organisations can treat developer laptops as production systems, allow a short approved list of extensions, mirror them internally, and delay updates by a day so eleven-hour incidents pass you by. The cost is some grumbling and an owner for the list.

Also this week

Cisco firewall crash bug under attack. Cisco's advisory of 28 October covers CVE-2026-76418, the public reference number for a flaw in the remote access VPN of its ASA firewall line and FTD, its newer firewall software. An unauthenticated attacker can make a device reload with a crafted request. Cisco rates it 8.6 and says it learned of active exploitation in October. It affects devices with the VPN enabled and secondary authentication on a tunnel group, and fixes exist for each release train. Cisco says no workaround addresses it, though disabling secondary authentication on the affected tunnel group reduces exposure, and it recommends upgrading. A firewall's login page is reachable by everyone, so it should be the best-tested code you run.

GCHQ cannot find its removable media. The Record reports that the Investigatory Powers Commissioner's Office annual report for 2025 says GCHQ estimated losses "in the thousands" of memory sticks, drives and discs. The commissioner said it was "very concerned" and disappointed with how long GCHQ took to investigate. GCHQ calls it a record-keeping failure and says it has been addressed. The report does not allege any device reached an adversary. Nobody can show data is safe if nobody can count the containers, so an asset register is a security control, not admin.

Binance and the engineer's laptop. Binance said about $6.3 billion was taken on 29 October and traced the breach to a compromised engineer's laptop with access to systems that could authorise withdrawals. Binance says user funds are safe and it will cover losses, and it suspended deposits and withdrawals during security checks. TRM Labs and Chainalysis attribute the theft to a group they call TraderTraitor, which is their assessment, not Binance's. Frozen amounts differ between outlets, about $2.7 billion in one and $3 billion in the other. One laptop should never be able to authorise movements of that size.

Sources

If your developers' machines or extensions need a Secure by Design review, get in touch.