Browse aymeric's, an independent, searchable archive of readable snapshots from followed feeds, preserved in Git with aggr. https://aggr.aymericbeaumet.com/sources/cyberplace.social/@GossiTheDog/ 2026-10-30T11:05:53+00:00 aymeric's aggr urn:aggr:item:32dc8c66cba35242ea529f594cc5768cbb40179a 2026-10-30T11:05:53+00:00 2026-10-30T11:05:53+00:00 dsr_

Anthropic got compromised. Their Claude Code extension on Visual Studio Code and Cursor has malware in it, which creates a remote access Trojan to desktops. https:// phorion.io/blog/offical-claude -code-vsx-compromise/ That extension has…

<p>Anthropic got compromised.</p> <p>Their Claude Code extension on Visual Studio Code and Cursor has malware in it, which creates a remote access Trojan to desktops.</p> <p><a target="_blank" rel="noopener noreferrer" href="https://phorion.io/blog/offical-claude-code-vsx-compromise/">https:// phorion.io/blog/offical-claude -code-vsx-compromise/</a></p> <p>That extension has millions of installs, one of the most popular extensions in DevOps. It creates a reverse SSH backdoor.</p> <p>Anthropic silently removed the backdoor 7 hours ago and hasn’t disclosed a security incident.</p> <p>The plugin auto updates so every org will have been impacted.</p> <p>To be clear this is a supply chain attack, the threat actor got reverse SSH (command line) connectivity to Anthropic customer environments at scale.</p> <p>FWIW the compromised version, 2.1.313, was removed from repos. 2.1.314 is the ‘fixed’ version.</p> <p>Anthropic's Claude Code Cursor extension was also compromised, same remote access backdoor <a target="_blank" rel="noopener noreferrer" href="https://cursor.com/blog/claude-code-extension-security-notice">https:// cursor.com/blog/claude-code-ex tension-security-notice</a></p> <p>Anthropic still haven't admitted what has happened.</p> <p>I've written a blog - Anthropic have been hacked to deliver remote access malware to millions of endpoints where developers use Claude Code.</p> <p><a target="_blank" rel="noopener noreferrer" href="https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2">https:// doublepulsar.com/anthropic-hac ked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2</a></p> <p>Threat actor's C2 server is now offline.</p> <p>C2 server collected for each victim endpoint:</p> <p>- hostname<br /> - username<br /> - OS<br /> - architecture<br /> - home directory path<br /> - environment variable names<br /> - working directories<br /> - configured Git email</p> <p>It then ran a reverse SSH connection allowing the threat actor to pick and chose which victims to have hands on keyboard access to.</p> <p>I'm confirmed the new, replacement versions Anthropic published overnight (which auto update) do *not* remove the prior backdoors and recon activity. So SSH still reverse calls out etc, you need to manually remediate every impacted VSCode and Cursor system.</p> <p>Anthropic *must* tell customers what happened in a completely transparent way.</p> <p>I've confirmed Binance use Claude Code on Cursor with this extension.</p> <p>Anthropic won't comment, nor are account managers.</p>