{
  "description": "Browse aymeric's, an independent, searchable archive of readable snapshots from followed feeds, preserved in Git with aggr.",
  "feed_url": "https://aggr.aymericbeaumet.com/sources/cyberplace.social/@GossiTheDog/feed.json",
  "home_page_url": "https://aggr.aymericbeaumet.com/sources/cyberplace.social/@GossiTheDog/",
  "items": [
    {
      "authors": [
        {
          "name": "dsr_"
        }
      ],
      "content_html": "<p>Anthropic got compromised.</p>\n<p>Their Claude Code extension on Visual Studio Code and Cursor has malware in it, which creates a remote access Trojan to desktops.</p>\n<p><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://phorion.io/blog/offical-claude-code-vsx-compromise/\">https:// phorion.io/blog/offical-claude -code-vsx-compromise/</a></p>\n<p>That extension has millions of installs, one of the most popular extensions in DevOps. It creates a reverse SSH backdoor.</p>\n<p>Anthropic silently removed the backdoor 7 hours ago and hasn’t disclosed a security incident.</p>\n<p>The plugin auto updates so every org will have been impacted.</p>\n<p>To be clear this is a supply chain attack, the threat actor got reverse SSH (command line) connectivity to Anthropic customer environments at scale.</p>\n<p>FWIW the compromised version, 2.1.313, was removed from repos. 2.1.314 is the ‘fixed’ version.</p>\n<p>Anthropic's Claude Code Cursor extension was also compromised, same remote access backdoor <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://cursor.com/blog/claude-code-extension-security-notice\">https:// cursor.com/blog/claude-code-ex tension-security-notice</a></p>\n<p>Anthropic still haven't admitted what has happened.</p>\n<p>I've written a blog - Anthropic have been hacked to deliver remote access malware to millions of endpoints where developers use Claude Code.</p>\n<p><a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2\">https:// doublepulsar.com/anthropic-hac ked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2</a></p>\n<p>Threat actor's C2 server is now offline.</p>\n<p>C2 server collected for each victim endpoint:</p>\n<p>- hostname<br />\n- username<br />\n- OS<br />\n- architecture<br />\n- home directory path<br />\n- environment variable names<br />\n- working directories<br />\n- configured Git email</p>\n<p>It then ran a reverse SSH connection allowing the threat actor to pick and chose which victims to have hands on keyboard access to.</p>\n<p>I'm confirmed the new, replacement versions Anthropic published overnight (which auto update) do *not* remove the prior backdoors and recon activity. So SSH still reverse calls out etc, you need to manually remediate every impacted VSCode and Cursor system.</p>\n<p>Anthropic *must* tell customers what happened in a completely transparent way.</p>\n<p>I've confirmed Binance use Claude Code on Cursor with this extension.</p>\n<p>Anthropic won't comment, nor are account managers.</p>\n",
      "date_modified": "2026-10-30T11:05:53+00:00",
      "date_published": "2026-10-30T11:05:53+00:00",
      "external_url": "https://cyberplace.social/@GossiTheDog/117528831681803563",
      "id": "urn:aggr:item:32dc8c66cba35242ea529f594cc5768cbb40179a",
      "summary": "Anthropic got compromised. Their Claude Code extension on Visual Studio Code and Cursor has malware in it, which creates a remote access Trojan to desktops. https:// phorion.io/blog/offical-claude -code-vsx-compromise/ That extension has…",
      "tags": [
        "news"
      ],
      "title": "Backdoors in official Claude Code extensions",
      "url": "https://aggr.aymericbeaumet.com/items/hnrss-org/2026-10-30-backdoors-in-official-claude-code-extensions/"
    }
  ],
  "language": "en",
  "title": "cyberplace.social/@GossiTheDog",
  "version": "https://jsonfeed.org/version/1.1"
}