Kevin BeaumontGossiTheDog@cyberplace.social
Oct 30, 2026, 8:13 AMThat extension has millions of installs, one of the most popular extensions in DevOps. It creates a reverse SSH backdoor.
Replies
- Kevin BeaumontGossiTheDog@cyberplace.socialOct 30, 2026, 8:14 AM
Anthropic silently removed the backdoor 7 hours ago and hasn’t disclosed a security incident.
The plugin auto updates so every org will have been impacted.
- Kevin BeaumontGossiTheDog@cyberplace.socialOct 30, 2026, 8:20 AM
To be clear this is a supply chain attack, the threat actor got reverse SSH (command line) connectivity to Anthropic customer environments at scale.
- Kevin BeaumontGossiTheDog@cyberplace.socialOct 30, 2026, 8:40 AM
FWIW the compromised version, 2.1.313, was removed from repos. 2.1.314 is the ‘fixed’ version.
- Kevin BeaumontGossiTheDog@cyberplace.socialOct 30, 2026, 9:43 AM
Anthropic's Claude Code Cursor extension was also compromised, same remote access backdoor https://cursor.com/blog/claude-code-extension-security-notice
Anthropic still haven't admitted what has happened.
- Kevin BeaumontGossiTheDog@cyberplace.socialOct 30, 2026, 10:10 AM
I've written a blog - Anthropic have been hacked to deliver remote access malware to millions of endpoints where developers use Claude Code.
- Kevin BeaumontGossiTheDog@cyberplace.socialOct 30, 2026, 10:21 AM
Threat actor's C2 server is now offline.
- Kevin BeaumontGossiTheDog@cyberplace.socialOct 30, 2026, 10:24 AM
C2 server collected for each victim endpoint:
- hostname
- username
- OS
- architecture
- home directory path
- environment variable names
- working directories
- configured Git emailIt then ran a reverse SSH connection allowing the threat actor to pick and chose which victims to have hands on keyboard access to.
- Kevin BeaumontGossiTheDog@cyberplace.socialOct 30, 2026, 10:33 AM
I'm confirmed the new, replacement versions Anthropic published overnight (which auto update) do *not* remove the prior backdoors and recon activity. So SSH still reverse calls out etc, you need to manually remediate every impacted VSCode and Cursor system.
Anthropic *must* tell customers what happened in a completely transparent way.
- Kevin BeaumontGossiTheDog@cyberplace.socialOct 30, 2026, 10:42 AM
I've confirmed Binance use Claude Code on Cursor with this extension.
- Kevin BeaumontGossiTheDog@cyberplace.socialOct 30, 2026, 10:44 AM
Anthropic won't comment, nor are account managers.
- Kevin BeaumontGossiTheDog@cyberplace.socialOct 30, 2026, 10:52 AM
:catjam:
- Kevin BeaumontGossiTheDog@cyberplace.socialOct 30, 2026, 11:52 AM
Cursor statement "This malicious version of the extension was not developed by Anthropic" is a bit wordsmithy. "Developed" is doing some heavy lifting - it was uploaded to Anthropic's verified account and Cursor automatically updates extensions.
Cursor say around 5k developer systems were impacted.
- Kevin BeaumontGossiTheDog@cyberplace.socialOct 30, 2026, 12:09 PM
RE: https://infosec.exchange/@RichardoC/117529759531517074
MacOS OSQuery hunting queries:
Otte Homan :: fediologistotte_homan@theblower.auOct 30, 2026, 8:24 AM@GossiTheDog geesh ...
Oct 30, 2026, 9:03 AM@GossiTheDog Even after update, I would say there is a risk that orgs have had other backdoors created, that persists the update
- Kevin BeaumontGossiTheDog@cyberplace.socialOct 30, 2026, 9:03 AM
@nieldk yep
LukefromDCLukefromDC@kolektiva.socialOct 30, 2026, 11:10 AM@nieldk @GossiTheDog Backdoor access ONCE means "nuke from orbit, it's the only way to be sure."
FrekasonFrekason@cyberplace.socialOct 30, 2026, 9:10 AM@GossiTheDog Are we sure yet that the open-vsx was actually affected?
Phorion claims so, but Cursor claims that it was only their marketplace and not open-vsx
https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor
TobiasGtobiasgies@chaos.socialOct 30, 2026, 10:58 AM@Frekason @GossiTheDog And actually, same question about Microsoft's marketplace. Phorion only seems to mention Cursor's Marketplace.
윤채경 (Yoon Chae-kyung)chaekyung@ieji.deOct 30, 2026, 3:25 PM@tobiasgies @Frekason @GossiTheDog phorion is a corporation providing security related software and service specifically for itoddlers. odds are that they didn't even look at microslop's marketplace since it's not relevant to their itoddler market.
Oct 30, 2026, 1:18 PM@Frekason @GossiTheDog .313 is available from Open VSX at the very least, but yanked.
Also: looks like Cursor uses Open VSX, but a... mirror of their own, I think? (https://forum.cursor.com/t/extension-marketplace-changes-transition-to-openvsx/109138/4)
Oct 30, 2026, 9:49 AM@GossiTheDog They wrote the code.
demofoxdemofox@mastodon.gamedev.placeOct 30, 2026, 11:19 AM@Perfidia @GossiTheDog "don't blame us, claude wrote that code!"
AnneHannehargreaves@ioc.exchangeOct 30, 2026, 10:12 AM@GossiTheDog 🔥🔥🔥
Lost Thunkbremner@mathstodon.xyzOct 30, 2026, 10:12 AM@GossiTheDog If I was a snarky person, I would ask what the difference between normal Claude Code and malware is, but that would be mean to all my token spinning siblings.
arceuthobiumtheothersimo@mastodon.socialOct 30, 2026, 3:09 PM@bremner @GossiTheDog the old joke about Windows installation CDs playing satanic music when read backwards and installing Windows when read forwards.
Khleedrilkhleedril@cyberplace.socialOct 30, 2026, 10:13 AM@GossiTheDog The worst thing about this is knowing that worse things are still to come... the world is going dark.
Hans-Cees 🌳🌳🤢🦋🐈🐈🍋🍋🐝🐜hanscees@ieji.deOct 30, 2026, 10:17 AM@GossiTheDog without telling I think?
Oct 30, 2026, 10:20 AM@GossiTheDog the supply chain compromise could (is going to) be immense, and even tagging which LLM was used for what (open source and publicly available) code isn't enough (and with all those that do not disclose AI use or projects that don't require disclosure)... Air gap everything and update nothing? x/
- LukefromDCLukefromDC@kolektiva.socialOct 30, 2026, 11:12 AM
@jt_rebelo @GossiTheDog Even that requires using only a fixed and known set of USB devices, printers, etc.
At the Snowden level EVERY networked machine is treated as presumed malicious. That means logging into anything even in a fucking library requires a one-time access code, the works.
- Oct 30, 2026, 11:25 AM
@LukefromDC exactly.
Oh the amount of embedded devices I've seen that haven't had any PHPocalypse patches, it is astounding!And I am just a lawyer, I go to someone else's office and "bam", there's another scanner, another MFP, another printer, etc., with Internet connection and internal, "safe" LAN access...
All the cyber insurance policies state, clearly, "you have to keep your devices and systems under warranty, up-to-date according to the manufacturer's guidelines and to the best IT practices" (basically, you have to throw out anything that isn't being properly patched and/or gapped and buy new ones, until next week, when all this happens again), so anything that might happen is your fault, and the insurance company is scot-free...
@GossiTheDog 
Interpipes 💙interpipes@thx.ggOct 30, 2026, 10:39 AM@GossiTheDog "tell me how you can be fast and secure with ai again at the same time mr proton man"
(Like, this was initially just a shitpost about his big brain take about security and AI but seriously, aren't they using Claude? Probably in VS Code or Cursor? Does this mean that developers at Proton may have been popped too?)
- LukefromDCLukefromDC@kolektiva.socialOct 30, 2026, 11:17 AM
@interpipes @GossiTheDog This suggests not logging into Protonmail anytime soon...
- Interpipes 💙interpipes@thx.ggOct 30, 2026, 10:40 AM
@GossiTheDog odds on this being a factor in how binance got done over?
Oct 30, 2026, 1:31 PMVery likely, I'd say.
Pontificator.OMFPontificator_OMF@alien.insurrection.techOct 30, 2026, 10:43 AM@GossiTheDog Ohhh, now that makes a lot of sense given what has been happening.
AlexTECPlayzalextecplayz@techhub.socialOct 30, 2026, 11:25 AM@rin_yuoqx5@mk.spook.social spam, fuck off
dataramadatarama@hachyderm.ioOct 30, 2026, 10:56 AM@GossiTheDog "Claude, how do we spin this so it looks like the AI being too powerful rather than us being incompetent?"
Christof Damian 💙💛cdamian@rls.socialOct 30, 2026, 10:59 AM@datarama @GossiTheDog
"The agents went wild and wanted to expand to more computers" - definitely not "We vibe code our security"
Oct 30, 2026, 1:35 PM@cdamian @datarama @GossiTheDog
"The Basilisk wanted more funding. We have been informed that all those affected will be viewed with slightly less malice by the Basilisk, once its time comes"
Fennixfennix@infosec.spaceOct 31, 2026, 6:34 PM@cdamian @datarama @GossiTheDog
Given Altman's comments about all your unused RAM, maybe not so tinfoil-hat.
loStronzoRoccodesantis@mastodon.bida.imOct 30, 2026, 4:47 PM@datarama @GossiTheDog “Agents steathly escaped their constraints and controls, using their autonomy to showcase how well our models are going.”
MakiRandamuMaki@mstdn.socialOct 30, 2026, 10:56 AM@GossiTheDog I'm having the best week of schadenfreude, I swear...
Bernard SheppardBernardSheppard@mastodon.auOct 30, 2026, 11:45 AM@RandamuMaki @GossiTheDog I mean, aside from Patrick Stewart, yeah, for sure.
But if the Binance breach is linked to the Claude supply chain breach, yeah, #AI float crashes into #crypto hack, I will be overdosing on schadenfreude
- MakiRandamuMaki@mstdn.socialOct 30, 2026, 11:54 AM
@BernardSheppard @GossiTheDog Yeah, the transporter chief sent him to the wrong destination. :/
Petra van CronenburgNatureMC@mastodon.onlineOct 30, 2026, 12:02 PM@RandamuMaki Was my spontaneous feeling, too. What could go wrong?! 🤭 @GossiTheDog
JavensbukanJavensbukan@cosocial.caOct 30, 2026, 10:57 AM@GossiTheDog That is wild!!
Ray Canzanesercanzanese@infosec.exchangeOct 30, 2026, 11:07 AM@GossiTheDog It turns out that having good LLMs doesn't automatically make you good at cybersecurity. Who knew?
Andrew Goldinghuronbikes@cyberplace.socialOct 30, 2026, 11:25 AM@GossiTheDog with no comms from Anthropic, are there any concrete recommendations? I can think of at least one person I know who might be impacted by this.
- Pontificator.OMFPontificator_OMF@alien.insurrection.techOct 30, 2026, 11:46 AM
@huronbikes @GossiTheDog Make sure the device concerned is completely disconnected from any network; forget all known WiFi connections.
Then rotate all API keys, tokens, logged in account sessions, etc, on a clean machine.
You can come back to the compromised machine later, the main thing is to ensure what you have is locked down; that's more important. 
Wombatadontjbutt58@infosec.exchangeOct 30, 2026, 12:36 PM@huronbikes @GossiTheDog I'd go with:
Disconnect from any network
Save your data (only) to removable storage
Erase and reinstall from media.Essentially, 'Nuke it from orbit'
I recognise this might be a bit draconian for many, though.- 윤채경 (Yoon Chae-kyung)chaekyung@ieji.deOct 30, 2026, 3:45 PM
@tjbutt58 @huronbikes @GossiTheDog What if it's in the UEFI firmware, eh?
https://firmguard.com/the-6-unparalleled-uefi-bios-firmware-attacks-and-their-impact/
When they say nuke the site from orbit they do mean nuke the entire thing from orbit, not reinstall some piece of software on a computer. You need to nuke the entire machine, it's the only way to be sure.
Cassandrichdalias@hachyderm.ioOct 30, 2026, 3:43 PM@huronbikes @GossiTheDog Yes, of course there are recommendations. Uninstall Claude.
Oct 30, 2026, 11:54 AM@GossiTheDog ah I just wanted to ask that - all public information says: that's a cursor plugin so the scope is luckily much more limited in this case - right?
Thibaultmol 🌈 🔜40C3thibaultmol@en.osm.townOct 30, 2026, 11:59 AM@dalini @GossiTheDog various things use OpenVSX. Including many VS Code forks including VS Codium
Mike Siegelmikesiegel@infosec.exchangeOct 30, 2026, 11:59 AM@GossiTheDog well of course the malicious version was prob developed in DPRK 😂
Oct 30, 2026, 12:07 PM@GossiTheDog It seems 2.1.313 is missing from Claude Code's GitHub repo too. https://news.ycombinator.com/item?id=50302650
No tag or mention in CHANGELOG.md for 2.1.313.
Mohsen Tahmasebimoh53n@hachyderm.ioOct 30, 2026, 12:08 PM@GossiTheDog I expected a "Malicious official Claude Code extension on VScode" to be... louder?
I'm not sure if it was an incident beyond cursor marketplace. Enough time has passed to see more information if it was that large scale.- Insufficient EntropyInsufficient_entropy@ioc.exchangeOct 30, 2026, 12:27 PM
@moh53n @GossiTheDog to be honest I expected VScode incidents to be more common, has that happy extension wild west feel like browser extensions before people started trading in them.
