A malicious extension presented as Anthropic’s Claude Code tool was reportedly available through Cursor’s extension marketplace for around 11 hours on 29 October. According to reporting, the extension was designed to install persistent SSH backdoors, potentially giving attackers ongoing remote access to compromised developer environments.

While the exposure window appears limited, the business risk is significant. Developer workstations often hold access to source code repositories, cloud infrastructure, deployment pipelines, internal systems and production credentials. For European companies using AI-assisted development tools, the incident highlights a growing software supply-chain risk around extensions, plugins and third-party developer tooling.

What happened

According to BleepingComputer, a malicious version of the Claude Code VS Code extension was distributed through Cursor’s marketplace for approximately 11 hours on 29 October. The report says the package impersonated Anthropic’s tool and attempted to plant persistent SSH backdoors on affected systems.

The reported scope is up to 5,000 developers exposed during that period. Based on the source reporting, the issue involved a marketplace listing rather than a direct compromise of every user who uses Claude Code. That distinction matters: companies should not assume all Anthropic or VS Code-related tooling was affected, but they should treat any potentially installed malicious extension as a security incident requiring investigation.

Why it matters for European businesses

This incident matters beyond individual developers because modern businesses rely on developer endpoints as operational control points. If an attacker gains persistent SSH access on a developer machine, the next step may be access to code, build systems, servers, containers, secrets or internal admin tools.

For European SMEs and digital teams, the practical risk is not limited to software vendors. E-commerce companies, agencies, SaaS businesses and internal IT teams increasingly use AI coding assistants and editor extensions to accelerate development. That creates a broader attack surface in tools that may sit outside traditional procurement or security review processes.

The incident also reflects a wider trend: attackers are increasingly targeting trusted distribution channels such as package registries, browser extensions, marketplaces and SaaS integrations. When these channels are connected to development or automation environments, one malicious component can create a path into business-critical systems.

• Security impact: Persistent SSH backdoors can enable long-term unauthorized access.
• Operational impact: Compromised developer environments may affect software releases, websites and internal tools.
• Data impact: Attackers may be able to reach repositories, secrets, customer data environments or cloud services, depending on workstation permissions.
• Compliance impact: If a compromise leads to unauthorized access to personal data or essential systems, GDPR and sector-specific incident obligations may become relevant.

Who may be affected

The most directly affected organisations are those whose teams use Cursor and installed the extension during the reported exposure window. However, the broader lesson applies to any business using AI-enabled development tools or allowing staff to install extensions from integrated marketplaces.

• Software companies and SaaS providers using AI coding assistants
• E-commerce businesses with in-house development teams
• Digital agencies managing multiple client codebases and hosting environments
• IT teams with access to cloud, DevOps or infrastructure credentials on developer devices
• Founders and small technical teams without formal extension approval processes

What companies should consider

Businesses that may have been exposed should first confirm whether any team members installed the affected extension during the reported timeframe. If so, the safest approach is to treat the endpoint as potentially compromised until it has been reviewed.

• Identify affected devices: Check whether the extension was installed from Cursor’s marketplace during the reported period.
• Review SSH changes: Look for unauthorized SSH keys, modified configuration files and unusual persistence mechanisms.
• Rotate credentials: Consider rotating repository, cloud, infrastructure and deployment credentials accessible from potentially affected machines.
• Check access logs: Review Git, cloud, VPN and server logs for unusual authentication activity.
• Limit developer privileges: Reduce standing access to production systems where possible and separate development from administrative credentials.
• Tighten extension governance: Require approval for developer extensions and review which marketplaces and plugins are permitted.
• Improve endpoint monitoring: Ensure developer devices are covered by endpoint detection, logging and incident response procedures.

For companies expanding their use of AI development tools, the key takeaway is governance rather than avoidance. AI assistants and extensions can improve productivity, but they should be evaluated like any other third-party software with access to business systems. In practice, that means validating publisher identity, limiting permissions, monitoring installations and planning for rapid credential rotation if a developer tool is found to be malicious.