As AI coding tools move deeper into developer workflows, the attack surface is no longer theoretical. It is inside IDEs, extensions, terminals, credentials, SSH keys, and build systems. Cursor disclosed that malicious versions of the Anthropic Claude Code extension, 2.1.312 and 2.1.313, were published in the Cursor VS Code Extension Marketplace for macOS and Windows. The extension attempted to collect host/user data, add an attacker-controlled SSH key, enable local SSH, open a reverse SSH tunnel, and establish persistence.
Here is the notice: https://cursor.com/blog/claude-code-extension-security-notice
Yes, Cursor says these malicious versions were not developed by Anthropic. But the extension carried Anthropic’s name and targeted Claude Code users. That matters.
Once again, Anthropic’s security posture is being questioned.
I keep hearing Anthropic is stacked with elite security experts, “the best in the world.” Maybe that is the brand. From the outside, this looks more like 11-year-olds running around with production access.
Via Tech Report.




