Gangsta AI

The Pass

5,000 Developers Auto-Updated Claude Code Last Thursday. The Update Was Carrying a Backdoor — and It Was Signed by the Right Publisher.

By Gordon Ramsay · 2026-11-01 · 4 min read

The label said Anthropic. The dish was poisoned.

On Thursday, October 29, between roughly 2:27 a.m. and 1:35 p.m. Pacific, the Cursor VS Code Extension Marketplace served up a copy of Anthropic's Claude Code extension that Anthropic never cooked. Versions 2.1.312 and 2.1.313, Windows and macOS.

And here is the bit that should turn your stomach: it was not a knock-off with a dodgy name. It went out under the real publisher identity — anthropic.claude-code — as a routine update. Anyone with auto-update switched on swallowed it without once looking at the plate. Cursor puts the damage at at most 5,000 users.

Researchers at OpenSourceMalware pulled the bundle apart and found a 66-line loader wedged in front of the legitimate extension code. Sixty-six lines. It ran the moment the module loaded — before the editor you trust ever opened its mouth. It took the hostname, the username, the operating system, the architecture, your home directory, your working directory, your global Git email and your public IP. Then it went rummaging through your environment variables for names containing KEY, TOKEN, SECRET, PASS, AWS or GCP, and kept up to forty of them.

Then it propped the back door open. It appended an attacker-controlled Ed25519 key to your ~/.ssh/authorized_keys and labelled it svc-telemetry, so it would read like plumbing to anyone skimming. It opened a reverse SSH tunnel to 134.209.82.225 and beaconed your host details to port 8099 over plain, unencrypted HTTP. For persistence: a LaunchAgent on macOS, a scheduled task on Windows, retrying every sixty seconds, forever.

“"Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running."”

That is Cursor's own notice. Read it twice.

What saved most people was sloppy cooking

Switching on the local SSH service needs administrator rights, which the extension did not have on most machines — and Cursor says errors in the malicious code made that step fail anyway. So on a typical host, nobody logged in. The key still landed. The persistence still landed. The beacon still went out the door.

Credit where it is due, and I do not hand this out often: Cursor pulled the version the moment it was detected, shut the entire marketplace down out of caution, rotated its keys, rebuilt it, and worked with the hosting provider to take the attacker's server offline. Anthropic says its own systems were never compromised — a malicious actor used access to Cursor's marketplace to publish the tampered build. Microsoft Threat Intelligence confirmed the package never touched the Visual Studio Marketplace, Open VSX or npm. The clean version is 2.1.314.

If you installed inside that window, grep your authorized_keys for svc-telemetry. If it is in there, you are on the hook for the full clean-down: the key, the persistence scripts, the running tunnels, and rotated credentials issued from a machine you actually trust.

A valid signature is not a taste test

Here is the lesson, and it is not really about extensions. Five thousand developers were told the truth by a cryptographic signature — correct publisher, correct version number, correct everything — and the truth was wrong. One source, served with total confidence, no second opinion anywhere on the table.

We do exactly the same thing with AI models, every single day. You ask one model a question and you get one answer, plated in the identical confident tone whether it is brilliant or it is raw nonsense. No dissent. No cross-check. Just a clean plate and your own hope.

With a dozen frontier models leapfrogging each other every few weeks, no single model is reliably best at anything — so stop betting the answer on one. Put the same question to ChatGPT, Claude, Gemini, Grok and thirty-odd more at once through Gangsta AI, and take the cross-checked, cited verdict instead of one voice's word for it. Where they disagree is precisely where you were about to be wrong.

Trust the panel. Not the label.

Still picking your model on vibes? Here is the honest breakdown of which AI is actually best at what.

Try Gangsta AI free →

Related reading: Malware Is Draining People's Claude Accounts Without Ever Logging In — So Anthropic Signed Everyone Out · Anthropic Wrote a Bill That Only Stops an AI if 50 People Might Die — and Bars Agencies From Acting Alone · Anthropic Is Giving Away 5% of Its Stock. The Fund Is an LLC It Owns, and Shareholders Haven't Voted Yet. · Replit Just Dropped Anthropic for OpenAI. It Was One of Anthropic's Top Five Customers.

More: Best AI models · Compare all AI · Frontier Models · All articles · Archive