Security researchers have uncovered two related threats to AI-assisted software development, intensifying concerns about the security of developer tools and code analysis. On October 29, Cursor removed a compromised Claude Code extension from its marketplace after researchers determined that malicious versions installed an SSH backdoor on affected machines. An estimated 5,000 users may have been exposed.
Cursor said two poisoned builds of Anthropic.claude-code — versions 2.1.312 and 2.1.313 — were available for Windows and macOS for roughly eleven hours, from 2:27 a.m. to 1:35 p.m. Pacific time. Anthropic did not create the malicious plug-ins, and the issue did not involve Anthropic’s Claude AI model. According to OpenSourceMalware, the attacker hid a 66-line loader at the start of the extension’s JavaScript file so that the malicious code ran before the legitimate extension. Loading the module was enough to trigger collection of computer information and credential types, generate an svc-telemetry SSH key, and attempt a reverse tunnel to 134.209.82.225 while transmitting data over HTTP port 8099.
Cursor said SSH attempts were often unsuccessful without admin privileges, but warned that uninstalling the extension may not be sufficient because the payload drops standalone persistence scripts, including a LaunchAgent on macOS and a scheduled task on Windows. Affected developers were advised to delete the svc-telemetry SSH key, run cleanup scripts, and rotate credentials from a separate trusted device.
The incident fits a broader 2026 supply-chain pattern. Cloud Security Alliance reported the TrapDoor campaign involving more than 34 malicious packages inserting hidden instructions into AI-assistant configuration files, while the GlassWorm campaign used sleeper extensions to target developer credentials and crypto wallets. Separately, Sonatype identified more than 454,600 new malicious packages in 2025, and Socket previously identified 73 malicious extensions. No confirmed links between the perpetrators have been established.
In a parallel disclosure, commentator @TheFlowHorse highlighted a JavaScript obfuscation technique that uses numerous function names related to biological weapons and poisons to prevent AI systems from analyzing code because of safety restrictions. Security researcher veritas found the method while examining browser fingerprint scripts. The technique raises additional questions about AI-based code review, especially as AI adoption grows. A 2026 Stack Overflow survey found that 80% of respondents use AI tools for an hour or more per day, though 48% trust AI-generated content only if its validity is easy to confirm.
