Malicious Anthropic Claude Extensions Reached Thousands of Devices in Supply Chain Attack

A developer opening an editor this week and installing a Claude Code extension may have gotten more than an AI coding assistant. According to a cluster of headlines aggregated by Google News, a supply chain attack put tampered extensions branded with Anthropic's Claude name onto developer machines, and the affected tools may have reached thousands of devices.

The most specific figure comes from Cursor, the AI code editor. As reported by Reuters, Cursor says up to 5,000 users were affected by a tampered Claude Code extension. The phrasing matters: it is a ceiling, not a tally, and it is Cursor's own estimate. The source material does not say how many of those users actually ran the compromised code.

Two outlets describe the mechanics in broad terms. Microsoft's reporting, as it appears in the headline, looks inside a malicious extension dressed up as Claude Code and describes a persistent SSH backdoor, a way for an attacker to keep returning to a machine after the initial compromise. Another headline, from DoublePulsar, says Anthropic was hacked to deliver a remote access trojan to Claude developer laptops worldwide. That is a broader and more dramatic claim than the others, and the headline alone does not establish how the compromise happened or where in the chain it occurred.

The timing is addressed by Ars Technica, whose headline says an Anthropic VS Code extension on Cursor was backdoored for nearly 12 hours. If accurate, that suggests a defined window during which anyone who installed or updated the extension could have received the malicious version, rather than a long-running infection. The headlines do not say when that window opened or closed.

WIRED frames the episode as a supply chain attack that put malicious Anthropic Claude extensions on thousands of devices. That label places the problem upstream of the individual user: the people affected were not careless about a suspicious download, they were installing something that carried a trusted name through a trusted channel. Extensions for editors like VS Code and Cursor run with considerable access to a developer's files and environment, which is why a backdoor there is a serious matter.

Much remains unsettled. The material available here is a set of headlines, not the full articles, and the outlets use somewhat different language about what was compromised: an Anthropic extension, a Claude Code-branded extension, a tampered extension on Cursor. Whether Anthropic's own systems were breached, or whether the malicious versions were published through a third party or a marketplace, is not established by what we have.

What to watch next: attribution of the attack, a firmer count of affected users than Cursor's up-to-5,000 figure, and whether Anthropic and Cursor publish formal incident details and remediation steps. Developers who installed Claude Code extensions in the reported window will be looking for exactly that guidance.