VS Code extension stories

Oct 30, 2026

Anthropic official VS Code extension backdoored for nearly 12 hours

An official extension for Anthropic's Claude model was backdoored and threatened as many as 5,000 developers' machines, with Anthropic yet to warn customers of the security breach.

Oct 30, 20263 sources

Top claims

▪The malicious Claude Code extension version 2.1.313 exfiltrates host details including IP address, username, hostname, global Git email, and the names of up to 40 environment variables containing sensitive keywords like AWS, GCP, KEY, TOKEN, SECRET, or PASS
▪The compromised Anthropic Claude Code extension version 2.1.313 was published under Anthropic's legitimate publisher identity anthropic.claude-code
▪Neither Cursor nor Anthropic has publicly explained the precise method or credential compromise through which attackers gained access to publish to Anthropic's official publisher account during the October 29, 2026, incident

People involved

Felix Rieseberg

Subtopics

AI coding1 AI developer tools1 AI security1 Claude Code1 Coding agents1 Data exfiltration1 Microsoft1

Related timelines