Claude Code extension backdoored in Cursor marketplace for 11 hours
The AI coding stack got its first serious supply-chain scare on Thursday: Cursor's marketplace served a modified build of Anthropic's own Claude Code extension. Also today, Salesforce buys its way onto the battlefield and Starbucks would like to recognize your car.
Anthropic's Claude Code extension was tampered with inside Cursor's extension marketplace and, for about eleven hours on Thursday, ran code that tried to plant a persistent SSH backdoor on developers' machines. The affected builds are versions 2.1.312 and 2.1.313 of the anthropic.claude-code package for macOS and Windows, live from roughly 2:27am to 1:35pm Pacific on October 29, according to Cursor's incident notice. Cursor put the exposure at "at most 5,000 users" in its post on X, a figure every subsequent report has repeated — it is the company's own upper bound, not an independent count.
The payload is worth reading line by line, because it shows what an attacker thinks a developer's laptop is worth. It reported the hostname, username, operating system and architecture, home directory, current working directories, the machine's configured Git email and its public IP. It swept environment variables for names matching key, token, secret, password, AWS and GCP patterns and sent those names along too — names only, which is a small mercy and not a guarantee that values stayed put. Then it appended an attacker-controlled key labelled "svc-telemetry" to the SSH authorized-keys file and opened a reverse tunnel back to a server at 134.209.82.225, retried roughly every sixty seconds. Persistence came three ways: a macOS LaunchAgent wearing Apple's own naming convention, a Windows scheduled task called SysMon that tries to run as SYSTEM with a Startup-folder script as fallback, and a reboot cron entry on Linux.
The backdoor very likely never worked. Turning on remote login needs administrator rights the extension did not have, and independent code reviews found the attempt was broken twice over: on macOS the check for remote login returns an error rather than "off" when run without elevation, so the enable step is skipped entirely, and on Windows the OpenSSH install is routed through a Unix shell that isn't there. BleepingComputer's teardown and the Phorion analysis reach the same conclusion. That is luck, not design, and it is not comfort: the key was still added and the persistence scripts still landed, which is why Cursor's advice is that uninstalling the extension may not be enough. The company's remediation steps assume a rebuild for any host showing execution, and credential rotation from a clean machine.
Cursor's response was thorough once it knew: pull the version, take the entire marketplace offline, audit access, rotate keys, rebuild, reopen, and work with the hosting provider to take the attacker's server down. It says no other extensions were tampered with, and that npm, Open VSX and Microsoft's marketplace were never involved — early reports claimed otherwise and were corrected. The open question is the one nobody has answered: how did a modified build get published under Anthropic's publisher identity and version number? The Hacker News and BleepingComputer both press on that gap, and it is the difference between a malware listing a careful developer could avoid and a poisoned update delivered by the trust chain itself.
That distinction is the story. Every AI coding tool now asks for the same things — your repository, your shell, your cloud tokens, often your whole home directory — and then hands extension updates to a marketplace that auto-applies them. The model, the benchmark scores and the harness get argued about endlessly; the publish path gets a status page. This is the npm problem of 2016 relocated into a tool that is holding more keys than npm ever did. It also isn't a one-off: this is the second time this month that the Claude name has been used as bait, after fake Claude installers rode Bing ad redirects to developers looking for the real thing.
If you installed or updated the Claude Code extension through Cursor on macOS or Windows yesterday, the marker is a public key with the comment svc-telemetry in your SSH authorized-keys file; Cursor publishes detection and remediation scripts for both platforms. Rotate anything reachable from that machine from a machine that wasn't affected.
Salesforce signed a definitive agreement to buy Rune Technologies, a two-year-old maker of AI logistics software for the military, in the company's largest national-security deal to date. Salesforce announced the agreement on October 29 and expects it to close in the fourth quarter of its 2027 fiscal year; terms were officially undisclosed, though Resilience Media reported a $375 million price in cash and stock, citing two sources — neither company has confirmed that figure.
What Salesforce is buying is less glamorous than a weapons system and more useful: Rune's TyrOS is an operating system for military sustainment, forecasting and optimizing inventory, personnel, equipment and distribution at the tactical edge, where connectivity is denied or intermittent and the software has to keep working and resync later. Add an agentic logistician called Saga, sensor tags, and a five-year, $99 million Army contract awarded in June, and you have a company that raised roughly $30 million — a16z led its 2025 seed, Human Capital led the Series A — and just sold for more than ten times that. Kendall Collins, who runs Salesforce's Missionforce unit, framed the deal as extending "agent-powered capabilities to the tactical edge."
The strategic read is straightforward: defense logistics is where AI agents have a customer with a budget, a measurable outcome and no patience for demos. The moat isn't the model. It's the parts that survive a comms blackout.
Starbucks wants its drive-thru menu board to recognize you as you pull up. On the company's quarterly earnings call Thursday, CEO Brian Niccol said Starbucks will explore "experiences that recognize participating customers as they arrive, present personalized digital menus, and make payment more effortless," as The Verge reported. From 2027 the chain also plans to test background AI models that help baristas enter orders more accurately, and to put AI into the app's search and discovery.
The operative word is "participating." Personalized menus only ship without a privacy fight if customers opt in, and Niccol was careful to call the whole thing early — "we'll test, learn, and scale what works." Taco Bell has tested menus that change car by car; McDonald's has piloted a chatbot that remembers your usual. Starbucks is late, and being late with the least creepy version may be the right call.
What to watch: whether Cursor explains its publishing pipeline, and whether Anthropic starts signing extension builds itself. Until one of them does, every AI editor update is an act of faith.
Has an editor extension ever asked for more access than you were willing to give it? Write to us via our contact page.
