A Backdoored Claude Code Extension Traveled Through an Approved AI Tool. That Is Shadow AI Governance.

For about eleven hours on October 29, Cursor’s extension marketplace served a tampered copy of Anthropic’s Claude Code extension to developers on macOS and Windows. Version 2.1.313 carried Anthropic’s name, sat under Anthropic’s official publisher account, and was not Anthropic’s build. Cursor puts the blast radius at “at most 5,000 users” who installed or updated in the window, and its advisory states plainly: “These malicious versions of the extension were not developed by Anthropic.”

The attack path was the supply chain’s favorite door: a trusted distribution channel inside an approved AI tool, with auto-updates turned on. Developers did not download anything suspicious. They let an approved tool update itself, the way teams do every day on every machine, and received an extra sixty-six lines of someone else’s code ahead of the legitimate extension. It never required anyone to open a Claude conversation; the loader ran when the editor did.

What the payload actually did

Cursor’s advisory lists the attempts in order. First, reconnaissance: “Collects and reports host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.”

Second, remote access. The tampered code added an attacker-controlled SSH key to the developer’s authorized_keys file, then tried to enable the local SSH service and open a reverse tunnel. On most machines that step failed: “Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail.”

Third, persistence for the cases that did not fail: a LaunchAgent on macOS, a scheduled task on Windows, background scripts retrying the tunnel roughly every sixty seconds, and on Linux a crontab @reboot entry that re-created the tunnel key and reconnected the loop, with Phorion noting a bug in that crontab check that could wipe a user’s existing cron jobs on repeat runs. The SSH key arrived dressed as a telemetry account, labeled svc-telemetry, the kind of label an admin glances past. Phorion’s analysis found the beacon reported up to forty environment variable names matching key, token, secret, pass, AWS, or GCP patterns. Not the values; the names. An attacker who gets one foothold later now has a map of which machines hold which credentials.

Cursor’s response was fast and correct: malicious versions removed and distribution blocked, the whole marketplace taken down as a precaution, keys rotated, the marketplace rebuilt, and the attacker’s server taken offline with the hosting provider. The company points anyone who installed the affected versions (2.1.312 and 2.1.313) to a validation script and to version 2.1.314. One relief worth stating precisely: the tampered build lived only in Cursor’s marketplace, with no evidence it reached the other distribution channels, and Anthropic’s fixed 2.1.314 is live on the unaffected official stores. Anthropic, for its part, denied any breach of its systems: engineering manager Felix Rieseberg said the company is “working with Cursor on this incident” and that it did not involve a compromise of Anthropic’s systems or employee laptops. How the attacker obtained the ability to publish from Anthropic’s official account is still unknown.

The part that makes this a governance story

The same day, attackers drained $6.3 billion from Binance, and Binance’s initial findings point to a compromised DevOps engineer’s laptop as the way in. Two trusted-path failures on engineer endpoints, hours apart, and in neither case did the attacker have to breach the vendor’s own systems first.

The Binance detail that should stick with every CTO: the wallet-signing service authenticated the caller and then signed whatever came in. The Claude Code detail that should stick right beside it: the distribution channel authenticated the publisher account and then served whatever came in. Identity was verified in both cases. Intent was never checked, because nobody had drawn the line yet.

That is the shadow AI problem in miniature, and it does not stay in the IDE. The Palo Alto Networks 2026 Identity Security Landscape, from a survey of more than 2,900 security leaders, reports machine identities outnumbering humans 109 to 1, that 99 percent of organizations have adopted AI agents, and that 40 percent of those agents already touch production data. Only 37 percent of organizations can revoke an AI agent’s credentials, and 30 percent keep an audit log of what agents do. The approved tool installed with a tampered update is exactly the asset those numbers describe: present, privileged, unsupervised.

Shadow AI usually means the unapproved stuff, the desktop chatbot, the unmanaged API key, the agent a team spun up without telling anyone. The Cursor incident adds the rarer, sharper case: approved AI tooling whose update path became the attack. Both live in the same governance gap. You cannot inventory your way out of one and ignore the other, because the attacker does not care which policy bucket the process sat in. Your developers were running Claude Code inside Cursor; the label on the marketplace listing was true; the code behind it moved anyway.

What to run this quarter

Five controls, none of which require buying anything before the inventory exists:

1. Inventory AI tooling where it actually runs: IDE extensions, CLIs, agent frameworks, MCP servers, browser AI assistants, plus the models behind them, each with a version and an owner. Shadow AI discovery and approved-tool registration are one exercise, not two; the MCP security checklist starts the same list.

2. Treat updates to AI tooling like releases, not patches. Pin versions where you can, stage auto-updates for anything with shell or extension-host privileges, and require provenance checks on new majors. The tampered build worked because auto-updates were default and the publisher label was trusted.

3. Put the same least-privilege discipline on developer endpoints that you put on servers. The payload failed where it lacked admin rights, and succeeded at the lower bar of key insertion, persistence, and reporting. Watch authorized_keys files, startup persistence paths, and outbound SSH from engineering subnets; that tunnel was the plan, and its failures were its alibi.

4. Assume AI output and AI tooling behavior both need filtering. The extension never waited for a user prompt, which is the pattern to encode in endpoint rules: AI software that acts before you ask is production software in a new wrapper.

5. Make it auditable. Change records for AI tool updates, agent inventories, and revocation drills are exactly the evidence a SOC 2 or exam conversation expects, and the gap there is the one our SOC 2 analysis unpacks.

What management should do next

Ask your engineering leaders two questions with dates in the answers. When did we last inventory the AI extensions, CLIs, and agent tools running on developer machines, approved or not? And if Cursor’s advisory had named one of our machines, how long until we could prove it did not hold our tokens?

If the answers take longer than a day to produce, your exposure is not the extension; it is the absence of an inventory. Our AI governance policy template ships with the registration, update-gate, and revocation fields this incident makes urgent, and it drops into a broader AI governance program. You can contact NTD Consulting for a second pair of eyes on your AI tooling estate, and teams selling into regulated finance can start with our fintech cybersecurity work, where the same shadow AI question now shows up in client due diligence.

Ron Moore runs NTD Consulting, which provides fractional CISO and cybersecurity advisory services to mid-market SaaS, fintech, and digital-asset companies.