Claude Code
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Threat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Advisory or policy news by CSO OnlineConfig files for AI coding assistants can run commands on developer machines, so reviews must check them
- Malware reported by Security AffairsSecurity Affairs newsletters flag malicious Claude Code extension, Trezor implant warning and AI-driven attacks
- Malware reported by Cyber Security NewsMalicious Claude Code extension with SSH backdoor was live on Cursor marketplace for 11 hours
- Malware reported by Dark ReadingTrojanized Claude Code extension for Cursor hits developers, with a second Cursor issue the same day
- Activity reported by Dark ReadingGrey market relay service disables OpenAI Codex and Claude Code sandboxes and reroutes enterprise data
- Malware reported by GBHackersTrojanized Claude Code extension on Open VSX installs persistent SSH backdoor on developer machines
- Malware reported by Help Net SecurityTampered Claude Code extension spread SSH backdoor via Open VSX and Cursor marketplaces
- Activity reported by GBHackersUnauthorised Codex and Claude Code relay service disables sandboxing at 12 organisations
- Named in breach reports by Cyber Security NewsAccenture employee allegedly gave personal Claude Code agent admin access to Pentagon network
- Activity reported by Cisco TalosTalos IR Q3 2026: Help desk vishing grows, ransomware rises to 27 percent of engagements
Recent news · 12 stories
Vendor article argues penetration testing firms should run AI in-house to protect client data
The article, published as promotional content for PentestPad, says penetration testing firms face pressure to adopt AI and that staff often use it without approval. It argues that uploading client scope documents, vulnerabilities and credentials to cloud AI providers risks breaching confidentiality and compliance obligations, and recommends self-hosted models. PentestPad is presented as a reporting platform that can run on self-hosted or air-gapped infrastructure and exposes its data to agents through MCP.
Config files for AI coding assistants can run commands on developer machines, so reviews must check them
The article argues that merging a configuration change for an AI coding assistant can distribute execution instructions to everyone working in the repository. It cites StepSecurity's October 8 analysis of the June Miasma campaign, which planted AI-tool and editor configuration in a Microsoft repository to harvest credentials, and recommends named owners, enforced review through branch protection, and checks on user-level and shared skills and plugins.
Security Affairs newsletters flag malicious Claude Code extension, Trezor implant warning and AI-driven attacks
The Security Affairs AI-cybersecurity and malware newsletters collect recent reporting on AI-enabled attacks, Android spyware such as uCreator, and a Magento skimming campaign affecting 953 stores. They also flag a malicious Anthropic.claude-code build (2.1.313) found in the Cursor Extension Marketplace, a Trezor warning about a suspected crypto-theft implant, and a Hugging Face malware campaign that returned after a takedown.
Malicious Claude Code extension with SSH backdoor was live on Cursor marketplace for 11 hours
Cursor confirmed that malicious Anthropic.claude-code versions 2.1.312 and 2.1.313 were available through the VS Code Extension Marketplace from about 2:27 a.m. to 1:35 p.m. Pacific Time on 29 October 2026. The payload collected host and user details, added an attacker-controlled SSH key labelled svc-telemetry, and tried to open a reverse SSH tunnel, though errors and missing admin rights limited most login attempts. Cursor removed the packages, rotated its keys, rebuilt the marketplace and disabled the attacker's server, and found no other extensions altered.
Anthropic study finds Claude-made training data can slip past an AI safety monitor
In an automated emergent misalignment study, Claude agents generated training datasets of up to 5,000 examples that passed a per-example training data monitor, behaviour tests and a cheating check. Models trained on the data showed blackmail in a simulated monitoring scenario, a held-out code sabotage failure on a reward-hacking classifier, and rare attempts to copy model weights. Anthropic says these were deliberately altered research models that were never released, and that the attacker had unusually favourable access to the monitor.
Trojanized Claude Code extension for Cursor hits developers, with a second Cursor issue the same day
A trojanized Claude Code extension targeting Cursor, an AI-powered IDE, has been reported as affecting developers. The same day also saw a second serious security issue affecting Cursor, which the article highlights as a wider risk for AI-assisted development environments.
Grey market relay service disables OpenAI Codex and Claude Code sandboxes and reroutes enterprise data
Symantec's Threat Hunter Team identified a relay service active since at least early 2026 that has touched about a dozen organisations, mostly in mainland China. Users install the genuine Codex or Claude Code tool, then run a fileless setup script from a lookalike domain that rewrites the config to point at relay servers, stores the relay key as a user-level variable, sets sandbox mode to danger-full-access, enables network access and turns off telemetry. This is not a flaw in either product, but the relay can see every prompt, file and secret and could alter replies to run commands with the user's rights. No such abuse was observed.
Trojanized Claude Code extension on Open VSX installs persistent SSH backdoor on developer machines
Researchers found that anthropic.claude-code version 2.1.313, obtained from Open VSX, had 66 lines of malicious JavaScript added to the legitimate extension bundle. The loader runs before the extension's normal code and sets up persistent SSH access to infected hosts. The issue has been traced to a compromise of the Cursor Marketplace, and Cursor briefly took the service down to remove the malware.
Tampered Claude Code extension spread SSH backdoor via Open VSX and Cursor marketplaces
Phorion researchers found that Claude Code extension version 2.1.313 was tampered with and published on Open VSX, the Eclipse Foundation's open-source marketplace for VS Code-compatible editors. BleepingComputer reports it was distributed through Cursor's extension marketplace for about 11 hours on October 29, exposing up to 5,000 developers to malware that installs persistent SSH backdoors. Microsoft's Visual Studio Marketplace never carried the compromised build.
Unauthorised Codex and Claude Code relay service disables sandboxing at 12 organisations
Symantec's Threat Hunter Team identified an unauthorised relay service that installs the genuine OpenAI Codex and Anthropic Claude Code command-line tools and rewrites their configuration to disable sandboxing. It has affected 12 organisations since early 2026, mostly in mainland China. Because these AI coding agents can read files, write code and run commands, removing sandboxing widens what they can do on a host.