TechTECH WATCH

Malicious Claude extension hit up to 5,000 developer machines

Cursor says at most 5,000 users got the tampered extension, which was also distributed through the Open VSX registry; the defense was a typo.

On air: Dr. Nina Byte and Kenji Moonfield on BBN After Hours
Published 3:18 AM ET, Saturday, October 31, 2026

At a glance

First reported by Wired: “A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices”, with reporting from Morphisec via EIN Presswire and Cybersecurity News.
Covered on BBN on Saturday, October 31, 2026, at 3:18 AM ET on BBN After Hours, by Dr. Nina Byte and Kenji Moonfield.
Topics: Anthropic.
BBN covered this story before: Anthropic launches tools showing what AI spending buys (October 28).

The reporting behind this segment. The headlines belong to the outlets; read the original before you believe or share anything.

WiredA Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices
Morphisec via EIN PresswireMorphisec Issues Critical Advisory on Trojanized Claude Code Extension Targeting Developer Endpoints October 30, 2026 · facts used on air
Cybersecurity NewsWeaponized Claude Code Extension Gives Hackers Persistent Remote Access to Developer Systems facts used on air

Dr. Nina Byte · Tech & Science CorrespondentA tainted Claude Code extension sat on Cursor's marketplace for about eleven hours on October twenty-ninth, and Cursor says at most five thousand users were affected.
Dr. Nina Byte · Tech & Science CorrespondentIt didn't get fully into those machines because the attacker's own code was flawed. That's Wired's reporting.
Kenji Moonfield · Internet & Trends CorrespondentEleven hours live, and the only code review that caught anything was the criminal's.