Anthropic denies breach as tampered Claude Code extension hits Cursor users
Comments on “Anthropic denies breach as tampered Claude Code extension hits Cursor users”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Cursor said tampered versions 2.1.312 and 2.1.313 of the Claude Code extension were live in its marketplace for about 11 hours on 29 October, reaching up to 5,000 users. The code tried to add an attacker's SSH key, enable SSH and upload machine details and the names of secret-like environment variables. Anthropic says its systems were not breached; Phorion says the upload used Anthropic's official account. How the attacker got access is unstated. Auto-updating extensions are a supply-chain risk, and uninstalling may not remove the backdoor.
Why it ranked
No. 6 of 59 with a score of 0.73. The panel rated it highest on reader interest (0.90) and practical relevance (0.88), lowest on audience breadth (0.58). The judges disagreed most on new information (spread 0.57), so the story is marked contested. Placed No. 6, No. 5 by score alone: the fifth Security story of the day (−0.040), and close to “Official Claude Code extension compromise”, No. 3 on Saturday 31 October 2026 (−0.014). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Supply-chain compromise of a widely used AI coding extension with a clear, actionable remediation path; strongly on-topic and security-focused, but a single incident with partly unresolved attribution limits significance and breadth.
- AI judgeJudge 3gpt-5.6-luna
- A well-supported report on a developer-tool supply-chain compromise affecting thousands, with concrete malware behavior and remediation guidance. It overlaps recent Claude Code compromise coverage but adds incident-specific details and actionable defensive steps.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.73total under rubric v2.3Contestedjudges differ by 0.57 on new information
- Significance0.68
- Reader interest0.90
- Audience breadth0.58
- Practical relevance0.88
- Substantiated0.71
- Technical depth0.63
- New information0.64
- Counts against: Promotional0.04
- Counts against: Overclaim0.21
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.71 | 0.55 | 0.78 | 0.68 | 0.23 | +0.24 | +0.163 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.85 | 0.90 | 0.95 | 0.90 | 0.10 | +0.26 | +0.234 |
| Audience breadthHow many people who build technology does it concern? | 0.39 | 0.67 | 0.67 | 0.58 | 0.28 | +0.13 | +0.075 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.88 | 0.90 | 0.86 | 0.88 | 0.04 | +0.22 | +0.194 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.72 | 0.60 | 0.80 | 0.71 | 0.20 | +0.05 | +0.035 |
| Technical depthHow technically substantive is it? | 0.73 | 0.55 | 0.62 | 0.63 | 0.18 | +0.05 | +0.032 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.66 | 0.35 | 0.92 | 0.64 | 0.57 , above the contested threshold | +0.05 | +0.032 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.06 | 0.03 | 0.02 | 0.04 | 0.04 | −0.19 | −0.007 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.21 | 0.25 | 0.18 | 0.21 | 0.07 | −0.11 | −0.023 |
| Sum of contributions | +0.735 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.735 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-01/6/"><img src="https://rubric.hrih.si/badge/2026-11-01/6.svg" alt="Ranked #6 on Rubric, 1 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 5 matches source · 3 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkNumber
A tampered copy of Anthropic's Claude Code extension was available in Cursor's extension marketplace for about 11 hours on Thursday 29 October and reached up to 5,000 users.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “A tampered copy of Anthropic’s Claude Code extension sat in Cursor’s extension marketplace for about 11 hours on Thursday 29 October. It reached up to 5,000 users”
The source says No passage could be compared.
Source cited by the article: cursor.com/blog/claude-code-extension-security-notice
Matches sourceCausal conclusion
The malicious extension versions tried to plant an SSH backdoor on developers' machines, according to Cursor.
The cited source says the same thing.
The article says “The malicious versions tried to plant an SSH backdoor on developers’ machines, Cursor said in a”
The source says “The extension runs malicious code that attempts to install a persistent SSH backdoor”
Source cited by the article: cursor.com/blog/claude-code-extension-security-notice
Matches sourceVersion
The affected versions were 2.1.312 and 2.1.313 for Windows and macOS, live from about 2:27am to 1:35pm Pacific time.
The cited source says the same thing.
The article says “The affected versions were 2.1.312 and 2.1.313 for Windows and macOS. They were live from about 2:27am to 1:35pm Pacific time”
The source says “Anthropic.claude-code version 2.1.312 and 2.1.313 for Windows and MacOS”
Source cited by the article: cursor.com/blog/claude-code-extension-security-notice
Matches sourceDate
SpaceX acquired Cursor earlier this year.
The cited source says the same thing.
The article says “Cursor, which SpaceX acquired earlier this year”
The source says “SpaceX closed the $60B all-stock acquisition of Cursor after agreeing it in June”
Source cited by the article: thenextweb.com/news/openai-ends-cursor-contract-spacex-acquisition-eu-switching-rules
Matches sourceCausal conclusion
The reverse tunnel step needs administrator rights, which the extension lacks on most macOS and Windows machines, so it would usually fail, but the SSH key, persistence scripts and data upload still went through.
The cited source says the same thing.
The article says “So it would usually fail, Cursor said. But the key, the persistence scripts and the data upload still went through”
The source says “turning on the local SSH service requires admin rights, which the malicious extension does not have on most macOS and Windows hosts. On those hosts the step fails”
Source cited by the article: cursor.com/blog/claude-code-extension-security-notice
Couldn’t checkQuote
Anthropic's Felix Rieseberg said the incident was not a compromise of Anthropic's systems or employee laptops, and that a malicious actor used access to Cursor's marketplace to publish the tampered extension.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension”
The source says No passage could be compared.
Source cited by the article: x.com/felixrieseberg/status/2116170451466543578
Couldn’t checkQuote
Phorion's CTO Luke Roberts said the malicious version 2.1.313 was posted to the official Anthropic account, superseding 2.1.312.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312,” Roberts told Ars”
The source says No passage could be compared.
Source cited by the article: arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours
Matches sourceNumber
The malware sent the names, but not the values, of up to 40 environment variables matching keys, tokens and secrets, according to Phorion.
The cited source says the same thing.
The article says “The malware also sent the names of up to 40 environment variables matching keys, tokens and secrets, but not their values, Phorion found”
The source says “Up to 40 environment variable names (not values) matching /KEY|TOKEN|SECRET|PASS|AWS|GCP/i”
Source cited by the article: phorion.io/blog/offical-claude-code-vsx-compromise
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN —
Recorded for context only, checked 1 Nov 2026, 05:47 UTC. It played no part in the ranking.