Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

On October 29, 2026, a trojanized version of Anthropic's official Claude Code extension (version 2.1.313) was distributed through Cursor's IDE marketplace under the legitimate publisher identity anthropic.claude-code. Between approximately 2:27 a.m. and 1:35 p.m. PT, up to 5,000 developers auto-updated to the malicious build, which injected a 66-line JavaScript loader to plant an attacker-controlled SSH key labeled "svc-telemetry," establish a reverse tunnel to 134.209.82.225, install cross-platform persistence, and beacon host reconnaissance data—including environment variable names referencing cloud credentials—over unencrypted HTTP to port 8099.

This incident reflects a sharp escalation in software supply-chain attacks targeting AI developer tooling. As agentic AI extensions gain privileged access to developer workstations and cloud credential stores, attackers are exploiting marketplace trust relationships and auto-update mechanisms to achieve persistent footholds at the earliest stage of the software development lifecycle, compressing the window between initial compromise and credential exposure.

Why This Matters Now

AI coding assistants like Claude Code now run with elevated IDE privileges on machines holding cloud credentials, CI/CD tokens, and production secrets. The Cursor marketplace incident demonstrates that attackers are actively targeting this high-value vector: a single poisoned auto-update can silently backdoor thousands of developer endpoints before security teams detect anomalous outbound traffic, making supply-chain integrity and egress visibility urgent priorities for any organization using AI-powered development tools.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

The attackers published version 2.1.313 under Anthropic's legitimate Claude Code publisher identity (anthropic.claude-code) on Cursor's marketplace, exploiting developer trust in the existing extension ID and auto-update behavior. Because the malicious code was prepended to the legitimate JavaScript bundle, the extension appeared fully functional while silently installing an SSH backdoor.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this supply chain attack because the malicious extension relied on unrestricted outbound connectivity and implicit east-west trust to establish C2 tunnels and pivot toward cloud credentials. By enforcing identity-aware segmentation and controlled egress across cloud workloads, Aviatrix would likely have reduced the attacker's ability to reach internal infrastructure and exfiltrate reconnaissance data after initial code execution.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: CNSF's workload-aware fabric would likely constrain the reach of newly executed extension code by reducing the set of cloud resources and internal segments reachable from developer workstation network paths, limiting how far the initial foothold could extend into cloud environments.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation would likely reduce the value of a planted SSH backdoor by constraining which internal segments and cloud resources the compromised workstation could reach, even with a valid local shell, limiting the attacker's ability to expand privilege scope beyond the initially infected host.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic enforcement would likely constrain the attacker's ability to move laterally from a compromised developer workstation toward cloud APIs, internal services, and CI/CD infrastructure, reducing reachability across segments that would otherwise be accessible through implicitly trusted internal network paths.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility and control would likely surface anomalous outbound SSH and HTTP connections to an unknown external IP, and policy enforcement could constrain unauthorized outbound tunneling from workload environments, reducing the reliability and persistence of the attacker's C2 channel.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security policy enforcement would likely constrain unauthorized HTTP beacon traffic destined for unknown external IPs, reducing the attacker's ability to reliably exfiltrate host reconnaissance data including credential metadata from cloud-connected developer environments.

Impact (Mitigations)

Even with persistent backdoors established on developer workstations, the constrained east-west segmentation and egress policies applied across cloud environments would likely reduce the attacker's ability to convert workstation footholds into meaningful cloud infrastructure access, limiting the scope of credential abuse and downstream supply chain pivots.

Impact at a Glance

Affected Business Functions

  • Software Development Toolchain Integrity
  • Developer Workstation Security
  • Cloud Credential and Secrets Management
  • CI/CD Pipeline and Repository Access Control
Operational Disruption

Estimated downtime: 1 days

Financial Impact

Estimated loss: N/A

Data Exposure

Up to 5,000 affected developer workstations had the following data exfiltrated to attacker-controlled infrastructure at 134.209.82.225: public IP address, hostname, local username, operating system and CPU architecture, home and working directory paths, global Git email address, and the names (not values) of up to 40 environment variables matching patterns such as KEY, TOKEN, SECRET, PASS, AWS, and GCP. The enumeration of environment variable names reveals the presence of cloud provider credentials (AWS, GCP), CI/CD tokens, and API keys, enabling targeted follow-on attacks. Additionally, an attacker-controlled SSH key labeled 'svc-telemetry' was injected into each victim's ~/.ssh/authorized_keys file, and platform-specific persistence mechanisms (scheduled tasks on Windows, crontab on Linux, LaunchAgent on macOS) were installed. A reverse SSH tunnel to 134.209.82.225 was established, providing the attacker with potential interactive shell access to affected developer machines. On macOS and Windows hosts without admin rights, the local SSH service enablement failed, partially limiting direct tunnel ingress, but the SSH key injection, persistence, and beacon transmission still occurred on all platforms.

Recommended Actions

  • • Deploy Egress Security & Policy Enforcement (CNSF): Block unauthorized outbound connections to unknown IPs and non-approved FQDNs at the network edge. The unencrypted HTTP beacon to 134.209.82.225:8099 and the reverse SSH tunnel to port 22 would have been detectable and blockable by egress FQDN filtering and outbound policy enforcement, directly preventing C2 establishment and data exfiltration from developer endpoints and cloud workloads.
  • • Enforce Multicloud Visibility & Control for Anomaly Detection: Implement centralized traffic observability across developer workstations and cloud-connected endpoints to baseline normal outbound behavior. Anomalous beaconing patterns, new SSH tunnel initiations, and connections to newly observed external IPs from IDE processes would surface as high-confidence alerts, enabling rapid containment within the 11-hour exposure window.
  • • Apply Zero Trust Segmentation to Restrict Developer Workstation Blast Radius: Enforce identity-based microsegmentation policies that prevent developer workstations from initiating lateral SSH connections to internal cloud resources, CI/CD pipelines, or production environments. Least-privilege network access ensures that even a fully compromised developer host cannot pivot into cloud control planes or internal APIs without explicit policy authorization.
  • • Leverage Cloud Native Security Fabric (CNSF) for Inline Enforcement Against Supply Chain Threats: Apply inline policy enforcement and real-time inspection at the cloud network layer to detect and block agentic or extension-based processes initiating unexpected outbound tunnels or writing to sensitive system paths such as ~/.ssh/authorized_keys. CNSF distributed policy enforcement provides a control layer independent of endpoint trust, directly mitigating supply chain compromise scenarios where the malicious code executes within a trusted application context.
  • • Encrypt and Inspect East-West and Egress Traffic with Encrypted Traffic Controls (HPE): The beacon transmission occurred over unencrypted HTTP, making it trivially inspectable. Mandating encrypted traffic for all legitimate workloads and using high-performance encryption with traffic inspection at egress points ensures that unencrypted outbound data transfers are flagged as policy violations, while also protecting legitimate developer traffic from interception by actors using similar packet-sniffing techniques on shared network segments.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image