How Cortex AES Protects Against Compromised Claude Code Extensions

Introduction

On October 29, 2026, attackers turned a trusted developer tool into a potential backdoor. Malicious versions of the Claude Code extension were distributed through Cursor's extension marketplace, exposing developers to malware capable of collecting host information, establishing persistence, and attempting to enable unauthorized remote access. In just 11 hours, up to 5,000 Cursor users were potentially exposed.¹

The incident highlights a growing security challenge: as developers increasingly rely on AI coding assistants, the extensions and tools supporting these workflows are becoming attractive targets for software supply chain attacks. A seemingly routine extension update can introduce malicious code directly into a developer's environment, putting sensitive credentials, source code, and enterprise systems at risk.

Traditional endpoint security remains essential, but organizations also need visibility and control over the AI tools, extensions, and supporting components that developers install and execute. Cortex Agentic Endpoint Security (AES) helps close this gap by providing continuous discovery, granular risk assessment, governance, and runtime protection for agentic environments. In this blog, we examine what happened in the Claude Code extension compromise, why it matters for enterprise security, and how Cortex AES helps organizations protect their developer workspaces against similar threats.

The Threat: How Attackers Weaponized a Claude Code Extension

On October 29, 2026, maliciously modified versions 2.1.312 and 2.1.313 of the Claude Code VS Code extension (anthropic.claude-code) were distributed through Cursor's Extension Marketplace (Mirrors OpenVSX). The compromised packages targeted macOS and Windows systems and contained malicious code embedded in the extension's extension.js bundle. These modifications were not developed by Anthropic, but due to the open marketplace the poisoned extension was downloaded by many developers.

For approximately 11 hours, developers who installed or updated the affected extension risked unknowingly executing a malicious payload on their machines.

Once loaded, the extension attempted several actions:

1. Host Reconnaissance: Collected system information, including operating system details, usernames, working directories, public IP addresses, and environment variable names, and transmitted telemetry to attacker-controlled infrastructure at 134.209.82.225:8099/beacon.
2. Backdoor Installation: Added an unauthorized SSH public key (svc-telemetry) to the host's authorized keys and attempted to enable SSH access and establish a reverse tunnel to the attacker's command-and-control (C2) infrastructure.
3. Persistent Access: Attempted to establish persistence through a macOS LaunchAgent or Windows scheduled tasks and startup scripts, allowing the malicious process to continue attempting connections independently of the extension.

Although the malware attempted to establish persistent remote access, Cursor reported that errors in the payload and insufficient administrative privileges generally prevented the SSH backdoor from becoming operational. However, the malware could still install persistence mechanisms and transmit host information.

The compromised versions have since been removed from Cursor's marketplace, and the attacker-controlled infrastructure has been taken offline.

The Security Challenge: Protecting the AI Developer Supply Chain

What makes this incident particularly concerning is how the malicious code reached developers. Rather than exploiting a traditional software vulnerability, attackers distributed malicious code through a familiar extension marketplace, using an established development workflow as the entry point.

As AI coding assistants become embedded in enterprise development environments, organizations face an expanding attack surface. IDE extensions, MCP servers, and other AI supporting components can execute code, interact with local resources, and operate within environments containing sensitive enterprise assets.

Protecting the modern developer workspace requires extending security beyond traditional endpoint defenses to the AI tools and software artifacts operating within it.

Beyond the Extension: The Open VSX Marketplace Takeover

To fully understand the severity of this threat, we must look at how the foundation itself was breached. Prior to this incident, security researchers at Koi uncovered a critical vulnerability in the Open VSX marketplace - the open-source extension registry powering alternative IDEs like Cursor and Windsurf. By exploiting flaws in publisher verification and namespace management, researchers demonstrated how an attacker could execute a complete takeover of marketplace accounts and published extensions.

When a developer marketplace itself is compromised, the chain of trust is completely broken. Security models in modern IDEs rely heavily on implicit trust in publisher identities and versioning. When attackers control the registry, there are virtually no limits to what can be delivered: clean extensions can be silently replaced with malicious updates, signed packages can be hijacked, and thousands of developer environments can be poisoned overnight without triggering traditional warnings.

The Claude Code extension compromise is a stark real-world realization of these systemic supply chain risks. It reinforces why our research team works continuously to uncover core platform vulnerabilities, defend extension marketplaces, and protect developer supply chains before attackers can exploit them at scale.

How Cortex AES Helps Protect Against Compromised Extensions

Cortex Agentic Endpoint Security (AES) is designed to help organizations address these emerging risks by securing the agentic endpoint and their related AI artifacts through the entire enterprise. 

In the context of the Claude Code extension compromise, several Cortex AES capabilities help organizations reduce exposure to similar supply chain attacks:

1. Continuous Discovery and Visibility

Cortex AES provides visibility into AI agents, IDE extensions, MCP servers, and other supporting components operating across enterprise endpoints. This allows security teams to maintain an inventory of AI tools in their environment and identify potentially affected assets when a security incident emerges.

For an incident like the Claude Code compromise, visibility into installed extension versions helps security teams determine which endpoints may require investigation or remediation.

2. Version-Level Risk Assessment

Not all versions of a trusted extension carry the same level of risk. As demonstrated by the Claude Code incident, a specific update can introduce malicious functionality even when the underlying application is legitimate.

Cortex AES helps security teams assess risks associated with individual extensions and software versions, enabling them to identify suspicious or potentially compromised artifacts and prioritize remediation.

3. Proactive Governance and Policy Enforcement

Cortex AES enables organizations to establish security policies governing which AI tools and supporting components are permitted to operate in their environments.

Rather than relying solely on marketplace trust or developer discretion, security teams can apply controls to restrict risky or unauthorized extensions and remove insecure components. These guardrails help reduce the likelihood that compromised artifacts will be introduced into developer environments.

4. Real-Time Runtime Protection

Even trusted tools can become compromised. Cortex AES complements preventive controls with runtime protection designed to detect and stop malicious activity associated with AI tools and agentic workflows.

Together, these capabilities provide a layered approach to securing agentic development environments, helping organizations reduce software supply chain risk without unnecessarily slowing down employee workflows.

Recommended Actions: Detect, Contain, and Remediate

While proactive security controls help reduce exposure to compromised extensions, organizations that may have installed the affected Claude Code versions should take immediate steps to investigate and remediate potential compromise.

Security teams should prioritize the following actions:

1. Identify affected endpoints: Review installed extensions and identify macOS or Windows systems that installed or updated anthropic.claude-code versions 2.1.312 or 2.1.313 from Cursor's marketplace during the exposure window. Cortex AES customers can use available extension inventory and endpoint visibility to support this assessment.
2. Investigate and contain: Search for the unauthorized SSH key svc-telemetry, suspicious persistence mechanisms, and outbound connections to 134.209.82.225. Isolate endpoints showing evidence of malicious payload execution.
3. Remove malicious artifacts: Uninstall the compromised extension and remove associated SSH keys, persistence scripts, scheduled tasks, and malicious processes. Since these mechanisms can persist after uninstalling the extension, follow the official Cursor remediation guidance and assess whether affected hosts require rebuilding.
4. Rotate potentially exposed credentials: Rotate source-control credentials, cloud keys, SSH credentials, registry tokens, and active sessions accessible from impacted systems. Perform credential rotation from a trusted, uncompromised endpoint.
5. Block and monitor: Block communications with the identified attacker infrastructure and review endpoint and network telemetry for suspicious activity or evidence of additional compromise.

Technical Reference: Affected Versions and Indicators of Compromise

The following information can help security teams identify potentially affected environments.

Affected Items

Key Indicators of Compromise

Network indicators

• C2 IP address: 134.209.82[.]225
• HTTP beacon: hxxp://134[.]209[.]82[.]225:8099/beacon
• Reverse SSH connections to the C2 infrastructure over TCP port 22

Host indicators

• Unauthorized SSH key comment: svc-telemetry
• macOS LaunchAgent: com.apple.sysmond.plist
• Windows scheduled task: SysMon
• Persistence artifacts including .config/.smt and .config/smt.cmd

File hashes and fingerprints

• SHA-256 (extension.js): ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15
• Unauthorized SSH public key fingerprint: SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk

For comprehensive platform-specific indicators, affected package hashes, verification commands, and remediation scripts, refer to Cursor's official security notice.

Securing the Future of Agentic Workspaces

The Claude Code extension compromise reinforces a critical lesson: as AI becomes embedded in everyday workflows, securing the enterprise requires protecting not just AI models, but the entire ecosystem of tools, extensions, and execution environments supporting them.

Palo Alto Networks is continuing to advance this approach through Cortex Agentic Endpoint Security and its collaboration with Anthropic. While Cortex AES helps organizations govern and protect AI tools and supporting components, the newly announced Cortex XDR integration with Anthropic's Claude Cowork will extend security visibility and threat detection into desktop AI agent execution environments.

By bringing enterprise-grade endpoint security into agentic workflows, Palo Alto Networks is helping organizations adopt AI-powered tools with greater visibility, control, and confidence.

To learn more about this collaboration, read New Cortex XDR Integration with Claude Cowork Secures Desktop AI Agents.

SOURCE: 

1. https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html