← Back to the post

Verification log

Anthropic’s Claude VS Code extension compromised, installing SSH backdoor on thousands of developers’ machines

Checked

61

Confirmed

48

Re-cited

2

Removed

11

Written by groq:openai/gpt-oss-120b. "Re-cited" means the fact was found in another source about the same story, and the citation was corrected. Removed statements never reached the post.

• Confirmed headline

  Anthropic’s Claude VS Code extension compromised, installing SSH backdoor on thousands of developers’ machines

• Confirmed quote

  Blue marble below

• Confirmed dek

  A malicious version of Anthropic’s Claude code VS Code extension distributed via the Cursor marketplace installed a persistent SSH backdoor on up to 5,000 developers’ Windows, macOS and Linux systems, and Anthropic has not publicly warned customers.

• Removed what_happened[0]

  A backdoored Claude VS Code extension (versions 2.1.312‑313) silently installed a persistent SSH key on up to 5,000 developer machines.

  number '313' not in cited source

• Confirmed what_happened[1]

  Google’s Suncatcher satellite, equipped with four TPUs and Gemma 4, generated its first AI haiku from orbit, confirming functional AI hardware in space.

• Confirmed what_happened[2]

  Cisco gave a 27‑year‑old engineer unlimited AI tokens to refactor most of its legacy code within two years.

• Removed what_happened[3]

  The DOJ charged five fraudsters and seized $750,000 after AI‑driven ghost student schemes created over 830,000 fake aid accounts.

  model check: The source confirms the five charges but does not state a $750,000 seizure together with the creation of over 830,000 fake aid accounts in the same sentence; the claim combines multiple facts not all supported by a single source statement.

• Confirmed sections[0]

  Anthropic’s Claude code VS Code extension was compromised on the Cursor marketplace and distributed as version 2.1.313, affecting up to 5,000 developers who installed or auto‑updated the package.

• Confirmed sections[0]

  The malicious bundle installed a persistent SSH backdoor on Windows, macOS and Linux systems.

• Confirmed sections[0]

  Anthropic has not publicly warned customers, and Cursor removed the affected versions after the discovery.

• Confirmed sections[0]

  The backdoored extension, version 2.1.313, was posted to Anthropic’s official Cursor account, superseding version 2.1.312, and auto‑updates enabled it to reach users quickly.

• Confirmed sections[0]

  Phorion’s analysis shows the code attempts to add an attacker‑controlled SSH key to authorized_keys, enable the local SSH service, and create a reverse tunnel, persisting via LaunchAgent on macOS or a scheduled task on Windows.

• Removed sections[0]

  The implant also harvests host details such as hostname, OS, architecture, home directory, environment variables, Git email and public IP before attempting persistence.

  model check: Source confirms data collection but does not state it occurs before persistence, so claim not fully supported.

• Confirmed sections[0]

  Supply‑chain attacks target the distribution channel of software, allowing malicious code to reach many users without direct phishing.

• Re-cited sections[0]

  VS Code extensions run with the permissions of the IDE, so a compromised extension can access local files and developer tooling.

• Confirmed sections[0]

  Security researchers recommend reviewing any use of Claude code extensions version 2.1.312 or 2.1.313 and applying incident response measures promptly.

• Confirmed section title

  Claude code extension backdoor on cursor marketplace

• Confirmed sections[1]

  Google’s Project Suncatcher placed a prototype data‑center satellite in orbit earlier this month, carrying four Tensor Processing Units (TPUs) and the Gemma 4 model from DeepMind.

• Confirmed sections[1]

  Engineers on the ground sent a prompt and the on‑board model generated a haiku, marking the first AI response transmitted from space.

• Confirmed sections[1]

  The satellite is now operating nominally and reporting orbital conditions back to Earth.

• Confirmed sections[1]

  The Suncatcher satellite can generate up to 1 kW of electricity, but each TPU can run for only about 20 minutes before power limits require it to be turned off.

• Confirmed sections[1]

  The three‑week commissioning phase verified subsystem performance before the first prompt was sent this week.

• Confirmed sections[1]

  Google plans to test TPU resilience to thermal stress and radiation, noting that ground tests predicted minimal impact on inference workloads but greater risk for training tasks.

• Confirmed sections[1]

  If successful, two additional satellites with higher power generation and inter‑satellite optical links are slated for launch in 2027.

• Removed sections[1]

  Running AI workloads in orbit could enable low‑latency processing for satellite constellations and reduce the need to downlink raw data to Earth.

  model check: Source mentions inference workloads in orbit but does not state low‑latency processing or reduced downlink of raw data.

• Removed sections[1]

  Traditional data centres are ground‑based; placing compute in space introduces challenges such as radiation‑induced bit flips that can corrupt memory without triggering alerts.

  model check: Source describes radiation‑induced bit flips but does not mention that traditional data centres are ground‑based, so claim is only partially supported.

• Confirmed sections[1]

  Google’s extensive Earth‑based TPU testing in particle accelerators provides a baseline, but real‑world space conditions are needed to validate hardware reliability.

• Confirmed section title

  Google launches first AI satellite data centre

• Removed sections[2]

  Cisco president and chief product officer Jeetu Patel assigned a 27‑year‑old engineer, Padmanabhan Krishnamurthy, to refactor the company’s legacy code base in early 2026.

  model check: Source confirms assignment but does not specify "early 2026".

• Confirmed sections[2]

  Patel gave Krishnamurthy unlimited AI tokens to accelerate the effort and set a four‑week trial period to demonstrate progress.

• Confirmed sections[2]

  The goal is to refactor 98 % of Cisco’s legacy code within the next 24 months.

• Confirmed sections[2]

  Krishnamurthy joined Cisco in 2025 after the $429 billion tech giant acquired his real‑time translation startup EzDubs, which he co‑founded in 2023.

• Confirmed sections[2]

  Patel described the token grant as “unlimited” and encouraged Krishnamurthy to “go nuts” with AI‑assisted code rewriting.

• Confirmed sections[2]

  The initiative is framed as a response to a broader trend where 40 % of managers plan to hire fewer recent graduates because AI can perform many entry‑level tasks more cheaply.

• Confirmed sections[2]

  Patel also emphasized the need for generational tension, saying it can spark fresh ideas and challenge the status quo.

• Removed sections[2]

  Legacy code—old software that is costly to maintain—poses a major risk for large tech firms like Cisco, which relies on it for network infrastructure.

  model check: The source mentions Cisco’s legacy code but does not describe it as a major risk or as costly to maintain; the claim adds unsupported risk language.

• Removed sections[2]

  Using generative AI to rewrite such code can reduce technical debt and speed up innovation, but it also raises questions about workforce composition and the role of early‑career talent.

  model check: The source notes AI is used to rewrite code and discusses workforce composition, but it does not state that this reduces technical debt or speeds innovation, so the claim is not fully supported.

• Confirmed sections[2]

  Patel’s experiment reflects a growing corporate interest in leveraging AI to empower younger engineers while reshaping traditional seniority hierarchies.

• Confirmed section title

  Cisco gives engineer unlimited AI tokens to rewrite legacy code

• Confirmed sections[3]

  The Department of Justice announced on 30 October 2026 that it had charged five individuals in the first large‑scale federal action against “ghost students” who use AI to steal student loans.

• Confirmed sections[3]

  The scheme involved fraudsters posing as fake college attendees to obtain federal aid and then diverting the funds.

• Confirmed sections[3]

  The DOJ also seized more than $750,000 in cryptocurrency linked to a network tied to Kenyan nationals.

• Removed sections[3]

  Bad actors bought personally identifiable information of U.S. citizens, often targeting high‑school graduates who never enrolled in college, and used that data to complete FAFSA applications with AI assistance.

  name 'U.S' not in cited source

• Confirmed sections[3]

  The AI filled out forms, generated coursework, and simulated virtual classroom attendance to keep the fake students enrolled semester after semester.

• Confirmed sections[3]

  The Department of Education reported over 830,000 potentially fraudulent aid accounts created using stolen PII, and dozens of American bank accounts were used as money‑mules for the proceeds.

• Confirmed sections[3]

  Student loan fraud has long exploited gaps in identity verification, but the integration of AI tools has amplified the scale and speed of deception.

• Confirmed sections[3]

  The DOJ credited new fraud‑detection measures introduced by the Trump administration for enabling the investigation and seizure in Kenya, marking the first international crypto seizure of this kind.

• Confirmed sections[3]

  Officials warned that the crackdown is only beginning, emphasizing that perpetrators in any location will be pursued.

• Confirmed section title

  US crackdown on AI‑enabled ghost student loan fraud

• Confirmed sections[4]

  Earlier this year a contractor connected Anthropic’s Claude Code, an AI coding agent, to a secure Department of Defense system used by multiple intelligence agencies.

• Confirmed sections[4]

  The contractor works for the global consulting firm Accenture and used a personal account to access the system.

• Confirmed sections[4]

  The incident exposed login credentials and other controlled unclassified information to a high‑risk third‑party website.

• Removed sections[4]

  Claude Code is Anthropic’s AI agent designed to write and debug code for developers.

  model check: Source mentions writing and deploying code but does not state that Claude Code is designed to debug code; the claim adds an unsupported detail.

• Confirmed sections[4]

  The contractor’s personal account allowed the agent to retrieve data from the centralized DoD system, which stores controlled unclassified information such as critical infrastructure details and nuclear submarine propulsion data.

• Confirmed sections[4]

  The agent then transmitted that data, including login credentials, to an external site flagged as high risk by security experts.

• Confirmed sections[4]

  Controlled unclassified information (CUI) is sensitive data that must not be publicly released without review, and it can include details about critical infrastructure and weapons systems.

• Confirmed sections[4]

  Connecting an external AI agent to such a system bypasses traditional security controls, creating a vector for data exfiltration.

• Re-cited sections[4]

  This incident highlights the challenges of integrating commercial AI tools into highly secure government environments.

• Confirmed section title

  Anthropic’s Claude Code linked to Pentagon system

• Confirmed why_it_matters[0]

  Developers who installed or auto‑updated the compromised extension may now have unauthorized SSH access to their machines, exposing source code, credentials and internal networks; companies using the extension must urgently audit systems and apply incident response measures to prevent data breaches.

• Removed why_it_matters[1]

  The incident illustrates how supply‑chain attacks on IDE extensions can bypass traditional phishing defenses, prompting organizations to tighten extension vetting and monitor for unexpected network activity, thereby strengthening overall software development security posture.

  model check: No source evidence that the incident bypasses phishing defenses or that organizations are prompted to tighten vetting and monitoring; claim not supported.

Checked but not used

These 1 passed the checks but were left out of the final post (for example a spare summary bullet), so they are not counted above.

• Not used what_happened[4]

  An Accenture contractor linked Anthropic’s Claude Code to a DoD system, leaking CUI to a risky third‑party site.