A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices
Review AUTO-3b594dbd
No AI involvement in the attack. The article describes a tampered, backdoored copy of the Claude Code extension published to Cursor's marketplace by an unidentified actor. Nothing in the article shows an AI system being used by the attacker, executing the attack, or being the victim. The Claude name is only the impersonated product, so this is a conventional supply-chain attack.
Reviewed: · Rule: roguewatch-organizational-harm-v1
Dates and discovery
- Incident date
- Not disclosed
- Added to research / record
- Not recorded
- Posted to RogueWatch
- No linked public incident
- First observed
- 2026-10-31T12:34:31.777Z UTC
- Discovery channel
- RogueWatch pipeline
- Discovery source
- https://www.wired.com/story/trojan-malware-targets-thousands-of-anthropic-claude-developer-systems/
Dates use America/Los_Angeles. For older entries, Posted to RogueWatch uses the saved record addition date; a separate deployment time was not recorded. Future posting timestamps record first public qualification. Source publication and incident occurrence are separate.
Sources
- www.wired.comRelationship not established · www.wired.com
Decision history
- · Source reviewed
No AI involvement in the attack. The article describes a tampered, backdoored copy of the Claude Code extension published to Cursor's marketplace by an unidentified actor. Nothing in the article shows an AI system being used by the attacker, executing the attack, or being the victim. The Claude name is only the impersonated product, so this is a conventional supply-chain attack.
Evidence source
A review decision applies only to the named scope. Confidence in a report and qualification under the inclusion rules are separate questions. Review records do not add incidents to the globe or leaderboard.