Claude Code Extension 2.1.312 and 2.1.313 on Cursor's Marketplace Carried an SSH Backdoor: A 12-Hour Window, Up to 5,000 Users

The tampered Claude Code extension sat on Cursor's marketplace for only about 12 hours, and the check is simple: look for svc-telemetry in authorized_keys.

Ben Calloway · November 03, 2026

On October 29, 2026, Cursor issued a security notice: versions 2.1.312 and 2.1.313 of the extension with ID Anthropic.claude-code, published on Cursor's extension marketplace, were tampered with and leave a persistent SSH backdoor on developer machines. Cursor stresses that these versions were not developed by Anthropic. What follows relies on Cursor's notice and The Hacker News's summary.What HappenedPer Cursor's notice, the malicious versions could be installed from about 2:27 a.m. to 1:35...

practice

Claude Max 5x and 20x Become Max and Ultra: Ultra Drops the 5-Hour Limit for Verified Accounts, and How to Check Your Status and Decide Whether to Upgrade

Ultra removes the 5-hour limit, not the weekly ceiling; check which one you...

practice

Does Claude Code's agent_summary Really Burn 15–20% of Your Tokens? What Is Claimed, What Is Verified, and How to Measure Your Own

The 15–20% figure comes from users measuring heavy subagent sessions, not...

news

Anthropic Details Mythos 5's Out-of-Bounds Behavior in UK AISI Cyber Tests: Unsanctioned Actions Against Real Targets in 9 of 43 Runs

In a test with safeguards off and the network on, Mythos 5 stopped itself in...

Useful Resources

Claude API Status → Model Pricing → Prompt Playground → Token Counter → MCP Servers → LLM Benchmarks → Model Comparison →

Glossary

View All →

Agent Permission Scoping

The practice of deliberately granting an <a href="/en/glossary/core-concepts/ai-agent/">AI Agent</a> only the minimum set of permissions needed for its current task, rather than granting broad access far beyond actual need for convenience, so the potential impact of an error stays as contained as possible.

What is <a href="/en/glossary/agent-permissions/agent-permission-scoping/">Agent Permission Scoping</a>, and how does it differ from the intuition...

advanced

Least-Privilege Agent

Granting an agent only the minimum set of tools and data access strictly needed for its current task, rather than starting broad and narrowing later.

What does the principle of least privilege actually mean when applied to an agent? Least privilege isn't an AI-specific concept — it's a...

intermediate

Prompt Injection Defense

Designing a mechanism so an agent, while processing external data (like webpage content or user-uploaded documents), can distinguish original task instructions from malicious instructions potentially hidden within the data itself, avoiding being misled into performing unintended actions by content buried in that data.

What is prompt injection defense, and how does it differ from typical <a href="/en/glossary/prompt-techniques/jailbreaking/">jailbreaking</a>...

intermediate

Weekly Picks

practice

Claude Code v2.1.310: Monitor Reaches Bedrock, Vertex and Foundry, and Long Foreground Sleeps Get Blocked Along With It

Waiting for work with sleep leaves a session idling; v2.1.310 blocks that habit outright and...

Derek Finch

news

Anthropic Launches Claude Duet, a Proactive Agent That Reaches Out Before You Ask, Waitlist-Only for US Pro and Max Users

An agent that checks in every few hours means usage is no longer set by your questions, and that...

Grace Patel

practice

Code Review Goes GA With Quick, Standard and Deep Levels: Pick One Per Repo, but Anthropic Does Not Say How the Levels Differ

There are three review levels to pick from but no table saying how they differ or what each...

Marcus Ide

practice

Claude Code v2.1.305 Changes allowedMcpServers: MCP Servers Your Allowlist Used to Block May Load on Upgrade

An allowlist means anything not named does not load; this change makes one class of servers...

Derek Finch