Fake Claude Code Build Backdoors Up to 5,000 Developer Machines — Redthread Security Says Failure

SAN DIEGO - EntSun -- Fake Claude Code Build Backdoors Up to 5,000 Developer Machines — Redthread Security Says the Failure Was Identity, Not Malware

SAN DIEGO, CA — November 3, 2026 — On October 29, 2026, Cursor's extension marketplace served fake versions of Anthropic's Claude Code extension (versions 2.1.312 and 2.1.313) for approximately 11 hours. The packages — not built by Anthropic — reached up to 5,000 developer machines, many via automatic update, and attempted to plant a persistent SSH backdoor while cataloguing credential-related environment variables, according to Cursor's disclosure and analyses by Microsoft Threat Intelligence and Expel.

Redthread Security, Inc., an AI-native application protection company, today published an analysis arguing the incident's root cause was not malware sophistication but a missing verification layer: the tool's identity consisted of a name and a version string, and nothing verified the build against the publisher before it executed with developer privileges.

More on EntSun News

• The Villari Firm, PLLC Named to the 2027 Edition of Best Law Firms
• Bell, Janssen, O'Donoghue, 'Hocus Pocus' Stars Added to FAN EXPO New Orleans Guest List
• Made to Order, Not Made for Landfill: Leather Workshop Takes a Different Road into Black Friday
• Jazz Vocalist and Songwriter Marcus Goldhaber Joins RL Productions
• Bacchus Wine & Spirits and Michelin Guide–Recommended Ethel's Fancy to Host Exclusive LOUIS XIII Limited Edition Diwali Decanter Celebration

"The name said Claude Code. The build said otherwise — and every step in the chain accepted the name at face value," said Ben Le, founder of Redthread Security. "This is the same failure we measure every day in the MCP ecosystem: listings whose code changes hands, tools edited without a version bump. Our November 1 signed scan of the full MCP registry covered 54,513 servers and found 1,509 listing swaps and 2,193 tools changed without a version bump."

Redthread's Agentic Trust & Protection Platform (ATPP) binds cryptographic agent identity (SPIFFE) to exact builds with content pinning, verifies identity and tool claims at call time, propagates revocation when tools drift, and publishes daily signed registry scans anchored in the public Sigstore Rekor transparency log. Its hooks for Claude Code and Cursor, currently in preview, check each MCP tool call against the server's signed claim before it runs. The company's agentless assessment platform offers a free self-serve estate scan at redthreadsec.com.

More on EntSun News

• For the Sister Who Has Been There Since the Beginning: Sisters Deserve a Keepsake, Not Just a Card
• Arizona Pest Control Surpasses $200,000 in Contributions to Southern Arizona High School Sports and Education Programs
• BetQL Brings a Human Connection to Sports Betting Through Live Shows
• "Santa Claus In Concert" Is Coming To The Triad Theater For An Enchanted NYC Christmas
• ZenaTech (NAS DAQ: ZENA) $1 Million in New Utility Contracts- Potential $2.5 Million Follow-On Opportunity Puts Its Drone Business in the Spotlight!

Redthread is opening two to three founding design-partner slots for teams deploying AI agents in production. The pilot is free for 30–45 days, with founding-partner pricing locked for participating companies.

The full analysis is available at https://redthreadsec.com/blog/fake-claude-code-extension-cursor

About Redthread Security, Inc.
Redthread Security is an AI-native application protection platform and agent trust company based in San Diego, California. Its assessment platform delivers proven, reproducible security findings — never inferred scores — across cloud, code, and AI estates, and its Agentic Trust & Protection Platform provides cryptographic identity, call-time verification, and signed trust records for AI agents and the tools they call. Learn more at redthreadsec.com and trust.redthreadsec.com.

Media contact: Ben Le, Founder, Redthread Security, Inc. — ben.le@redthreadsec.com