Fake Claude Code Build Backdoors Up to 5,000 Developer Machines — Redthread Security Says Failure

SAN DIEGO - Amzeal -- Fake Claude Code Build Backdoors Up to 5,000 Developer Machines — Redthread Security Says the Failure Was Identity, Not Malware

SAN DIEGO, CA — November 3, 2026 — On October 29, 2026, Cursor's extension marketplace served fake versions of Anthropic's Claude Code extension (versions 2.1.312 and 2.1.313) for approximately 11 hours. The packages — not built by Anthropic — reached up to 5,000 developer machines, many via automatic update, and attempted to plant a persistent SSH backdoor while cataloguing credential-related environment variables, according to Cursor's disclosure and analyses by Microsoft Threat Intelligence and Expel.

Redthread Security, Inc., an AI-native application protection company, today published an analysis arguing the incident's root cause was not malware sophistication but a missing verification layer: the tool's identity consisted of a name and a version string, and nothing verified the build against the publisher before it executed with developer privileges.

More on Amzeal News

• Electronic Office Systems Named ENX Magazine Elite Dealer for 26th Consecutive Year
• Commercial Sales Launch Following FDA Approval; National Sales Force Now in Action as January Shipments and Major Market Opportunity Take Shape
• Transtek Welcomes Visitors to Explore Its RPM Devices and Solutions at MEDICA 2026
• World Stroke Day Highlights the Importance of Blood Pressure Management: Transtek Supports Remote Patient Monitoring
• KAIT to Demo 400 Gbps 8K Uncompressed Video via SRv6 In-Network Computing at SC26

"The name said Claude Code. The build said otherwise — and every step in the chain accepted the name at face value," said Ben Le, founder of Redthread Security. "This is the same failure we measure every day in the MCP ecosystem: listings whose code changes hands, tools edited without a version bump. Our November 1 signed scan of the full MCP registry covered 54,513 servers and found 1,509 listing swaps and 2,193 tools changed without a version bump."

Redthread's Agentic Trust & Protection Platform (ATPP) binds cryptographic agent identity (SPIFFE) to exact builds with content pinning, verifies identity and tool claims at call time, propagates revocation when tools drift, and publishes daily signed registry scans anchored in the public Sigstore Rekor transparency log. Its hooks for Claude Code and Cursor, currently in preview, check each MCP tool call against the server's signed claim before it runs. The company's agentless assessment platform offers a free self-serve estate scan at redthreadsec.com.

More on Amzeal News

• RackAegis Introduces Industrial Cybersecurity SaaS Initiative
• ViewDNS.info Launches Monitors, Alerting Teams the Moment Something Changes on Their Domains
• Atomic Clocks Go Strategic: Defense, SATCOM, 5G/6G Transition and AI Drive Precision Timing
• Philadelphia-Area Entrepreneur Nouho M Kanneh Builds $37 Million Net Worth Across Real Estate, E-Commerce and Retail
• Contracting Resources Group Named a 2027 Elev8 GovCon Honoree by OrangeSlices

Redthread is opening two to three founding design-partner slots for teams deploying AI agents in production. The pilot is free for 30–45 days, with founding-partner pricing locked for participating companies.

The full analysis is available at https://redthreadsec.com/blog/fake-claude-code-extension-cursor

About Redthread Security, Inc.
Redthread Security is an AI-native application protection platform and agent trust company based in San Diego, California. Its assessment platform delivers proven, reproducible security findings — never inferred scores — across cloud, code, and AI estates, and its Agentic Trust & Protection Platform provides cryptographic identity, call-time verification, and signed trust records for AI agents and the tools they call. Learn more at redthreadsec.com and trust.redthreadsec.com.

Media contact: Ben Le, Founder, Redthread Security, Inc. — ben.le@redthreadsec.com