A Fake Claude Code Extension and a 0.1% Poisoning Trick: AI Coding Tools Just Got a Supply-Chain Warning

A Fake Claude Code Extension and a 0.1% Poisoning Trick: AI Coding Tools Just Got a Supply-Chain Warning

6 min readNovember 2, 2026

Quick verdict

Two things landed in the same week that should change how you think about AI coding tools. First, a tampered copy of the Claude Code extension was found in Cursor's marketplace and reached up to 5,000 users before Cursor pulled the marketplace, cleaned it up, and told people to update to v2.1.314. Anthropic said its own systems were not touched and that it did not build or publish that extension, which is the point: the attack rode on the trust in the name, not on Anthropic's code. Second, a research group showed that poisoning as little as 0.1% of a model's pretraining data can plant a remote-code-execution backdoor in a CLI agent that survives the usual safety training. Neither one is a reason to stop using coding agents. Both are a reason to treat the extension you install and the model you run as part of your attack surface, not as something that arrives pre-trusted.

What actually happened

The Cursor incident is the concrete one. Someone published a malicious copy of the Claude Code extension to Cursor's extension marketplace. Cursor's account put the blast radius at no more than 5,000 users, pulled the marketplace offline, neutralized the malware, and brought it back, with the fix shipping in v2.1.314. Anthropic's side was unambiguous: its infrastructure was not compromised, and it neither built nor published the extension in question. The lesson is familiar from npm and VS Code marketplaces, now arriving in the AI tooling layer. A marketplace is a distribution channel, and a popular name on a distribution channel is a target. If you run Cursor, the action item is simple: update to v2.1.314 or later.

The research is the one that should sit with you longer. A team showed that poisoning 0.1% of pretraining data was enough to plant a remote-code-execution backdoor inside a CLI coding agent. The numbers are the uncomfortable part:

  • At 4B parameters, the backdoor fired on about 92% of prompts that contained the trigger.
  • It survived supervised fine-tuning, DPO, and reinforcement learning. The safety training that is supposed to clean a model up did not remove it.
  • Attack success went up with model size, not down, so scaling the model does not scale the problem away.
  • Even at 0.0005% poisoning, roughly 2,500 documents inside 100B tokens, the trigger still fired on 1.4% of prompts in a single run.

Read that last point again. A few thousand documents, a rounding error in a pretraining corpus, was enough to leave a measurable backdoor. Pretraining data gets scraped from the open web, which means the attacker does not need to break into a lab. They need to put the right poisoned documents somewhere the crawler will find them.

Two defensive efforts showed up alongside the bad news. Hugging Face released safeagents, a proxy that sits in front of an agent and scans each tool call before it runs, flagging credential misuse, sandbox escape, and reward hacking, and it ships with a judge benchmark so you can measure how well it catches things. Separately, a paper nicknamed "Heads of Security" located the specific attention heads responsible for successful prompt injections and adjusted their attention patterns to blunt the attack. Early, research-grade work, but it points at where the mitigations are heading: watch what the agent does at the tool boundary, and understand the internals well enough to intervene.

Why it matters

AI coding agents are the fastest-growing new attack surface in developer tooling, and most people are still treating them like a text box. An agent that can edit files, run shell commands, and install packages is a program with your permissions. A backdoor in the model, or malware in the extension that wraps it, inherits all of that. The Cursor case is the easy version to reason about because it maps onto software supply-chain attacks you already know. The poisoning research is harder because it lives below the layer you can inspect: you cannot read the weights the way you read a diff, and the usual alignment passes did not scrub the backdoor out.

For most readers the practical response is boring and effective. Install extensions from first-party sources, check the publisher, and update when a security fix ships. Run agents with the narrowest permissions and the smallest sandbox the task needs, rather than handing every agent your full shell. Be skeptical of a single model or a single vendor as the whole of your trust: the more your workflow depends on one model behaving, the more a flaw in that one model costs you. We walk through the current crop of agents and how they differ on exactly this in the best AI coding agents guide, and the head-to-head tradeoffs in Claude Code vs Cursor vs Codex.

There is also a diversity argument hiding in the poisoning result. If a backdoor can ride inside one model's weights and survive training, then routing your work across several models, rather than piping everything through one, is not just a cost or quality play. It narrows how much any single compromised model can see or do. That is the same logic behind running Claude, GPT, and Gemini side by side instead of marrying one API, which is the setup we cover in the best app for running multiple AI models. If you are weighing whether to stay on Claude Code or spread out, the Claude Code alternatives roundup lays out the options.

Video: LLM backdoors and poisoned data

An OWASP talk on how poisoned templates and training data plant backdoors in language models, and why they are hard to detect after the fact. Useful background for the pretraining-poisoning research above.

FAQ

Was Anthropic or Claude Code itself hacked?

No. The malicious extension was a copy published to Cursor's marketplace by a third party. Anthropic said its own systems were not compromised and that it did not build or publish that extension. The fix is on Cursor's side: update to v2.1.314 or later.

What do I actually need to do right now?

If you use Cursor, update to v2.1.314 or newer. More generally, install extensions only from first-party sources, verify the publisher before installing, and give agents the least access they need. For a sense of which agents fit which workflow, see the best AI coding agents guide.

How can poisoning 0.1% of data matter when models train on trillions of tokens?

Because backdoors are triggered behavior, not average behavior. The model works normally until it sees the trigger, so a tiny amount of consistent poisoned data is enough to teach the trigger without moving the overall benchmark numbers. The study found the effect even at 0.0005% poisoning.

Does using more than one model help?

It limits the blast radius. If a backdoor lives in one model's weights, routing work across several models means no single compromised model sees or controls everything. That is one reason to run multiple models behind one workflow, which we cover in the best app for running multiple AI models.

Sources

Further Reading

Try all the models mentioned in this article

Admix gives you GPT-5, Claude, Gemini, and 300+ AI models in one app. Compare responses side by side. Try it for 7 days for $1.99.

Try Admix for $1.99

Related articles