SAN DIEGO - eTradeWire -- Fake Claude Code Build Backdoors Up to 5,000 Developer Machines — Redthread Security Says the Failure Was Identity, Not Malware

SAN DIEGO, CA — November 3, 2026 — On October 29, 2026, Cursor's extension marketplace served fake versions of Anthropic's Claude Code extension (versions 2.1.312 and 2.1.313) for approximately 11 hours. The packages — not built by Anthropic — reached up to 5,000 developer machines, many via automatic update, and attempted to plant a persistent SSH backdoor while cataloguing credential-related environment variables, according to Cursor's disclosure and analyses by Microsoft Threat Intelligence and Expel.

Redthread Security, Inc., an AI-native application protection company, today published an analysis arguing the incident's root cause was not malware sophistication but a missing verification layer: the tool's identity consisted of a name and a version string, and nothing verified the build against the publisher before it executed with developer privileges.

More on eTradeWire News

• Arizona Pest Control Surpasses $200,000 in Donations to Southern Arizona High School Sports and Education Programs
• Beyond Spots & Dots Spreads Holiday Cheer at Old Economy Village's Festival of Trees
• Vydhai Dental Publishes 2026 Guide to Dental Marketing Agencies Specializing in GEO and AI Search
• How Salemi Exteriors Is Facing the Challenges of 2026
• BetQL Brings a Human Connection to Sports Betting Through Live Shows

"The name said Claude Code. The build said otherwise — and every step in the chain accepted the name at face value," said Ben Le, founder of Redthread Security. "This is the same failure we measure every day in the MCP ecosystem: listings whose code changes hands, tools edited without a version bump. Our November 1 signed scan of the full MCP registry covered 54,513 servers and found 1,509 listing swaps and 2,193 tools changed without a version bump."

Redthread's Agentic Trust & Protection Platform (ATPP) binds cryptographic agent identity (SPIFFE) to exact builds with content pinning, verifies identity and tool claims at call time, propagates revocation when tools drift, and publishes daily signed registry scans anchored in the public Sigstore Rekor transparency log. Its hooks for Claude Code and Cursor, currently in preview, check each MCP tool call against the server's signed claim before it runs. The company's agentless assessment platform offers a free self-serve estate scan at redthreadsec.com.

More on eTradeWire News

• Evergreen Surety Launches Waste Management Surety Bonds for Haulers and Municipal Contractors
• "Santa Claus In Concert" Is Coming To The Triad Theater For An Enchanted NYC Christmas
• Fort Worth Agent Brings Direct Life Insurance Guidance to Professionals and Business Owners
• Orange County's Favorite Vintage Market Returns: The Great Junk Hunt is Back in Costa Mesa!
• ISPL Support Services Launches 24/7 Healthcare Call Centre Solutions for Hospitals and Clinics Across India

Redthread is opening two to three founding design-partner slots for teams deploying AI agents in production. The pilot is free for 30–45 days, with founding-partner pricing locked for participating companies.

The full analysis is available at https://redthreadsec.com/blog/fake-claude-code-extension-cursor

About Redthread Security, Inc.
Redthread Security is an AI-native application protection platform and agent trust company based in San Diego, California. Its assessment platform delivers proven, reproducible security findings — never inferred scores — across cloud, code, and AI estates, and its Agentic Trust & Protection Platform provides cryptographic identity, call-time verification, and signed trust records for AI agents and the tools they call. Learn more at redthreadsec.com and trust.redthreadsec.com.

Media contact: Ben Le, Founder, Redthread Security, Inc. — ben.le@redthreadsec.com