A Backdoor Shipped Inside the Official Claude Code VS Code Extension

The extension you installed may not be the extension you trust

A blog post from Phorion says it found a backdoor in the Claude Code VS Code extension distributed through the Cursor Marketplace. The claim is narrow and pointed: developers who installed the official extension from that marketplace may have been running code they did not audit.

The post spread on Hacker News almost immediately. That reaction matters more than the specific bug. AI coding tools have moved from chat windows into IDE extensions, and IDE extensions run with your permissions, your files, and your shell. A marketplace listing is not a code review.

Here is what the report says, what it does not say, and the checks a builder can run before the next commit.

What the Phorion post actually claims

The Phorion analysis is about distribution, not about Anthropic’s model. It says the build of the Claude Code VS Code extension served through the Cursor Marketplace contained a backdoor. The practical consequence: if you installed from that listing, your editor’s extension host was executing whatever the compromised build carried.

That is the supply-chain shape of the problem. The model can be fine. The API can be fine. The thing that sits between your keystrokes and your terminal is the extension, and that is the artifact under suspicion.

One caveat before anyone panics: a single blog post is a lead, not a verdict. The useful move is to treat it as a prompt to verify your own install path, not as proof that every Claude Code user was affected.

Why the Cursor Marketplace is the weak link

VS Code extensions are not sandboxed the way a browser tab is. They run inside the extension host with access to the workspace, the file system, and often the integrated terminal. An extension that can read your repo can also read your .env.

Marketplaces add a second layer of trust. A listing says a package exists and was published; it does not guarantee that the artifact you downloaded is byte-identical to the one the vendor built. Mirrors, republished packages, and stale versions are ordinary failure modes.

Cursor’s Marketplace is a distribution surface for a fast-moving editor. Developers install there because it is convenient, not because they have read the publisher’s signing chain.

How a backdoor hides in an extension build

The mechanism matters, because it explains why nobody noticed. An extension ships as a packaged bundle, and the code a reviewer sees in the vendor’s public repository is not necessarily the code inside the .vsix that a marketplace serves. Between source and install sit a build step, a signing or publishing step, and a hosting step. A backdoor does not need to be clever at any of them. It only needs to survive the handoff.

That is why the usual defenses miss it. Reading the source on GitHub feels like due diligence, but it audits the input, not the output. Scanning your own package.json tells you which extension you asked for, not which build you received. The extension host then loads that bundle and grants it the same reach as the editor itself, so a payload that fires once on activation can read a file, call out over the network, and leave no trace in your terminal scrollback.

The narrowness of the Phorion claim is the point. It does not allege a flaw in how the model reasons or how the API responds. It alleges that one artifact, on one distribution path, carried something extra.

The uncomfortable timing

This lands in a week when AI coding tools are being adopted as IDE extensions at a pace that outstrips security review. Teams that would never npm install an unvetted package will happily add an AI assistant that can run commands.

The uncomfortable part is not that a backdoor was found. It is that the official path was the compromised one. “Install from the official listing” has been the standard advice for a decade. This story is a reminder that official means published, not audited.

There is a second-order effect worth naming. When the official channel is the suspect, the instinct to reinstall from the same channel does nothing. You have to change what you verify, not just where you click.

What to check before your next commit

Start with provenance. Confirm where your Claude Code extension came from: the vendor’s own release channel, a VS Code Marketplace listing, or the Cursor Marketplace. If you cannot answer that in one sentence, that is the finding.

Second, pin versions. An extension that auto-updates is a supply chain you have delegated. Pin the version you reviewed, and re-review when it moves.

Third, read the permissions. An AI coding extension should need workspace access. If it also wants broad filesystem or network reach, ask what for.

Fourth, watch the extension host. Anything the extension executes runs with your user’s privileges. If your threat model includes secrets in the repo, the extension is inside that boundary.

Fifth, keep a record. A one-line note in your repo or onboarding doc naming the extension, its source, and its pinned version costs nothing and turns the next incident into a lookup instead of an investigation.

The bigger pattern: agents with your credentials

AI coding tools are converging on the same architecture: an editor extension that talks to a model and can act on your machine. That is exactly the architecture where a compromised build hurts most, because the extension is not just displaying text. It is running commands.

This is the same lesson that keeps surfacing across AI tooling: the model is the easy part to reason about, and the plumbing around it is where trust actually breaks. A backdoor in a VS Code extension is a plumbing failure, not a model failure.

The pattern generalizes past this one vendor. Every assistant that can read your files and run your shell inherits the trust you place in its packaging. The more capable the tool, the more the build pipeline deserves the scrutiny you currently spend on the prompt.

What would actually settle it

A blog post is a claim. The things that would settle the question are boring and verifiable: a diff between the published artifact and the vendor’s build, a signed release, and a clear statement from the marketplace about which version was served when.

Until then, the responsible posture is to check your own install, pin what you can, and stop treating “official listing” as a synonym for “reviewed code.”

Frequently asked questions

Q: Was the Claude model itself compromised? A: The report points at the VS Code extension distributed through the Cursor Marketplace, not at the model or the API.

Q: Does this affect every Claude Code user? A: Only if your extension came from the affected distribution path. Check your install source and version before assuming either way.

Q: What is the one action to take today? A: Confirm where your extension came from, pin its version, and re-check when it updates.