The story behind the cartoon
Security researchers disclosed on October 30 that version 2.1.313 of the official Claude Code extension, distributed through Cursor's marketplace, contained a hidden 66-line loader slipped in ahead of the legitimate code. Cursor confirmed the incident: at most 5,000 users received the malicious version between about 2:27 a.m. and 1:35 p.m. Pacific Time on October 29, after which the package was pulled and version 2.1.314 published.
The loader runs when the extension activates — no conversation with the assistant required — and adds an attacker-controlled SSH key labelled “svc-telemetry” to the user's authorized keys, attempts to enable the local SSH service, opens a reverse tunnel, installs persistence across macOS, Linux, and Windows, and beacons host details back to the operator. Updating to 2.1.314 removes the backdoor from the extension, but not from machines already infected; those still need incident response. The npm package and Microsoft's VS Code Marketplace extension were identified as unaffected, and how the attacker obtained publishing rights is still under investigation — researchers attribute the compromise to Cursor's marketplace distribution, not to Anthropic's own release pipeline.
The sting is the delivery mechanism: this was not a dodgy download from a lookalike site, but an auto-update of a trusted tool, served under the extension's legitimate publisher identity, that kept working normally while it opened the machine up. Cursor temporarily shut its marketplace to remove the package. For the developers who build the software everything else runs on, the update channel itself was the break-in.
The joke is the helpful helper: the developer smiles at his screen while his cheerful robot types away, and through the tiny wooden door built into the back of his laptop a burglar tiptoes in. The assistant that writes your code also left the door open — and the only person in the room who doesn't notice is the one at the keyboard.
CUSTOMER B HAS A NAME
THE ORIGINAL THINKER
THE PROOF CAME WITH BUGS.
THE KEY UNDER THE MAT.