Six 2026 attacks using AI coding tools came via stores, not labs

The tampered Claude Code extension that Cursor's marketplace served on October 29 was two versions, not one, and it fits a pattern. SaasBuzz counted six supply-chain attacks reported in 2026 that used an AI coding tool's name or machinery to reach developers. All six came through a store, the npm registry or GitHub downloads, and none of the primary reports describes a breach of the AI company whose tool was used.

That is the finding behind this piece: attackers are going after the places AI coding tools are distributed and the features they run on a developer's machine, not the labs that build them. SaasBuzz reported the Cursor incident on October 30, including the steps to check an affected machine. Since then Cursor has widened the list of bad versions, Microsoft has published its own analysis, and the early claims that Anthropic's official channels were hit have been withdrawn or contradicted.

What changed since October 30

Cursor updated its security notice at 11:30 a.m. PT (2:30 p.m. ET) on October 30, saying it had "clarified affected versions." The notice now names Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and macOS, each with its own malicious package hashes, where it first named only 2.1.313. Anyone who installed or updated either version from Cursor's marketplace between 2:27 a.m. and 1:35 p.m. PT on October 29 is in scope. The window did not change: about 11 hours and 8 minutes, by SaasBuzz's count.

Microsoft's security research team published its analysis of the injected code the same day, with Defender detection names for the key, the launch agent, the scheduled task and the tunnel. Its threat intelligence account summarized the result on X, including a line that matters for anyone who assumed a failed tunnel meant a clean machine.

The first day also produced a false trail. Early reports said the backdoored build had also reached Open VSX, the open registry many VS Code forks draw from, and some security accounts repeated them. Matt Johansen, the founder of Vulnerable U, withdrew his post at 8:02 a.m. ET on October 30.

Socket, which scans open-source registries, reviewed 3,392 Open VSX change events from October 27 onward and found "no evidence that Claude Code version 2.1.313 became publicly available through Open VSX." Microsoft says the bad packages never reached the Visual Studio Marketplace or npm. Three separate checks now point to one store.

Two things are still unknown. Cursor's notice says it "audited access and confirmed no other extensions were tampered with," rotated its keys and rebuilt the marketplace, but it has not said how the attacker got the access to publish under Anthropic's extension name. It has also not said how many of the up to 5,000 affected users had the attacker's key written to their machines. Neither had been made public as of 3:30 p.m. ET on October 31.

Six attacks, one route

To test whether Cursor's incident is a one-off, SaasBuzz wrote an inclusion rule first and then searched. An incident counts if it was first reported in 2026, has a primary report from the researchers who found it or the affected company, delivered malicious code through a distribution channel, and names an AI coding or agent tool as the lure, the disguise or the machinery. Six met it.

Source: SaasBuzz analysis of primary reports by Trend Micro, Mend, SafeDep (May 13), SafeDep (Aug. 4), Check Point Research and Cursor. Dates are when each report was published.

Three patterns run through the table. First, the channel: three attacks went through npm, two through GitHub repositories and release downloads, and one through Cursor's own extension store. Second, in none of the six does the primary report describe a breach of Anthropic's or OpenAI's systems. Trend Micro's report on the April lures says the Claude Code source exposure that inspired them "was not a sophisticated breach, but a packaging error," and Check Point found attackers shipping a "legitimate signed OpenAI executable" to load their own code, not a tampered one.

Third, in three of the six the AI tool's own features did the work. In the SAP case, Mend says the attacker "used the Claude Code GitHub integration already running on an infected developer's machine" to change SAP's release workflow and publish four poisoned packages. SafeDep's May packages used a malicious hook that "re-executes on every Claude Code session start in the affected project." In the August Keyv worm, SafeDep found "VS Code and Claude Code hook files" committed to the repository, so opening a checkout could run the payload without an install.

The table is not a census. Searches that named Claude Code returned the most results, so Claude is over-represented by construction, and incidents nobody wrote up are missing. What it does show is that, across very different attacks, the route ran through distribution and local configuration rather than through a lab.

What the industry is saying

For Anthropic, Felix Rieseberg, a member of its technical staff, responded on X at 10:08 a.m. ET on October 30. His post drew the line that the rest of the day's analysis followed: the problem sat in Cursor's marketplace, not in Anthropic's build.

Cursor's own explanation is in its notice: it removed the package "immediately upon detection," took the whole marketplace offline, worked with the hosting provider to take the attacker's server down and found no other tampered extension. Cursor's co-founder, Michael Truell, wrote on X early on October 30 that the company did not believe the official Claude Code extension had been compromised.

Feross Aboukhadijeh, the founder and chief executive of Socket, put the lesson for buyers in one line on the evening of October 30. A listing that says "Anthropic" tells a developer who the extension claims to be from, not who built the file.

Microsoft's advice is aimed at Cursor's customers specifically. It tells organizations to apply Cursor's hardening controls, "including restricting extensions to approved publishers and configuring an extension installation cooldown to delay installation of newly published versions."

The counter-case: this is ordinary extension risk

The strongest objection is that nothing here is specific to AI. Extension stores and npm have carried poisoned updates for years, and one of 2026's most serious extension attacks had nothing to do with an AI tool. According to StepSecurity's write-up, a malicious Nx Console 18.95.0, a developer extension with more than 2.2 million installs, was published to Microsoft's own Visual Studio Code Marketplace on May 18 with a contributor's stolen GitHub token and pulled after about 11 minutes. StepSecurity's update says GitHub then disclosed that about 3,800 of its internal repositories were taken after an employee's device was compromised through a poisoned extension, which GitHub did not name.

On mechanism, the objection is right: Cursor's incident is a stolen-or-misused publishing path, the same failure as Nx Console. The difference is in the details the table surfaces. A VS Code fork that runs its own store, as Cursor does, is one more set of publishing keys and one more review process to defend, and Cursor's tampered build sat under Anthropic's extension name for about 11 hours, where the Nx team caught its rogue release in minutes. AI tools also hand attackers two things an ordinary extension does not: a brand that developers search for and install on trust, and hooks and repository access that run code by design. Half the incidents in the table used the second.

What teams should change

• Know which store each editor installs from. Cursor's marketplace, Open VSX and Microsoft's marketplace are different supply chains with different publishers' keys.

• Allow extensions only from approved publishers and add an install cooldown for new versions, as Microsoft recommends for Cursor.

• Review .claude/settings.json and similar hook files in any repository before trusting it. In two of the six incidents, a Claude Code hook was one of the ways the malware ran.

• Scope the repository and token access given to coding assistants as tightly as a human contributor's. In the SAP case, the attacker changed the release workflow through an assistant's existing commit access.

• Alert on writes to authorized_keys and on new launch agents and scheduled tasks, whatever installed them. The full cleanup steps for Cursor users are in our October 30 report, linked above.

What would change the conclusion

If Cursor's investigation finds the publishing access came from inside Anthropic, or a future report traces an attack to a lab's own build system, the pattern breaks. The things to watch are Cursor's account of how the package was published, a count of machines where the attacker's key was written, and whether other VS Code forks that run their own stores publish how they sign and review extensions.

Method

SaasBuzz wrote the inclusion rule before collecting incidents on October 31. Included: first reported January 1 to October 31, 2026; a primary report by the finders or the affected company; malicious code delivered through an extension store, package registry, code host or download page; and an AI coding or agent tool named as lure, disguise or machinery. Excluded: flaws in the tools with no malicious distribution, such as the March Claude Code source-map exposure itself; attacks on tools without AI features, such as Nx Console, which serves as the counter-case; and an npm package that press coverage tied to Claude, because its primary report does not name an AI tool. Counts and the exposure windows were computed in code from the sources above.