AI News · Edition 82 ·
A poisoned AI add-on, and the question to ask your developer
A tampered AI coding extension carried a hidden backdoor onto developers' machines. Plus: rising PC prices, website opt-outs and a school plugin.
The one that matters
A tampered AI coding add-on hid a backdoor. If someone maintains your systems, ask them about it
A tampered copy of Anthropic's Claude Code extension, labelled version 2.1.313, was distributed through the add-on marketplace of Cursor. Cursor is a popular AI-assisted code editor. The tampered copy carried a persistent SSH backdoor. In plain words, a developer who installed what looked like a normal AI coding helper may also have given an outsider a lasting key to their computer. SSH is the standard way developers log in to servers from a distance. “Persistent” means the hidden door survives restarts and stays open until someone finds it and removes it. Several outlets have reported the story. The reports we have don't establish how many people installed it, how long it was available or who was behind it. Treat any precise numbers quoted elsewhere with caution.
What this means for your business
Most owners never install a code editor. The person who maintains your systems almost certainly does. Picture a 600-student school whose fee portal and parent app are looked after by a two-person agency. Or a 30-bed clinic whose patient records sit on a cloud server set up by a freelance developer. Or a 40-person workshop running an inventory system built by an outside firm. Those developers increasingly work inside AI editors like Cursor, and they install AI add-ons as casually as you install a phone app. If one of their laptops carried this backdoor, an attacker may be able to reach whatever that laptop can reach: your server logins, your source code and the database passwords that often sit in configuration files. Your data was never on the developer's laptop, but the keys to it might be.
The bigger point is that AI coding tools are now worth attacking. They are installed widely, they are trusted, and they usually have broad access to a developer's files and connections. Whatever your contract says, your developer's toolkit is now part of your security.
What it does not mean
- Claude, or AI models in general, were not “hacked.” The reports describe a tampered package in a marketplace, not a flaw in the AI itself. The same thing has happened to ordinary browser extensions and software libraries for years.
- You don't need to ban AI coding tools. Your vendors use them because they get work done faster, and you see that in your invoices. The fix is to be careful about where tools come from, not to forbid them.
- You don't need to buy anything. Expect security sellers to use incidents like this to pitch “AI security” packages costing lakhs of rupees or thousands of dollars a year. For a business with one or two servers, the useful response costs a few hours of developer time. Anyone who says a tool must be safe because it's listed in a marketplace is wrong in the other direction.
What to do this month
- Send one email to whoever maintains your systems. Ask three things: Do you, or anyone working on our account, use Cursor or AI coding extensions? Did anyone install Claude Code extension version 2.1.313 from the Cursor marketplace? Which machines can log in to our servers? Ask for the answer in writing.
- If the answer is yes or “not sure,” treat it as a break-in. Have them replace the login keys and passwords for your servers, hosting account and database. They should also check the servers for any login keys nobody can explain. For a small setup this is usually about half a day's work. Very roughly, that is ₹5,000–15,000 from an Indian freelancer or C$300–800 in Canada.
- Close old doors while you're at it. Remove access for anyone who has left, including former staff, past freelancers and agencies you no longer use. Turn on two-step login for your hosting and domain accounts.
- Add two lines to your next vendor contract or renewal. First, they install tools only from official publishers and keep a list of what's installed. Second, they tell you within 24 hours if a tool they use on your systems is reported compromised.
If you run entirely on off-the-shelf software and nobody has server access on your behalf, your risk runs through those software companies, and there's little to do beyond keeping two-step login turned on. Everyone else should spend twenty minutes on that email.
Also worth knowing
How this briefing is put together
Every morning we read the day’s AI announcements and reporting from the companies themselves and from the technology press, then pick the handful that actually change something for a working business. The analysis is ours and it is written for owners and managers, not engineers. Every story links to its original source — read them, and disagree with us where we’ve got it wrong.