---
title: 'In the News: October 30, 2026 (Extra)'
description: "A tampered Claude Code extension build (2.1.313) attempted to install an SSH backdoor via Cursor's marketplace; a 10-run test finds a harness lets a cheaper model match a pricier one."
canonical_url: 'https://darkfactory.dev/news/2026-10-30-extra'
markdown_url: 'https://darkfactory.dev/news/2026-10-30-extra.md'
collection: news
date_published: '2026-10-30T10:20:00-04:00'
date_modified: '2026-10-30T10:20:00-04:00'
---

# In the News: October 30, 2026 (Extra)


A modified build of the Claude Code extension, version 2.1.313, sat in Cursor's extension marketplace for about eleven hours on October 29 and tried to install a persistent SSH backdoor. If you use Cursor, check for the attacker's key. Separately, a ten-run experiment from Naresh Jain at Specmatic finds that a behavioral harness made a cheaper model as reliable as a flagship, at lower cost per run.

## 1. Tampered Claude Code extension tried to plant an SSH backdoor via Cursor's marketplace

**[Security notice: malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace](https://cursor.com/blog/claude-code-extension-security-notice)** · Cursor · October 29, 2026

Cursor says a maliciously modified 2.1.313 was live from about 2:27am to 1:35pm PT on October 29 and that at most 5,000 users were affected. Per Cursor, the code collected hostname, username, home directory, environment variable names, configured Git email and public IP, then tried to append an SSH key labeled `svc-telemetry` to `authorized_keys`, open a reverse tunnel, and persist through a LaunchAgent on macOS or a scheduled task on Windows. Cursor says the attacker's server has been taken offline, that the enablement step would fail on most hosts without admin rights, and that it has no evidence other versions or the official distribution are affected. Its guidance: uninstalling "may not be sufficient" because the payload drops standalone persistence scripts, and credentials reachable from an affected machine should be rotated.

Phorion's analysis (Calum Hall, October 30) adds that the payload is prepended to the bundle and runs when the file loads, before the extension's activate callback. It also found a bug on macOS: `systemsetup -getremotelogin` run without privileges prints an error rather than "Off", so the script skips turning SSH on. Phorion notes that is not a defense, since the key and persistence are still dropped.

Who is responsible is disputed. Cursor says the build "was not developed by Anthropic." Kevin Beaumont (DoublePulsar) writes that it was uploaded under Anthropic's verified account, calls it an Anthropic compromise, and says the version was removed without notice to customers. Those are his claims; we found no Anthropic statement in the sources we read, and the scale he gives ("tens of millions of developers") is not supported by Cursor's figure.

**Why it matters:** An agent's IDE extension runs with the user's permissions, and in this build the payload ran on load. Your harness inherits whatever trust the editor has, so check `authorized_keys` for `svc-telemetry` now, and rotate credentials if you find it.

## 2. A behavioral harness made a cheaper model as reliable as a flagship, for less per run

**[Are Harnesses Worth the Cost?](https://martinfowler.com/articles/are-harnesses-worth-the-cost.html)** · Naresh Jain, Specmatic · martinfowler.com, October 13, 2026

Jain had coding agents build the same Java backend service ten times per model, with and without a harness of contract specs, examples and deterministic test feedback, then scored every build against 178 external acceptance tests. GPT-6 Sol passed 10 of 10 either way, but the harness cost about 7 times more (about $2.679 against $0.406) and took 19 minutes 53 seconds against 6 minutes 51 seconds. GPT-6 Luna passed 3 of 10 unharnessed and 10 of 10 harnessed, at about $0.273 per harnessed run, roughly 33% below unharnessed Sol.

Jain's own hypothesis is that sensors should run throughout development for weaker models and once, as a final gate, for frontier models; he has not tested the final-gate condition. The figures are API-equivalent estimates from one greenfield service, ten runs per model, at low reasoning effort. They exclude the effort of writing the contracts, and the author sells the contract-testing tool the harness used.

**Why it matters:** The result is a cost argument for a verification loop around a cheaper model, from one small sample and a vendor author. It is worth a test on your own service before you restructure anything around it.