Backdoors in official Claude Code extensions

Commenters focused less on Claude Code’s coding ability than on the sobering supply-chain lesson: an AI coding extension can execute with enough local privilege that a compromised update is effectively routine remote-code execution. Several readers noted that automatic extension updates make it hard to know whether merely having installed the tool months ago offers any protection; until a real incident report establishes the malicious version and release window, users cannot reliably infer their exposure. The suggestion that some marketplaces delay auto-updates offered a narrow piece of possible luck, not confidence. The thread also tried to untangle a crucial attribution question. Participants distinguished the extension distributed through Open VSX and Cursor from builds on Microsoft’s Visual Studio Code marketplace, while noting that removals and screenshots made the scope unclear. This matters because an extension branded around a frontier AI tool can inherit users’ trust even when a third-party marketplace build is not actually authored or controlled by the model vendor. Readers were especially alarmed by reports of enterprise use and by the scale of potential installs, though one inflated installation claim was corrected sharply. The broad conclusion was that convenience-oriented AI developer tooling has normalized granting opaque software access to repositories, directories, and credentials, reviving the very execution-risk discipline developers often claim to follow.