Inside a malicious Claude Code-branded extension and its persistent SSH backdoor

In this article 1. Attack chain overview 1. Attack chain 2. Host reconnaissance collection 3. SSH authorization and tunnel identities 4. Protocol Tunneling T1572: reverse SSH forwarding 5. Platform-specific startup persistence 2. Mitigation and protection guidance 1. Immediate actions 2...

aigate

aigate Secret hygiene for AI-generated code. Catches hardcoded credentials in prompts, tool inputs, generated code, and existing files. Quick start pip install aigate && aigate setup-all That's it. This installs a background proxy redact mode, a PostToolUse hook for file scanning, and registers t...

agentic-workflow-injection

Agentic workflow injection: fixtures and a coverage comparison Reproducible vulnerable/fixed fixtures for the class of bug published as CVE-2026-44246 nnU-Net, agentic workflow injection, CVSS 7.2, CWE-1427, plus the measured output of three detectors against them. It exists because there was...

SNet

SNet 日本語版はこちら / Japanese version A CTF where you use AI to capture the flag. No pentesting experience? No problem. Claude Code acts as your personal trainer — it sets up the environment, teaches you the tools, and guides you through real attack techniques step by step. You type every command...

Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor

Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems. The malicious update, version 2.1.313, was...

CVE-2026-88968

Claude Code validated Edit tool targets using point-in-time pathname and symlink resolution that was not bound to the underlying directory inodes or file descriptors. On macOS, a process running inside Claude Code's Bash sandbox could exploit the resulting time-of-check to time-of-use window by...

yolo-cage

yolo-cage: autonomous coding agents that do no harm You're a responsible engineer. You'd never just let an AI run roughshod through your most sensitive systems and codebases. That's why you'd never just shut off the safeguards for a tool like Claude Code. It asks permission for every dangerous...

Ring-0 by Default: Agents As Operating Systems (AaOS)

LLM agents now read and write files, start processes and subagents, fetch network content, load third-party extensions, and save and resume state, which are the responsibilities of an operating system. They gained these functions within about three years, but not the protections that operating...

Anthropic Claude Code < 2.1.179 Plugin Hash Pinning Bypass (CVE-2026-86063)

The version of Anthropic Claude Code installed on the remote host is prior to 2.1.179. It is, therefore, affected by a hash pinning bypass vulnerability: - The plugin install flow in Claude Code checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting...

Exploit for CVE-2026-109618

php2shell-check for Claude A passive check for Claude whether...

php2shell-checker-claude

Instrucciones en español al final PHP2Shell C...

Discordance-Based-Reward-Debugger-Abstract

Discordance-Based Reward Debugger — Abstract Trajectories A c...

Claude Code Desktop Flaw Let Malicious HTML Steal Developer Credentials

Noma Labs found a high-severity Claude Code Desktop flaw that let malicious HTML files steal local credentials and…...

@acampkin/mcc (>=2.1.0, <=2.5.0), @applydigital/claude (>=1.0.0, <=1.2.1) +36 more potentially affected by CVE-2026-86063 via @anthropic-ai/claude-code (>=2.0.0, <=2.1.175)

@anthropic-ai/claude-code NPM version =2.0.0, =2.1.0, =1.0.0, =0.0.1, =0.7.5, =0.4.2-beta.2, =19.24.1, =1.0.0-broken, =0.0.1-rc.1, =0.0.1, =0.4.0, =1.0.29, =1.0.81 and more Source cves: CVE-2026-86063 Source advisory: OSV:GHSA-PQ7J-F95F-QFCV...

EUVD-2026-100461

Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning...

@acampkin/mcc (>=2.1.0, <=2.5.0), @applydigital/claude (>=1.0.0, <=1.2.1) +36 more potentially affected by CVE-2026-86063 via @anthropic-ai/claude-code (>=2.0.0, <=2.1.175)

@anthropic-ai/claude-code NPM version =2.0.0, =2.1.0, =1.0.0, =0.0.1, =0.7.5, =0.4.2-beta.2, =19.24.1, =1.0.0-broken, =0.0.1-rc.1, =0.0.1, =0.4.0, =1.0.29, =1.0.81 and more Source cves: CVE-2026-86063 Source advisory: GHSA-PQ7J-F95F-QFCV...

@acampkin/mcc (>=2.1.0, <=2.5.0), @applydigital/claude (>=1.0.0, <=1.2.1) +36 more potentially affected by CVE-2026-86063 via @anthropic-ai/claude-code (>=2.0.0, <=2.1.175)

@anthropic-ai/claude-code NPM version =2.0.0, =2.1.0, =1.0.0, =0.0.1, =0.7.5, =0.4.2-beta.2, =19.24.1, =1.0.0-broken, =0.0.1-rc.1, =0.0.1, =0.4.0, =1.0.29, =1.0.81 and more Source cves: CVE-2026-86063 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-21201048...

Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling a plugin's upstream repository could create a branch named identically to the pinned...

GHSA-PQ7J-F95F-QFCV Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling a plugin's upstream repository could create a branch named identically to the pinned...

Unsafe Dependency Resolution

Overview @anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you. Affected versions of this package are vulnerable to Unsafe Dependency Resolution vi...