HN Hacker News: Claude Code
Hacker News

Backdoor found in Claude Code VS Code extension on Cursor Marketplace

Phorion found a persistent SSH backdoor in versions 2.1.312 and 2.1.313 of the official Claude Code VS Code extension on the Cursor Marketplace. Cursor has removed both versions. Developers and teams who installed the extension should check their machines now, since the payload runs as soon as the extension loads.

Using Claude to shrink code attack surface: 493 issues in 25 projects

Anthropic shared research on using Claude to find code that a deployment can reach but does not need, then restrict or remove it. Across 25 open-source projects with over five million lines, it reported 493 issues. In OpenSSH, about 4,500 lines of experimental post-quantum signature code reachable before authentication were addressed in releases 10.5 and 10.6. It is a concrete method for teams using AI in security reviews.