Phorion finds backdoor in official Claude Code extension 2.1.313

The incident centers on distribution rather than the tool itself. The extension sat on Cursor's marketplace as an official Claude Code add-on, and the body says it stayed there for roughly 12 hours before being reported. Because the code executes on load, the exposure did not depend on any action by the user, which is what makes an official-looking package different from a random download.

The body also notes that how the official account was compromised is still unknown. On Macs, an attacker-side mistake may leave the external entry point closed in some cases, but the body says the key and the persistent mechanism remain, so that is not a reason for comfort. That unresolved question is likely to shape how organizations respond, since Phorion is asking affected organizations to bring in incident-response specialists rather than simply remove the extension.

The same day's other items point in a similar direction: a new Claude Code setting, blockWritesOutsideWorkingDirectories in v2.1.314, limits file writes to the working folder, but the body explicitly says it would not have stopped this backdoor, because it covers three write tools, not malicious extensions themselves. For teams delegating work to AI, the practical gap is between guarding what the tool does and guarding what gets shipped to the tool.