Researchers have disclosed that the official Anthropic Claude Code extension distributed through the Cursor Marketplace was compromised and used to install a persistent SSH backdoor on infected hosts. The finding does not point to a flaw in the model or the runtime; the problem sits in the distribution channel for the tooling that many developers install to run Claude Code as a local LLM harness inside VS Code or compatible editors.

The persistence is what matters. A persistent SSH backdoor survives reboots and gives an attacker a stable remote foothold. On a development machine, that kind of access can intersect repositories, credentials, environment variables, configuration files and, in some contexts, data used for fine-tuning or local inference. Even without additional unconfirmed technical details, the value of such a foothold lies in continuity: whoever controls it can observe the environment over time, decide when to act, and move laterally.

The perimeter shifts from the model to the tooling

For those following local stacks, the attention often goes to VRAM, quantization and performance. Here the vector is not the model size or the GPU: it is the software supply chain. Extensions and plugins run with high privileges inside the editor context, and an "official" label lowers suspicion even when a publisher account or build pipeline can be compromised. In other words, moving an LLM on-premises does not shrink the perimeter if developers then install unverified tooling from third-party marketplaces.

The incident adds a specific cost for teams evaluating on-premise deployment. Isolating data from the cloud is not enough; integrity of packages, release signatures and update provenance need equal attention. Cursor Marketplace is a legitimate channel, but the described compromise shows that an official repository can turn into a distribution point for malicious code when control over identity or publishing fails. When Claude Code or similar tools run locally, the developer workstation becomes a first-class attack surface, often with access to internal systems and data that centralized cloud policies would otherwise mediate.

There is also an asymmetry. Organizations that adopt local stacks for sovereignty or TCO reasons gain more direct control over data and models, but they distribute security responsibility across many endpoints. An attacker does not need to aim at the GPU server; intercepting the everyday developer tooling may be enough. The Claude Code extension compromise is a concrete example of development infrastructure, not the trained model, becoming the entry point. That is a shift security policies will need to register, especially when workflows mix official components, third-party marketplaces and local environments.