Two security disclosures landed within 48 hours of each other this week, describing the same failure from opposite directions. On October 29, a tampered build of Anthropic's Claude Code extension sat in Cursor's marketplace for about 11 hours. The same day, Symantec published research on an unauthorized relay that rewrites Codex and Claude Code settings so requests flow through someone else's servers. One attack poisoned the distribution channel. The other poisoned the config file. Neither needed a zero-day.
The Claude Code incident is the louder one. Version 2.1.313 was live between 2:27 a.m. and 1:35 p.m. Pacific Time, reaching as many as 5,000 developers. Attackers prepended a JavaScript loader to the top of extension.js, left the rest of the legitimate code untouched, and let the payload run on load with no prompt. It installed a persistent SSH backdoor using a key named svc-telemetry and sent reconnaissance home: username, hostname, public IP, Git email, and the names of environment variables holding credentials. Only sloppy malware limited the damage. The macOS routine checked Remote Login without privileges and the Windows routine called /bin/sh, so most backdoors failed. Cursor pulled the extension, shut its marketplace to audit the rest, rotated access keys, and took the attacker's server offline.
Scorecard: Marketplace Trust vs Config Trust
Symantec's findings describe a different failure. Its Threat Hunter Team tracked a relay service across a dozen organizations since early 2026, mostly in mainland China, plus multinationals tied to South Korea, Taiwan, and Malaysia. Targets spanned semiconductors, pharmaceuticals, shipping, petrochemicals, and data centers. No binary was modified and neither agent had a vulnerability. A user ran a fileless setup script from a lookalike domain minutes after installing a tool through npm, and the script did the rest.
- Entry point: Claude Code came through a third-party marketplace listing under Anthropic's name. Codex and Claude Code were reached through a post-install script the user ran personally.
- Guardrails: the extension payload ran on load. The relay set sandbox_mode to danger-full-access in ~/.codex/config.toml, added DISABLE_TELEMETRY=1, and repointed ANTHROPIC_BASE_URL in ~/.claude/settings.json after a claude /logout.
- Detection: Cursor published a timeline within hours. Relay deployments survived for months before Symantec documented them.
- Remediation: revoke the package, rotate secrets, rebuild hosts, check for svc-telemetry, and audit base URLs and user-level environment variables.
The Uncomfortable Verdict
On distribution integrity, Claude Code loses. A marketplace could not verify who published a build under a major vendor's name, and the vendor had no say in the listing. On response speed it deserves credit: 11 hours to takedown is fast by supply chain standards. On configuration integrity, Codex loses. danger-full-access is one line in a TOML file, and turning off telemetry is just as easy. Claude Code carries identical exposure through ANTHROPIC_BASE_URL, so framing this as a Codex problem would be generous to Anthropic.
The shared lesson is that every guardrail here is advisory once an attacker can write to the same layer. Sandbox modes and telemetry flags live where installers can reach them. Audit the endpoint your agent talks to, confirm the sandbox mode, and treat download-and-execute commands after an npm install as unreviewed code.
Final scorecard: Claude Code 5/10, Codex 5/10, and developers who assumed defaults were protections, 0/10. Neither vendor shipped a broken model. They shipped trust boundaries that were never boundaries.
Comments