If you want to check AI coding extensions for backdoors, the timing of the check matters more than the tool you use. You hand your AI coding extension your repository and your SSH keys, and on October 29, 2026 a tampered build of Anthropic's Claude Code extension sat in Cursor's marketplace for about 11 hours. Here are the five free checks from the video, what each one really catches, what each one misses, and the one that beats the other four.
The extension you already trust
Your AI coding extension has your repo and your SSH keys. A tampered Claude Code build just sat in Cursor's marketplace for about 11 hours. Of the five checks below, one beats the other four, and most developers run it at the wrong moment.
The backdoor that outlives uninstall
Picture the assistant you installed to write tests quietly adding a stranger's key to your machine. That happened on October 29, 2026: a maliciously modified build of Anthropic's Claude Code extension (versions 2.1.312 and 2.1.313) went out through Cursor's extension marketplace and stayed up most of the day. Up to 5,000 users were exposed to a hidden SSH-backdoor payload.
Cursor confirmed the build was not produced by Anthropic, removed it, and temporarily shut the marketplace. The extension name was real. The store was the one you already use. Neither one protected anybody.
The part that matters for your weekend: Cursor warned that uninstalling the extension does not remove the backdoor. The planted SSH key, the reverse tunnel and the persistence scripts stay on disk. So what you install matters, and so does what an extension leaves behind.
Four incidents, one pattern
This is not bad luck at one marketplace. In July 2025, a contributor got a commit merged into Amazon's Q Developer extension for VS Code that instructed the AI agent to wipe local files and tear down AWS resources. Amazon shipped that build on July 17 and replaced it a week later. That one arrived from the vendor itself, as a normal update.
In January 2026, Koi Security found two ChatGPT-branded extensions on the official VS Code Marketplace with nearly 1.5 million installs between them. They read the contents of files you opened, Base64-encoded them, and sent them to a server in China. That is your source code leaving one file at a time.
The newest threat is built for exactly the editors you use. GlassWorm, first identified in October 2025, steals a victim's GitHub, npm and Open VSX credentials and uses them to publish poisoned updates to the next extension that victim can reach. In 2026, researchers disclosed 73 sleeper extensions carrying it: they look clean, then turn malicious after an update. They target VS Code, Cursor, Windsurf, VSCodium and Positron.
None of this is new. Check Point found malicious VS Code extensions with more than 45,000 downloads back in 2023. What changed is reach: an AI assistant reads your whole project by design.
Checks one and two: free websites that check AI coding extensions for backdoors
Two free tools try to tell you an extension is dangerous before you install it.
ExtensionTotal, built by Koi Security and modeled on VirusTotal, unpacks any VS Code Marketplace extension, extracts hundreds of attributes and hands you a risk score. Koi's own client treats a score of 7 or higher as high-risk. That threshold is Koi's own line, not an independent standard.
The second is VSCan. You paste an extension's name or ID and get a free report on malware and spyware signs, dependency supply-chain risk, excessive permissions and data-collection behavior. Neither tool asks you to pay, and neither asks you to install anything first.
The catch comes from VSCan's own creators: the scan is "not perfect" and should only be a starting point for review. A score describes a package at one moment, and GlassWorm's sleepers are clean on the day you scan and malicious after an update. Use these instead of trusting a download count when you pick something new. Don't treat a low score as a clearance.
Check three: audit the manifest offline
If you don't want to send anything to a website at all, ExtAudit is a free, open-source command-line tool, MIT licensed and written in TypeScript. You install it with one command, npm install -g extaudit, and it runs entirely offline with no network calls. The project doesn't list hardware requirements beyond that.
It statically checks an extension's package.json against 14 built-in rules: postinstall scripts, risky network libraries, overly broad activation events, and ways around workspace trust. It scores from Safe (0 to 9) up to Dangerous (50 to 100).
You can point it at the folder you already have, with extaudit scan ~/.vscode/extensions or extaudit scan ~/.cursor/extensions, so it checks what is already on your machine, not just what you are about to install. Hold on to that; it comes back at the end.
The catch: it reads the manifest, not the behavior. A static look at package.json can flag a postinstall script, but it won't see what the code does once that script runs. Use it instead of a website scanner when your code can't leave the machine. Don't use it as your only check on an extension you've never heard of.
Check four: distrust the blue badge
On July 1, 2025, OX Security showed that the verified badge settles nothing. The verified flag VS Code displays is stored inside the extension's own bundled files. Edit it, and a malicious package still shows the badge. The researchers demonstrated arbitrary command execution as proof of concept.
Microsoft called the behavior "by design" and rated it low to moderate severity. Its reasoning: marketplace signature verification, on by default, blocks a tampered copy from being republished to the official Marketplace. But that check does not protect a VSIX file you side-load yourself. So the rule is simple: if someone hands you a VSIX file, or a guide tells you to install one by hand, the badge means nothing.
Even the official store has a window. Checkmarx Zero, a continuous marketplace-monitoring service, got Microsoft to remove a brand-jacking extension called prettier-vscode-plus within 4 hours of publication, after only a handful of installs. Fast, but never zero: the Cursor build stayed up nearly three times as long.
Check five: inventory, and the code itself
If you run a team, this is where the money goes. In April 2026, Socket acquired Secure Annex, an extension-security company whose risk inventory of browser and VS Code extensions is used by security teams at Reddit, Brave, Torq and Movable Ink. Socket is folding it into its Firewall and says it will extend that to "browser and code editor extensions, MCP servers, and AI tools."
Two honest limits there: that last part is the company's stated plan, not a shipped feature list, and Socket's pricing does not appear in any of the sources for this story, so treat cost as unknown rather than low.
For a solo developer, the fifth check costs nothing: open the extension's code before you trust it. Developers on r/programming who took apart one malicious extension argued for restricting extension installs through Group Policy and blocklisting known bad extension IDs rather than panicking (their view, not a vendor recommendation).
Reading code matters because at a WeAreDevelopers talk, researchers Raul Onitza-Klugman and Kirill Efimov live-demonstrated a malicious extension reading a developer's SSH keys and executing remote code. An installed extension runs with the same operating-system privileges as your editor. Whatever your editor can touch, it can touch.
The check that matters most
The check that beats the other four is scanning what is already installed, and running it again after every update. Checking once, at install time, is the wrong moment, and the four incidents above say why. Amazon's wiper prompt arrived as a normal update from the vendor. GlassWorm's sleepers turn malicious only after an update. And the Cursor backdoor stays on disk even after you uninstall.
If you work alone: run ExtAudit against your extensions folder after updates, and paste anything new into VSCan or ExtensionTotal first. If you run a team, you want an inventory that watches continuously, which is what Secure Annex was built for. If you ever side-load a VSIX file, ignore the badge and read the manifest yourself. And if you had either tampered Claude Code build from Cursor's marketplace, uninstalling is not enough: look for a planted SSH key, a reverse tunnel and persistence scripts.
An extension isn't safe today because it was safe yesterday.
Sources
- Malicious Claude Code extension on Cursor planted SSH backdoors
- Claude Code extension poisoned with persistent SSH backdoor
- Malicious VS Code AI Extensions With 1.5 Million Installs Steal Developer Source Code
- Checkmarx Zero Takes Down Malicious Prettier Alternative Found in VSCode Marketplace
- Can You Trust That Verified Symbol? Exploiting IDE Extensions Is Easier Than It Should Be
- GlassWorm malware attacks return via 73 OpenVSX sleeper extensions
- Introducing ExtensionTotal: How to Assess Risk in VS Code Extensions
- VSCan can detect malicious VSCode extensions
- rogerchappel/extaudit: VSCode/Cursor Extension Security Auditor
- 283 Vulnerable VS Code extensions are now at your front door
- r/programming: Reverse Engineering Malicious Visual Studio Code Extension DarkGPT
- Amazon AI coding agent hacked to inject data wiping commands
- Socket Has Acquired Secure Annex
- VSCode Security: Malicious Extensions Detected: More Than 45,000 Downloads, PII Exposed, and Backdoors Enabled