Trojanized Claude Code Extension on Cursor Marketplace Planted SSH Backdoors

A tampered copy of Anthropic’s Claude Code extension sat in Cursor’s VS Code Extension Marketplace for about 11 hours on October 29, quietly planting an attacker’s SSH key on developer machines and phoning home with details about each system. Cursor estimated that at most 5,000 users were affected before it pulled the package, shut down the entire marketplace and rebuilt it.

The malicious builds carried the extension’s legitimate identity, Anthropic.claude-code, so developers who received them saw what looked like a routine update to a trusted tool. Cursor said the tampered versions were not developed by Anthropic, and Anthropic has said its own systems were not compromised.

An 11-hour window on Windows and macOS

According to Cursor’s security notice, the modified extension was available between about 2:27 a.m. and 1:35 p.m. Pacific time on October 29, 2026. Cursor first named version 2.1.313 and, in an October 30 update, said versions 2.1.312 and 2.1.313 served from its marketplace for Windows and macOS were both malicious.

Cursor said it removed the package as soon as it was detected, blocked further distribution and then took the whole marketplace offline “out of an abundance of caution.” The company said it audited access, confirmed no other extensions had been tampered with, rotated its keys and rebuilt the marketplace before bringing it back online. It also worked with the hosting provider to take the attacker’s server offline.

Endpoint security firm Phorion first spotted the tampered package.

What the backdoor tried to do

Researchers who unpacked the extension found that only its main extension.js file had been altered. A short loader was placed ahead of the legitimate code, which means it ran as soon as the extension loaded. A user did not need to start a Claude conversation for it to fire.

Cursor said the payload:

• Collected the hostname, username, operating system, architecture, home directory, working directories, configured Git email, public IP address and the names of environment variables, then sent them to the attacker over plain HTTP on port 8099
• Added an attacker-controlled SSH public key labeled svc-telemetry to the user’s authorized_keys file
• Tried to switch on the local SSH service and open a reverse SSH tunnel to 134[.]209[.]82[.]225
• Set up persistence through a LaunchAgent named com.apple.sysmond on macOS and a scheduled task named SysMon on Windows, with a Startup folder fallback, retrying the tunnel about every 60 seconds

There is one piece of good news. Turning on the SSH service requires administrator rights, which the extension did not have on most Windows and Mac systems, and Cursor said errors in the malicious code also caused that step to fail. Unless Cursor was running with administrator privileges, the attacker could not have logged in through the tunnel. Cursor stressed that the key, the persistence scripts and the host beacon were still installed regardless.

Anthropic says its systems were not involved

Early speculation online suggested the bad build came from a breach at Anthropic or from the Open VSX registry. Anthropic pushed back on both. A member of its technical staff said the company was working with Cursor but that the incident “wasn’t a compromise of Anthropic’s systems or employee laptops,” adding that “a malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension.”

Anthropic said the official VS Code Marketplace and Open VSX listings were not affected. Version 2.1.313 is no longer listed on official channels, and Anthropic shipped its next update as 2.1.314.

Neither company has publicly explained how the attacker obtained the access needed to publish the package to Cursor’s marketplace. Cursor had not issued any public statement on the root cause at time of publication.

Why uninstalling is not enough

Removing the extension does not remove the backdoor, because the payload drops standalone scripts that keep running. Cursor published check and cleanup scripts for both platforms. Anyone who installed or updated the Claude Code extension from Cursor’s marketplace on macOS or Windows during the exposure window should:

• Search ~/.ssh/authorized_keys (and administrators_authorized_keys on Windows) for the svc-telemetry key
• Run Cursor’s remediation script, which removes the extension, persistence, tunnel processes and the attacker’s key
• Isolate any host that shows signs of the payload and consider rebuilding it
• Rotate credentials and sessions reachable from the affected machine, from a separate trusted system

Cursor warned that the limited environment variable collection “does not rule out later credential access over the backdoor,” which is why it recommends treating secrets on any affected machine as exposed.

Developer tools keep getting hit

The incident is the latest in a run of attacks aimed at the software developers use every day. AI coding tools are especially attractive targets because they run with broad access to source code, terminals and cloud credentials. BreachNews has covered the Miasma attack on npm packages and AI developer tools, the second LiteLLM supply chain attack and the TeamPCP worm, all of which targeted developer secrets through trusted channels.

What sets this case apart is that the malicious code arrived through an official marketplace, under a well-known publisher name, as an ordinary update. For teams that allow AI extensions on developer workstations, it is a reminder to monitor extension changes like any other software deployment. Our guide on how to tell if a browser extension is malicious covers warning signs that also apply to IDE extensions.