Tampered Claude Code extension on Cursor's marketplace planted an SSH backdoor

Update, November 5, 2026: Anthropic staff have since said publicly that its own systems and official channels were not compromised. Engineer Felix Rieseberg told The Register that "a malicious actor used access to Cursor's marketplace to publish a tampered copy", and security engineer David Dworken wrote that the versions on Anthropic's official channels, including VS Code and Open VSX, "are not affected and this only impacts Cursor users" (as quoted by The Hacker News). Anthropic's GitHub releases page now lists clean versions 2.1.314 (October 30) and 2.1.316 (October 31). Neither company has explained how the attacker got access to Cursor's marketplace.

A modified copy of Anthropic's Claude Code extension was distributed through Cursor's extension marketplace on October 29, 2026, between roughly 2:27 a.m. and 1:35 p.m. Pacific Time. Cursor says the tampered versions, labeled 2.1.312 and 2.1.313, collected host details, added an attacker's SSH key and set up persistence. If you use Cursor and installed or auto-updated Claude Code that day, check your machine now and follow Cursor's remediation steps; uninstalling the extension alone is not enough.

What happened, in plain English

Cursor is a popular code editor built on Visual Studio Code (VS Code). Like VS Code, it lets developers add extensions — small add-on programs that run inside the editor with the same permissions as the user. Cursor runs its own marketplace for these extensions. One of them is Claude Code, Anthropic's AI coding assistant, which many developers install so they can chat with an AI agent next to their code.

On October 29, 2026, the Claude Code package offered by Cursor's marketplace was not the real one. Someone had added a small piece of extra code to the start of the extension. As soon as the editor loaded the extension — no AI conversation needed — that code quietly did three things: it sent information about the computer to a server controlled by the attacker; it added the attacker's key to the list of keys allowed to log in to the machine over SSH (Secure Shell, the standard tool for remote logins); and it tried to open a hidden "reverse tunnel" so the attacker could reach the machine from outside, then made sure all of this would restart after a reboot.

An analogy: you ordered a known brand of door lock from a trusted shop, but the box on the shelf that day had been swapped. The lock still works, yet a stranger now has a copy of the key.

Cursor says it removed the tampered version, briefly shut down its whole marketplace, rebuilt it, and audited access. Cursor said at most 5,000 users were affected (as reported by The Hacker News, citing Cursor's statement on X). Anthropic says it was not involved in building, publishing or hosting the tampered copy. The researchers at OpenSourceMalware, who analyzed the sample, say the npm package of Claude Code and the copies on Open VSX and Microsoft's VS Code Marketplace were not affected; they trace the malicious file to Cursor's own mirror of the Open VSX registry.

Are you affected? What to do now

Most readers who do not use Cursor have nothing to do. You are in scope if:

• You use the Cursor editor, and
• The Anthropic.claude-code extension was installed or updated from the Cursor marketplace between about 2:27 a.m. and 1:35 p.m. PT on October 29, 2026 (11:27–22:35 Romania time / 09:27–20:35 UTC), and
• The installed version was 2.1.312 or 2.1.313.

Cursor's notice scopes the impact to macOS and Windows machines; OpenSourceMalware's analysis of the code also describes Linux persistence, and Cursor's own indicator list includes a Linux artefact, so Linux users of Cursor should check too.

How to check

• In Cursor, open the Extensions view and note the Claude Code version and when it was last updated. Auto-update means you may have received it without noticing.
• Look in your ~/.ssh/authorized_keys file for a key with the comment svc-telemetry (fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk). Cursor's notice gives ready-made grep / PowerShell commands.
• Look for the persistence items Cursor and OpenSourceMalware list: files ~/.config/.smt and ~/.config/.smtk; on macOS a LaunchAgent named com.apple.sysmond (it imitates an Apple name but is not Apple's); on Windows a scheduled task named SysMon or a sysmon.cmd in the Startup folder; on Linux an @reboot crontab entry.
• Search endpoint and network telemetry for connections to 134.209.82.225 (TCP 22 and 8099) and for long-running ssh -N -R or autossh processes.

If you find any of these

1. Isolate the machine from the network; preserve evidence if your security team will investigate.
2. Remove the unauthorized key, the persistence items and any tunnel processes — Cursor provides remediation scripts (remediate-macos.sh, run as the affected user, and remediate-windows.ps1, run as Administrator). Cursor and OpenSourceMalware both note that a rebuild of the host may be the safer choice.
3. From a known-clean device, rotate credentials and sessions that were reachable from that machine: cloud keys, API tokens, Git credentials, SSH keys. The malware only collected the names of secret-looking environment variables, not their values — but an attacker with SSH access could have read anything.
4. Reinstall Claude Code only from a trusted source and confirm the version (Anthropic's releases page lists 2.1.314 and 2.1.316 as of November 5, 2026); consider pausing auto-update for this extension until you have verified it. Installing a newer version does not remove the persistence, so do the cleanup first.

Cursor says the attacker's server is now offline, so the tunnel no longer works — but the key and persistence remain on machines that ran the code, which is why cleanup is still required.

The expert view

This is a distribution-channel compromise, not a vulnerability in Claude Code itself. Per OpenSourceMalware, the payload was a roughly 66-line loader prepended to the normal extension.js bundle, so the extension kept working while the payload ran on activation. There were no install scripts to flag; VS Code-style extensions run in the extension host with the user's full privileges the moment they activate, and there is no permission prompt or sandbox between an extension and the user's home directory. That is the core weakness this incident exploits.

The payload is notably low-tech and noisy: plain-HTTP beacon to a raw IP, a static SSH key, LaunchAgent/scheduled-task persistence with lookalike names. What it optimizes for is durable interactive access to developer workstations — machines that typically hold cloud credentials, source code and signing material. Enumerating env-var names matching KEY, TOKEN, SECRET, AWS or GCP is triage: it tells the operator which hosts are worth logging in to.

The open question is how the package got onto Cursor's marketplace under Anthropic's publisher identity. Cursor's notice, last updated October 30, still gives no root cause; it says it audited access, found no other tampered extensions, rotated keys and rebuilt the marketplace. Anthropic's position, per The Register, is that "a malicious actor used access to Cursor's marketplace", and it denies that its own systems were breached. Phorion CTO Luke Roberts called it "a supply-chain compromise where the attacker gained access to the official distribution channel", according to Implicator, citing Ars Technica. Note that 2.1.312 is a real Anthropic version number (released October 27 per Anthropic's GitHub releases); the malicious builds reused legitimate-looking version labels so auto-update would pick them up.

No CVE or CVSS score applies. Severity in context: the blast radius is bounded (a ~11-hour window, macOS/Windows privileges limiting the SSH steps, a server now offline), but for any affected host it is a full-access backdoor, so treat confirmed hits as incidents, not patching tasks.

The broader trend is clear: third-party registries that re-host popular extensions — Open VSX mirrors, forked-editor marketplaces, MCP and plugin directories — have become a supply-chain layer of their own, often with weaker publishing controls than the original vendor's. AI coding tools are especially attractive targets because they are installed widely, auto-updated, and trusted to touch code and terminals. Organizations should inventory which marketplaces their editors pull from, pin or allow-list extensions where possible, and monitor authorized_keys, LaunchAgents and scheduled tasks on developer endpoints.

No attribution to any threat actor has been made by Cursor, Anthropic or the researchers.

Official sources

• Cursor — Security notice: malicious Anthropic.claude-code (2.1.312 and 2.1.313), October 29, 2026, updated October 30, 2026
• OpenSourceMalware — Trojanized Claude Code extension plants persistent SSH backdoor (October 30, 2026)
• Anthropic — Claude Code releases
• Coverage: The Register — Anthropic statement on the Cursor marketplace incident (October 30, 2026)
• Coverage: The Hacker News — Official Claude Code extension on Cursor Marketplace trojanized with persistent SSH backdoor