# Claude Code extension on Cursor planted SSH backdoors

URL: https://techaiwire.com/articles/claude-code-extension-2-1-313-cursor-marketplace-ssh-backdoor/

_By Claire Whitmore - Oct 31, 2026_

**By the numbers:**

- ~11 hours - the tampered builds were live in Cursor's marketplace
- 5,000 - users at most potentially affected, per Cursor as relayed
- 2 - tampered versions, 2.1.312 and 2.1.313

Cursor's extension marketplace served tampered copies of Anthropic's Claude Code extension for about 11 hours on October 29, 2026. The builds tried to open a backdoor into developers' machines over SSH, the remote login protocol. Cursor said in its [security notice](https://cursor.com/blog/claude-code-extension-security-notice) that versions 2.1.312 and 2.1.313 for Windows and macOS were affected, and that uninstalling the extension "may not be sufficient."

Cursor is an AI code editor built on VS Code, and it runs its own marketplace for VS Code extensions. Anyone who installed or updated Claude Code through that marketplace in the window should check their machine.

## What happened

The malicious builds were available between about 2:27 a.m. and 1:35 p.m. Pacific time on October 29, Cursor says. It removed them "immediately upon detection" and then shut down the whole marketplace "out of an abundance of caution." [BleepingComputer reports](https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/) that Cursor reviewed other extensions and rotated access keys before reopening it.

StepSecurity and OX Security both say Cursor put the number of users who received the build at 5,000 at most. Cursor's own notice gives no number.

"These malicious versions of the extension were not developed by Anthropic," Cursor wrote. Felix Rieseberg of Anthropic said on Hacker News that "a malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension." He added that "the versions on our official channels are not affected and this only impacts Cursor users." How the attacker got that access has not been explained.

Early reports also named Open VSX, npm and Microsoft's VS Code Marketplace. BleepingComputer says it was later confirmed that Cursor was the only source. Anthropic's David Dworken wrote that 2.1.313 "was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts."

## What the malicious code does

The payload sits inside the extension's `extension.js` file and runs as soon as the editor loads the extension. No Claude Code session is needed, according to [StepSecurity](https://www.stepsecurity.io/blog/claude-code-extension-trojanized). Security firms that took it apart describe these steps:

| Step | What it does |
| --- | --- |
| Reconnaissance | Collects machine and user names, OS, home folder, environment variable names, working folders, Git email and public IP |
| Backdoor key | Adds an `ssh-ed25519` key with the comment `svc-telemetry` to `authorized_keys` |
| SSH server | Tries to turn on the built-in SSH server, which Cursor says fails "outside highly unusual cases" |
| Reverse tunnel | Opens a tunnel to `134.209.82.225` on port 22, retrying about once a minute |
| Beacon | Sends the collected data to the same address on port 8099 |
| Persistence | macOS LaunchAgent `com.apple.sysmond`; Windows scheduled task `SysMon` plus a Startup script |

Cursor's indicator list also includes a Linux `@reboot` cron entry. The attacker's server "no longer functions," Cursor says. The persistence scripts keep running after the extension is removed, which is why uninstalling alone is not enough.

## How to check and clean up

Cursor's notice gives a check and two cleanup scripts:

- **Check for the key.** Search `~/.ssh/authorized_keys` for `svc-telemetry`. On Windows, also check `C:\ProgramData\ssh\administrators_authorized_keys`. A match means the payload ran.
- **Run Cursor's script.** Use the macOS script as the affected user, not root, and the Windows script from an elevated PowerShell. A non-zero exit code means something was left behind.
- **Remove the bad builds.** Uninstall 2.1.312 and 2.1.313. StepSecurity says 2.1.314 or newer is clean.
- **Rotate secrets.** Change the tokens and keys that machine could reach, working from a clean system: source control, CI/CD, cloud, SSH and package registry credentials.

## What this means for developers

- **Check even if you only updated.** The code ran on load, so a routine extension update in that window was enough. Search `authorized_keys` on every Cursor machine, not just your main laptop.
- **Treat a connected tunnel as a full compromise.** StepSecurity says rebuilding is the safer choice where the tunnel connected. Check SSH and auth logs for logins you do not recognize.
- **Know which marketplace you install from.** VS Code forks such as Cursor run their own extension stores. A trusted publisher name in one store says nothing about another store's security.
- **Pin extension versions on shared machines.** Automatic updates delivered this build to everyone at once. Teams can hold extensions at a known version and update after a short review.
- **Watch for the root cause.** Neither Cursor nor Anthropic has said how the attacker reached the marketplace. Until they do, assume other extensions in that store could be targeted the same way.

## Sources

- [Claude Code extension security notice](https://cursor.com/blog/claude-code-extension-security-notice) - Cursor
- [Malicious Claude Code extension on Cursor planted SSH backdoors](https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/) - BleepingComputer
- [Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines](https://www.stepsecurity.io/blog/claude-code-extension-trojanized) - StepSecurity
- [Malicious Claude Code Extension Installs SSH Backdoor via Cursor](https://www.ox.security/blog/malicious-claude-code-extension-cursor-ssh-backdoor/) - OX Security