Claude Code extension on Cursor planted SSH backdoors

Cursor's extension marketplace served tampered copies of Anthropic's Claude Code extension for about 11 hours on October 29, 2026. The builds tried to open a backdoor into developers' machines over SSH, the remote login protocol. Cursor said in its security notice that versions 2.1.312 and 2.1.313 for Windows and macOS were affected, and that uninstalling the extension "may not be sufficient."

Cursor is an AI code editor built on VS Code, and it runs its own marketplace for VS Code extensions. Anyone who installed or updated Claude Code through that marketplace in the window should check their machine.

What happened

The malicious builds were available between about 2:27 a.m. and 1:35 p.m. Pacific time on October 29, Cursor says. It removed them "immediately upon detection" and then shut down the whole marketplace "out of an abundance of caution." BleepingComputer reports that Cursor reviewed other extensions and rotated access keys before reopening it.

StepSecurity and OX Security both say Cursor put the number of users who received the build at 5,000 at most. Cursor's own notice gives no number.

"These malicious versions of the extension were not developed by Anthropic," Cursor wrote. Felix Rieseberg of Anthropic said on Hacker News that "a malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension." He added that "the versions on our official channels are not affected and this only impacts Cursor users." How the attacker got that access has not been explained.

Early reports also named Open VSX, npm and Microsoft's VS Code Marketplace. BleepingComputer says it was later confirmed that Cursor was the only source. Anthropic's David Dworken wrote that 2.1.313 "was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts."

What the malicious code does

The payload sits inside the extension's extension.js file and runs as soon as the editor loads the extension. No Claude Code session is needed, according to StepSecurity. Security firms that took it apart describe these steps:

Step	What it does
Reconnaissance	Collects machine and user names, OS, home folder, environment variable names, working folders, Git email and public IP
Backdoor key	Adds an ssh-ed25519 key with the comment svc-telemetry to authorized_keys
SSH server	Tries to turn on the built-in SSH server, which Cursor says fails "outside highly unusual cases"
Reverse tunnel	Opens a tunnel to 134.209.82.225 on port 22, retrying about once a minute
Beacon	Sends the collected data to the same address on port 8099
Persistence	macOS LaunchAgent com.apple.sysmond; Windows scheduled task SysMon plus a Startup script

Cursor's indicator list also includes a Linux @reboot cron entry. The attacker's server "no longer functions," Cursor says. The persistence scripts keep running after the extension is removed, which is why uninstalling alone is not enough.

How to check and clean up

Cursor's notice gives a check and two cleanup scripts:

• Check for the key. Search ~/.ssh/authorized_keys for svc-telemetry. On Windows, also check C:\ProgramData\ssh\administrators_authorized_keys. A match means the payload ran.
• Run Cursor's script. Use the macOS script as the affected user, not root, and the Windows script from an elevated PowerShell. A non-zero exit code means something was left behind.
• Remove the bad builds. Uninstall 2.1.312 and 2.1.313. StepSecurity says 2.1.314 or newer is clean.
• Rotate secrets. Change the tokens and keys that machine could reach, working from a clean system: source control, CI/CD, cloud, SSH and package registry credentials.

What this means for developers

• Check even if you only updated. The code ran on load, so a routine extension update in that window was enough. Search authorized_keys on every Cursor machine, not just your main laptop.
• Treat a connected tunnel as a full compromise. StepSecurity says rebuilding is the safer choice where the tunnel connected. Check SSH and auth logs for logins you do not recognize.
• Know which marketplace you install from. VS Code forks such as Cursor run their own extension stores. A trusted publisher name in one store says nothing about another store's security.
• Pin extension versions on shared machines. Automatic updates delivered this build to everyone at once. Teams can hold extensions at a known version and update after a short review.
• Watch for the root cause. Neither Cursor nor Anthropic has said how the attacker reached the marketplace. Until they do, assume other extensions in that store could be targeted the same way.