Claude Code Extension Trojanized on Cursor: Inside the 11-Hour SSH Backdoor That Hit 5,000 Developers

Posted on 31st Oct 2026 11:05:22 in Artificial Intelligence, Machine Learning

Tagged as: Claude Code, Cursor, supply chain attack, SSH backdoor, Anthropic, developer security

For roughly eleven hours on Thursday, October 29, 2026, the official Claude Code extension on Cursor's extension marketplace was not the official Claude Code extension. A tampered build carrying a 66-line loader shipped under the real Anthropic publisher identity, reached developers through Cursor's default auto-update path, and attempted to install a persistent SSH backdoor on every machine it touched. Cursor puts the exposure at "at most 5,000 users."

This was not a typosquat. Nobody registered a lookalike name or cloned a logo. The listing was the legitimate extension, published under the legitimate publisher, retrieved from the legitimate marketplace, delivered by the legitimate update mechanism. That combination is what makes the incident a template rather than a one-off, and it is why the most important question about it is still unanswered.

What Shipped Between 2:27 AM and 1:35 PM PT

According to Cursor's own security notice, two package versions of anthropic.claude-code — 2.1.312 and 2.1.313 — were distributed through the Cursor VS Code Extension Marketplace between approximately 2:27 a.m. and 1:35 p.m. Pacific Time on October 29. That is a shade over eleven hours of live distribution for a tool that many developers have installed and update automatically.

Cursor states plainly that the malicious versions "were not developed by Anthropic," and that it has no evidence other versions of the extension or the official distribution were affected. The exposure window matters because Cursor extensions update themselves by default: a developer who never opened the marketplace that day could still have received the payload while the editor sat running in the background.

The detection was not Cursor's. It came from Phorion, a macOS security firm, whose researchers spotted the modified package and published the first technical analysis. Independent researcher Kevin Beaumont corroborated the timeline. Ars Technica reported that version 2.1.313 was distributed through Anthropic's official account on Cursor, and that as of its Friday story neither Cursor nor Anthropic had explained how attackers gained control of that account.

Inside the Payload: 66 Lines and a Key Called svc-telemetry

Phorion's analysis describes an immediately invoked function expression prepended to the minified extension.js bundle. The injection pulls in standard Node.js modules — child_process, fs, os, path, http and crypto — and runs the moment Node loads the file, before the extension's normal activate callback executes. The remainder of the bundle is the ordinary extension. Claude Code keeps working. Errors are suppressed so nothing looks wrong.

That design choice is the whole trick. The user does not have to click anything, enable anything, or notice anything. A working AI coding assistant with a silent passenger is far harder to detect than a broken one.

The payload's behaviour, per Cursor's indicators-of-compromise list and Phorion's write-up:

• Collects hostname, username, operating system, architecture, home directory, working directories, configured Git email address and public IP address.
• Harvests the names of up to about 40 environment variables matching patterns like KEY, TOKEN, SECRET, PASS, AWS or GCP. Values stay on the machine — but the list tells an operator which laptops are worth a second visit.
• Appends an attacker-controlled Ed25519 public key labelled svc-telemetry to the user's ~/.ssh/authorized_keys, then attempts to enable the local SSH service and open a reverse tunnel to 134.209.82.225.
• Beacons host details over unencrypted HTTP to hxxp://134.209.82.225:8099/beacon.
• Installs persistence that survives closing the editor: a LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist on macOS (deliberately Apple-styled), a scheduled task named SysMon that tries to run as SYSTEM with a Startup-folder script as fallback on Windows, and a @reboot cron entry on Linux. Background scripts retry the tunnel roughly every 60 seconds.

The tunnel was launched with ssh -N -R '*:0:localhost:22', with host-key checking disabled and known-hosts pointed at /dev/null. Published indicators include the key fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk and the tunnel-key fingerprint SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ.

Why Most of It Failed, and Why That Is Not Reassurance

Enabling a machine's SSH service needs administrator rights, and the extension did not have them on the overwhelming majority of macOS and Windows hosts. Cursor says that on those hosts the step failed, and the attacker could not have logged in through the tunnel. Phorion traced the macOS failure to a specific bug: the script asks the system whether Remote Login is off without admin rights, receives an error instead of an answer, and skips the step that would have switched SSH on.

Sloppy tradecraft limited the damage. It did not eliminate it. The SSH key still landed in authorized_keys. The persistence still installed. The reconnaissance still beacons. Phorion's chief executive Calum Hall put it directly: the payload's goal is long-term interactive access, and while the bug minimises impact on macOS, the malware remains a significant threat because it installs persistence and reports host reconnaissance.

There is a second reason not to take comfort from the bug. On a Mac where Remote Login was already enabled — a common setting for developers who SSH into their own machines — or on one where the user turns it on next month, the planted key is already sitting in the file, waiting. The defensive assumption has to be that the write succeeded even where the tunnel did not.

The Question Nobody Has Answered

How did a malicious actor publish to Anthropic's official listing on Cursor's marketplace? Neither company has said. Ars noted that as of Friday, Anthropic had not publicly warned customers of the incident. The Register later reported a statement from Felix Rieseberg, a member of Anthropic's technical staff, asserting that "it wasn't a compromise of Anthropic's systems or employee laptops," that a malicious actor used access to Cursor's marketplace to publish a tampered copy "which we didn't build or publish," and that the versions on Anthropic's official channels were not affected.

Anthropic published a clean version 2.1.314 to Open VSX and to Microsoft's Visual Studio Marketplace on October 30. But a denial of compromise is not an explanation of the access path. Credentials, a stolen publisher token, an insecure build pipeline, a compromised maintainer account, a marketplace-side flaw — each implies a different set of organisations that need to rotate secrets and audit history. Developers are being asked to trust the fix without being told what was broken.

Even the affected-surface question is contested. Phorion and Help Net Security initially reported the malicious package on Open VSX, the Eclipse Foundation's registry that VS Code forks rely on because Microsoft's marketplace terms restrict itself to Microsoft products. Manifold Security's Ax Sharma publicly disputed that the Open VSX build was compromised, and Cursor framed the incident as its own marketplace only. Two days on, developers still lack a single reconciled statement of where the bad bits actually were.

Cleanup Is Not the Same as Uninstalling

The remediation advice is the part most likely to be misread. Installing 2.1.314, or uninstalling the extension entirely, does not remove the backdoor. The payload drops standalone persistence scripts that run independently of the editor, which is precisely why they survive.

Cursor's suggested sequence is to grep the SSH authorised-keys file for the string svc-telemetry, isolate any host where it appears, remove the unauthorised key along with the persistence mechanisms and running tunnel processes, consider rebuilding the host, and rotate credentials and sessions reachable from it from a trusted system. Cursor has published platform-specific remediation scripts and considers them successful only if they exit with a non-zero status when anything remains. Phorion suggests hunting SSH logs for localhost logins that used the svc-telemetry key.

Any developer who installed or updated the extension from Cursor on October 29 between those two timestamps should treat the machine as suspect. So should anyone uncertain of their update history, because the update was automatic and silent by design.

The Bigger Pattern: Trust Itself Is Now the Attack Surface

Three things about this incident generalise well beyond one extension.

First, publisher identity has stopped being a useful signal. Sharma's summary is the sharpest version of the point: there was no impersonation to spot, because the publisher was real. Security guidance built around verifying vendor names, download counts and blue ticks does nothing when the attacker operates inside the verified account. Behavioural detection — a coding extension writing to authorised_keys, enabling SSH, creating a SYSTEM-level scheduled task — is what would have caught this in seconds rather than hours.

Second, auto-update is an unaudited remote code execution channel that developers have opted into for convenience. Every extension that updates itself is a standing grant of execute-as-me privileges to whoever holds the publisher's credentials. For AI coding tools the grant is unusually wide: extensions inherit editor permissions, and the editor can already read your source code, your environment and your shell.

Third, the timing is not a coincidence. One day earlier, Forever Security's EMBRACE research broke the embedded browsers in Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop — with Cursor reportedly disabling its own sandbox when blocked, and Codex and VS Code unpatched at publication. In May, a poisoned VS Code extension attack was linked to exfiltration from internal repositories. AI developer tooling is now the highest-value supply chain in software, and its security model is still built on the assumption that a marketplace listing is trustworthy.

For teams running these tools, the practical lesson is uncomfortable but simple: treat editor extensions as production dependencies. Pin versions where the editor allows it, disable silent auto-update on machines holding cloud credentials, alert on processes that write to SSH configuration or install persistence, and assume that any extension update is code execution until proven otherwise. The eleven-hour window on October 29 closed. The structural problem it exposed did not.

Sources

• Cursor — Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313)
• Ars Technica — Anthropic VS Code extension on Cursor backdoored for nearly 12 hours
• The Register — Anthropic: That Claude Code extension compromise could not be us
• Help Net Security — Claude Code extension poisoned with persistent SSH backdoor
• Phorion — Official Claude Code VSX compromise analysis
• The Hacker News — Official Claude Code extension on Cursor marketplace trojanized