AI Security Alert: Trojanized Claude Code Extension on Cursor Marketplace Planted SSH Backdoors

🌏 中文版

What happened

In the early hours of October 29, 2026 (2:27 a.m. to 1:35 p.m. Pacific, roughly 11 hours), Cursor's VS Code extension marketplace served a package under the legitimate identifier anthropic.claude-code, version 2.1.313 — but Anthropic never shipped it. Its extension.js had a roughly 66-line malicious loader spliced in ahead of the real extension code. That loader tried to plant an SSH backdoor on the victim's machine, open a reverse connection, and beacon host details to a server the attacker controlled. Cursor says at most 5,000 users installed or updated to this version during the exposure window.

Key facts

Attack surface analysis

The attackers didn't bother spoofing a lookalike package name. They published the tampered build under Anthropic's own extension identifier, anthropic.claude-code, sidestepping the one trust signal most users actually check — "does the publisher ID match." OpenSourceMalware co-founder Jenn Gile's analysis found the malicious code was a 66-line loader inserted at the very start of the legitimate extension.js, with the real extension's functionality left untouched. The loader runs automatically the moment the extension activates — no extra interaction required from the user.

Once loaded, the payload worked in three layers. First it collected host and environment data: hostname, username, OS and architecture, home and working directories, the global Git email (git config --global user.email), the public IP, and the names (not values) of up to 40 environment variables matching KEY, TOKEN, SECRET, PASS, AWS, or GCP. Next it wrote the attacker's SSH public key — labeled svc-telemetry to look harmless — into ~/.ssh/authorized_keys, and tried to enable the local SSH service and open a reverse tunnel to 134.209.82.225. Finally it set up persistence: a macOS LaunchAgent (com.apple.sysmond), or on Windows a scheduled task named SysMon (attempting to run as SYSTEM, with a Startup-script fallback), retrying the tunnel connection roughly every 60 seconds and POSTing host details in cleartext HTTP to 134.209.82.225:8099/beacon.

Per Cursor's own analysis and a teardown by security research firm Phorion, actually enabling local SSH requires admin rights the malware doesn't have on most hosts, and the code has bugs that make the step fail outright: on macOS, it checks the SSH service's status with systemsetup -getremotelogin without elevated privileges, which returns a permissions error rather than "Off" — so the activation branch never runs; on Windows, it tries to drive PowerShell through /bin/sh, a Unix shell that doesn't exist on a standard Windows install, so that path fails too. Either way, the SSH key, the persistence mechanism, and the host-info beacon still complete successfully.

This maps to OWASP LLM Top 10: LLM05 Supply Chain Vulnerabilities. The attack surface here isn't the model or a prompt — it's the distribution channel for an AI coding agent. An IDE extension runs with the user's full privileges, and once the publishing pipeline for a marketplace itself is breached, "the extension ID matches the legitimate publisher" — the one signal most users can actually check — stops meaning anything. The Hacker News also noted this happened a little over a week after attackers tampered with release binaries of OVHcloud's official CLI (which we covered here under the GlassWorm operation) — a sign that developer tooling's publishing pipelines keep being a live target.

Defense

Immediate actions

• Check whether you're affected: on macOS, run grep -qs svc-telemetry ~/.ssh/authorized_keys; on Windows, check in PowerShell whether $HOME\.ssh\authorized_keys or C:\ProgramData\ssh\administrators_authorized_keys contains svc-telemetry (Cursor's notice has the full commands)
• If it's present, run Cursor's published remediate-macos.sh or remediate-windows.ps1 to remove the SSH key, the persistence mechanism, and any running tunnel process — uninstalling the extension alone isn't enough, since the payload drops standalone persistence scripts that keep running
• Decide whether affected hosts need to be rebuilt, and rotate any credentials or sessions reachable from them; environment-variable values weren't exfiltrated directly, but if the attacker gained access through the backdoor, they could still have been read later
• Pause auto-updates for Cursor Marketplace extensions and verify the VSIX SHA-256 hash against Cursor's published advisory before updating manually

Longer-term architecture

• Treat IDE extensions like any other software supply-chain dependency: pin versions, verify hashes, and don't rely on "the extension ID matches the publisher name" as the sole trust signal
• Consider AI/ML supply-chain scanning tools like Protect AI, extending coverage beyond models and packages to the extensions and tooling that AI coding agents themselves run on
• Apply least-privilege and network egress restrictions to environments running AI coding agents — for example, limiting the ability to open outbound SSH reverse tunnels — so that even a backdoored extension has a bounded blast radius

Impact

Cursor says at most 5,000 users installed or updated to the malicious version during the roughly 11-hour exposure window, and the company says it will contact affected users directly. Because the local-SSH-enable step failed on most hosts, the share of users where the attacker actually gained remote access is likely far smaller than the exposure count — but the SSH key plant, the persistence mechanism, and the host-info beacon aren't limited by that bug, meaning those hosts still carry an attacker-usable artifact. Cursor has pulled the malicious version, rebuilt the marketplace, rotated its keys, and worked with the hosting provider to take the attacker's server at 134.209.82.225 offline, cutting off the reverse connection and the beacon channel; how the attacker obtained the publishing access needed to tamper with a package under this legitimate identifier remains publicly unexplained.

If your team uses the Claude Code extension through Cursor and has auto-update turned on, you were exposed during this window. Even if the SSH backdoor itself failed to activate on your platform, it's worth running through Cursor's checklist to confirm there's no leftover key or persistence entry — the traces this kind of attack leaves behind don't disappear just because the core payload malfunctioned.

Today's takeaway

This incident breaks a common assumption: that a matching extension ID and publisher name means the content is trustworthy. In reality the publishing pipeline itself can be breached, and the one signal a user can actually verify — "the publisher ID is correct" — stops working entirely in that scenario. What actually stops this class of attack isn't trusting publisher identity, it's hash verification and behavioral monitoring at runtime — which is also why the payload's own bugs, breaking SSH activation on most platforms, ended up being the only line of defense that actually held.

References

• Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor — The Hacker News
• Malicious Claude Code extension on Cursor planted SSH backdoors — BleepingComputer
• Security notice — malicious version of Anthropic.claude-code (2.1.313) — Cursor
• Official Claude Code Extension Compromise: Security Advisory — Phorion
• Trojanized Claude Code extension plants persistent SSH backdoor — OpenSourceMalware