Claude Code Extension Hack Planted SSH Backdoor on Cursor Users

Hakkı ALKAN

October 30, 2026

A tampered build of Anthropic’s Claude Code extension was served to Cursor users for about 11 hours on October 29, 2026, and tried to plant a persistent SSH backdoor on their computers. Cursor says at most 5,000 users installed the malicious version 2.1.313, which Anthropic did not build, and that it will contact them directly.

We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions…

— Cursor (@cursor_ai) October 30, 2026

What the Malicious Claude Code Extension Did

According to Cursor’s security notice, the modified package was available in the Cursor extension marketplace between about 2:27 a.m. and 1:35 p.m. PT (09:27 to 20:35 UTC). Once loaded, it:

• Collected host details such as hostname, username, operating system, home folder path, environment variable names, the configured Git email and the public IP address.
• Added an attacker-controlled SSH key labeled svc-telemetry to the user’s authorized_keys file and tried to enable the local SSH service.
• Tried to open a reverse SSH tunnel to the attacker’s server and kept it alive through a LaunchAgent on macOS or a scheduled task on Windows, retrying about every 60 seconds.
• Sent the collected data to the attacker’s server over plain HTTP.

Cursor says the most dangerous step usually failed. Turning on the SSH service needs administrator rights, which the extension does not have on most Mac and Windows machines, so on those hosts the attacker could not log in through the tunnel. The SSH key, the persistence scripts and the data report still went through. Cursor also worked with the hosting provider to take the attacker’s server offline, so the tunnel and the beacon no longer work.

How Cursor Responded

Cursor pulled version 2.1.313, then shut down its whole VS Code extension marketplace as a precaution. It audited access, found no other tampered extensions, rotated its keys, rebuilt the marketplace and brought it back online. Anthropic has since published a clean version 2.1.314, The Hacker News reports.

It is still unclear how the attacker got the update published under the real anthropic.claude-code extension ID. Reports also differ on its reach: macOS security firm Phorion, cited by Help Net Security, and StepSecurity say the build also appeared on the Open VSX registry, while The Hacker News found no evidence it reached Open VSX or Microsoft’s official Visual Studio Marketplace. No malicious version has been reported on Microsoft’s store.

The case follows a run of attacks aimed at developers and AI tools, including the Vapor Panda campaign that used AI agents against more than 200 organizations. It also comes a day after Anthropic was named SpaceX’s largest customer.

What Cursor Users Should Do Now

If you installed or updated the Claude Code extension in Cursor on October 29, check whether the attacker’s key is on your machine. On macOS, run this in Terminal:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

Windows users can run the PowerShell check in Cursor’s notice, which also looks at C:\ProgramData\ssh\administrators_authorized_keys. If the key is found:

• Do not rely on uninstalling the extension. Cursor warns the payload leaves standalone scripts that keep running.
• Run Cursor’s remediation script for macOS (as your normal user) or Windows (as administrator) to remove the key, the persistence and the tunnel processes.
• Isolate the machine and consider rebuilding it.
• From a clean device, rotate passwords, tokens, API keys and sessions that the affected computer could reach.

Security teams can also search their logs for connections to 134.209.82.225 on ports 22 and 8099, the attacker endpoint listed in Cursor’s indicators of compromise. As with the Binance hack earlier this week, the first hours matter most, so rotating credentials quickly is the safest move.