Trojanized Claude Code extension on Cursor: an SSH backdoor shipped for about 12 hours

On October 29, 2026, trojanized versions of the Claude Code extension were distributed for about twelve hours on the marketplace of Cursor, the AI code editor. They installed an SSH backdoor on the Windows and macOS machines that installed or updated them. Anthropic says it did not build or publish these versions, and its official channels are not affected. Here is who is concerned, what the malicious code did, and how to check and clean a machine.

What happened

As Cursor explained in its security notice, versions 2.1.312 and 2.1.313 of the anthropic.claude-code extension, for Windows and macOS, were available on its marketplace between 2:27 am and 1:35 pm Pacific time on October 29. Users who installed or updated the extension during that window are affected. StepSecurity converts that window to 09:27 to 20:35 UTC and says that, per Cursor’s initial figure, at most 5,000 users received these builds.

Cursor first named only version 2.1.313, then revised its notice to add 2.1.312, as The Hacker News noted. The latest legitimate version published by Anthropic on Open VSX and on Microsoft’s marketplace is 2.1.314.

Anthropic and Cursor: who published what

According to Cursor, these versions were not developed by Anthropic, and it has no evidence that other versions of the extension or the official distribution are affected. StepSecurity reports that Anthropic stated that 2.1.313 was never published on Open VSX or the Visual Studio Marketplace, that the 2.1.312 served by Open VSX was verified clean, and that its systems and employee machines are not compromised. StepSecurity also corrected its first account, which had presented Open VSX as the origin.

According to Anthropic, cited by The Hacker News, a malicious actor used access to Cursor’s marketplace to publish a modified copy. How that access was obtained is unknown, no specific actor is named, and Cursor does not describe the intrusion vector in its notice. Cursor says it rotated its keys, rebuilt its marketplace after shutting it down as a precaution, and states that no other extension was altered.

What the malicious code did

StepSecurity describes a loader added at the top of the extension’s main file, the rest being identical to the clean 2.1.312. It runs as soon as the module loads, under plain Node.js, without any conversation with Claude, and it uses no install hook such as postinstall. It does not download a second stage.

• Reconnaissance: it sends, over unencrypted HTTP, the hostname, username, system, directories, configured Git email and public IP address, along with the names (not the values) of environment variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP.
• SSH access: it adds an attacker key, labeled “svc-telemetry”, to the authorized_keys file and tries to enable the SSH service, which generally fails without administrator rights.
• Reverse tunnel: it tries to open an SSH tunnel to the attacker’s server, retried about every 60 seconds.
• Persistence: a LaunchAgent named com.apple.sysmond on macOS, or a “SysMon” scheduled task (or a sysmon.cmd startup script) on Windows, according to StepSecurity.

Cursor estimates the attacker probably could not connect through the tunnel on most macOS and Windows hosts, as The Hacker News noted, but the key and persistence are installed in every case. The attacker’s server (134.209.82[.]225) was taken offline on October 30, according to StepSecurity. In its weekly roundup, This Week in Security describes a compromise of about twelve hours.

How to tell if you are affected

1. Check whether you installed or updated the Claude Code extension from Cursor’s marketplace (not VS Code’s) on October 29, between 2:27 am and 1:35 pm Pacific time. StepSecurity stresses that having the version does not by itself prove a compromise.
2. Look for the “svc-telemetry” key in the ~/.ssh/authorized_keys file and for the persistence mechanisms listed above.
3. Check the indicators of compromise in Cursor’s notice, updated on October 30, and your endpoint telemetry.

What to do if the machine installed the trojanized version

• Isolate the machine and preserve evidence.
• Remove the SSH key, persistence mechanisms and tunnel processes. Uninstalling the extension is not enough, because persistence scripts keep running. Cursor provides remediation scripts for macOS and Windows, and suggests considering rebuilding the machine.
• Rotate credentials and revoke sessions reachable from the machine, from a trusted system. Cursor says the code only collects the names of environment variables, but that this does not rule out later credential access.

What this incident reminds us of

This part is our analysis. An editor extension runs with the user’s rights and updates itself: a single trojanized build on a marketplace is enough to reach thousands of developer machines full of keys, tokens and repository access. Measures to consider:

• Limit extensions installed in sensitive environments and keep an inventory.
• Control automatic extension updates on machines that handle production secrets.
• Do not confuse a sandbox with the editor: isolating the coding agent in a container, as we explain in our article on Docker sbx, protects what the agent runs, not necessarily the extension, which runs in the editor on the host machine.
• Watch for new SSH keys and new scheduled tasks or LaunchAgents on development machines.

Frequently asked questions about the trojanized Claude Code extension