Claude Code extension tampered with in the Cursor marketplace: what developer teams need to know about the SSH backdoor
October 31, 2026
The incident at a glance
On October 29, 2026, the marketplace of the AI code editor Cursor distributed a tampered Claude Code extension that set up an SSH backdoor. It was published under the genuine identifier anthropic.claude-code, not as a look-alike with a similar name. According to Cursor's updated security notice, versions 2.1.312 and 2.1.313 for Windows and macOS were affected and were available between about 09:27 and 20:35 UTC (2:27 a.m. to 1:35 p.m. Pacific Time). The injected code added an attacker SSH key, tried to open a reverse channel to the attackers' server, made itself persistent and sent a profile of the machine. Cursor puts the number of affected users at no more than 5,000. The extension on the Visual Studio Marketplace and on Open VSX was not affected. Anyone using Claude Code in Cursor should check their machines now – uninstalling the extension alone does not remove the backdoor.
What the tampered extension did
According to Cursor and analyses by OpenSourceMalware and StepSecurity, a short loader sat at the top of the main file extension.js, ahead of the extension's actual code. It ran as soon as the extension was loaded; no conversation with Claude was needed. The loader added an attacker public SSH key with the comment svc-telemetry to the user's authorized_keys file, tried to enable the local SSH service and to open a reverse SSH tunnel to the server 134.209.82.225. Through this tunnel the attackers could have logged in to the machine from outside. For persistence it created the LaunchAgent com.apple.sysmond on macOS and, on Windows, a scheduled task named SysMon running with SYSTEM privileges, with a script in the Startup folder as a fallback. Background scripts retried the tunnel roughly every minute. The loader also sent a profile of the machine over unencrypted HTTP to port 8099 on the same server.
What data was sent – and what was not
According to Cursor, the profile contained the hostname, user name, operating system, processor architecture, home and working directories, the global Git email address and the public IP address. It also listed the names of environment variables that point to keys, tokens, passwords or cloud access, for example names containing KEY, TOKEN, SECRET or AWS. Based on the analyses so far, the values of these variables were not transmitted. For attackers, even the list is valuable: it shows which machines hold access to cloud, source code and build systems. No additional payloads have been observed so far. Cursor says it took the attackers' server offline together with the hosting provider.
Why the backdoor mostly could not be used – and why action is still required
Enabling the SSH service requires administrator rights. An extension usually does not have them on macOS and Windows, and according to Cursor the malicious code also contained errors. On most machines this step therefore failed, and the attackers could not log in through the tunnel. Cursor explicitly names one exception: machines on which Cursor was started with administrator rights. We also recommend checking machines particularly thoroughly on which an SSH service was already running. Regardless, the extension added the key, installed persistence and sent the profile. These traces remain after uninstalling – anyone affected has to clean up.
Is my machine affected? How to check
You may be affected if you use Claude Code in Cursor and installed or updated the extension on October 29, 2026 between about 09:27 and 20:35 UTC. The quickest test is to look at the authorized_keys file: does it contain an entry with svc-telemetry? On macOS, running grep svc-telemetry ~/.ssh/authorized_keys in the terminal is enough; on Windows, check %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys. Further indicators are the LaunchAgent ~/Library/LaunchAgents/com.apple.sysmond.plist, the scheduled task SysMon, the file sysmon.cmd in the Startup folder, files such as ~/.config/.smt, ~/.config/.smtk or smt.cmd, temporary files matching the pattern .stk_ and connections to 134.209.82.225 on ports 22 and 8099. Cursor also lists a cron entry with @reboot as an indicator. The complete list with checksums is in Cursor's security notice. Requests to services such as ifconfig.me or api.ipify.org are not an indicator on their own.
What affected users should do now
1. Disconnect affected machines from the network and preserve evidence before cleaning up. 2. Remove the svc-telemetry key, the LaunchAgent or the SysMon task including the Startup script, the files under .config and any running ssh or autossh tunnel processes. Cursor provides the scripts remediate-macos.sh, to be run as the affected user and not as root, and remediate-windows.ps1 for an elevated PowerShell; both report an error as long as traces remain. 3. Only then remove the extension and replace it with the clean version 2.1.314 or later published by Anthropic. 4. From a clean machine, rotate all credentials that were reachable on the device: SSH keys, tokens for GitHub, GitLab and package registries, CI/CD secrets, cloud access and API keys – and end open sessions. 5. Review SSH, process and authentication logs for follow-on activity. If anyone logged in through the tunnel, we recommend rebuilding the machine.
Check reporting obligations under GDPR, NIS2 and DORA
The profile contains personal data such as the user name and Git email address. Your data protection team should assess whether this requires a notification to the supervisory authority – the deadline is 72 hours from becoming aware of the breach. Even if no notification is required, the breach must be documented. If the access was actually used or further systems are affected, additional reporting obligations may apply to entities under NIS2 and to financial entities under DORA. Document checks, findings and decisions from the start.
How the attackers got into the marketplace – and what remains open
It is still unclear how the attackers were able to publish the tampered version in Cursor's marketplace. Cursor stresses that the versions were not developed by Anthropic. On October 30, Anthropic clarified that neither its own systems nor employee machines were compromised: someone used access to Cursor's marketplace to publish the tampered copy, and the official channels are not affected. According to Anthropic, version number 2.1.313 was never published through official channels, which is why the next release is numbered 2.1.314. Cursor immediately removed the version, shut down and rebuilt its marketplace as a precaution, audited access – finding no other tampered extensions – and rotated its keys. Early reports also named Open VSX and the Visual Studio Marketplace as sources; this has since been corrected.
What the incident means for organisations
Code editor extensions run with the rights of the logged-in user and can reach source code, credentials and terminals. With AI assistants, agent skills and MCP servers, this supply chain on developer machines keeps growing, yet it is rarely controlled as strictly as servers or build pipelines. The incident shows that a trusted publisher and a genuine identifier offer no protection when the distribution channel itself is compromised. We recommend including developer machines in asset and vulnerability management, defining approved extensions and marketplaces, rolling out updates in sensitive environments in a controlled way and replacing long-lived credentials on developer machines with short-lived ones. Background on AI coding agents as a supply chain risk: https://vamisec.com/en/wissen/secure-software-development/slopsquatting-coding-agents · Securing agent skills: https://vamisec.com/en/agent-skills-security · MCP security: https://vamisec.com/en/mcp-security
How VamiSec helps
We check and clean affected machines, look for follow-on activity as part of a compromise assessment and support the orderly rotation of credentials. If you suspect a compromise, our CSIRT is available around the clock at csirt@vamisec.com. More on compromise assessments: https://vamisec.com/en/compromise-assessment · Incident response and forensics: https://vamisec.com/en/wissen/it-security/incident-response-forensik
All links and sources
Cursor security notice with indicators and remediation scripts: https://cursor.com/blog/claude-code-extension-security-notice · The Hacker News: https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html · StepSecurity: https://www.stepsecurity.io/blog/claude-code-extension-trojanized · BleepingComputer: https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/ · Sophos: https://www.sophos.com/en-us/blog/malicious-claude-code-extension-distributed-through-cursor-marketplace
Frequently asked questions about the tampered Claude Code extension
Which versions of the Claude Code extension are affected?
According to Cursor, versions 2.1.312 and 2.1.313 of anthropic.claude-code for Windows and macOS that were distributed through the Cursor marketplace on October 29, 2026 between about 09:27 and 20:35 UTC. The extension from the Visual Studio Marketplace and from Open VSX is not affected. The clean version is 2.1.314.
Am I affected if I use Claude Code in VS Code or in the terminal?
Based on current information, no. The tampered version was only distributed through Cursor's marketplace. VS Code installs the extension from the Visual Studio Marketplace, and according to OpenSourceMalware the npm package @anthropic-ai/claude-code for the terminal is not affected.
Is uninstalling the extension enough?
No. The malicious code creates an SSH key, standalone scripts and a LaunchAgent or scheduled task that remain after uninstalling. Remove these traces first, for example with Cursor's scripts, and then rotate your credentials.
Were passwords or API keys stolen?
Not directly, based on the analyses so far: the names of environment variables were transmitted, not their values. Because the attackers wanted to establish persistent access, you should still rotate all credentials reachable on affected machines.
How can I quickly check whether my machine is affected?
Search the authorized_keys file for the entry svc-telemetry – on macOS with grep svc-telemetry ~/.ssh/authorized_keys, on Windows in %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys. Also check for the LaunchAgent com.apple.sysmond, the scheduled task SysMon and connections to 134.209.82.225.
Who is behind the attack?
That is not known. Neither Cursor nor Anthropic has explained so far how the attackers gained access to the marketplace. Anthropic stresses that its own systems were not compromised.
Do you have questions about your organization's IT security?
Free Initial Consultation →