Cursor: Fake Claude Code extension tried to install an SSH backdoor

What this is about

Cursor, an AI-assisted development environment, disclosed a security incident on October 29, 2026. The extension marketplace of the program (compatible with VS Code extensions) offered a tampered version of the "Anthropic.claude-code" extension. According to Cursor, the package did not come from Anthropic. It ran code meant to set up a persistent SSH backdoor, meaning remote access that would let an attacker log in to your machine. At most 5,000 users may be affected.

The malicious version 2.1.313 was available on October 29 between roughly 2:27 and 13:35 US Pacific time. Cursor says it will contact affected users directly.

What the malicious version does

The extension collects system information: hostname, username, operating system, architecture, home directory, names of environment variables, working directories, the configured Git email address and the public IP address. It reports this data and the status of the backdoor via HTTP POST to a "/beacon" endpoint on port 8099.

Then it tries to add an attacker's key to the "authorized_keys" file, enable the local SSH service and open a reverse SSH tunnel. With a reverse tunnel, the infected machine itself initiates the outbound connection, so firewalls don't block the access. According to Cursor, this step fails because of bugs in the malicious code except in very unusual cases, such as when Cursor was started with administrator privileges. Enabling the SSH service requires admin rights, which the extension doesn't have on most macOS and Windows machines. There, the attacker could not have logged in through the tunnel. Even so, the extension still adds the key, installs persistence and sends host data.

For persistence, the malicious code creates a LaunchAgent on macOS and a scheduled task on Windows (trying SYSTEM first, with a startup script as a fallback). Background scripts try to set up the tunnel about every 60 seconds.

Cursor's response

Cursor says it removed the version immediately after discovery, stopped further distribution and, as a precaution, shut down the entire marketplace. It reviewed access, confirmed that no other extensions were tampered with, rotated keys, rebuilt the marketplace and brought it back online. Together with the cloud provider hosting the attacker's server, it had that server shut down. The reverse shell and data exfiltration no longer work as a result. According to Cursor, there is no evidence of other affected versions or of the official distribution being compromised.

What affected users should do

If you installed or updated Anthropic.claude-code 2.1.313 from the Cursor marketplace during that window, Cursor advises you to:

• run the impact check. It looks for the attacker's key labeled "svc-telemetry" in the authorized_keys file (macOS via grep, Windows via PowerShell, including C:\ProgramData\ssh\administrators_authorized_keys);
• search endpoint, network and installation telemetry for the published indicators;
• isolate affected machines and clean them with the scripts: "remediate-macos.sh" (run as the affected user, not as root) or "remediate-windows.ps1" (in a PowerShell with admin rights). Both remove the extension, persistence, tunnel processes and the key, and exit with an error code if anything is left over;
• consider whether the machine should be reinstalled from scratch;
• renew credentials and sessions that were reachable from the machine, using a trusted system.

Cursor warns that simply uninstalling isn't enough, because standalone scripts keep running. The fact that only the names of environment variables were collected doesn't rule out later access to credentials through the backdoor.

Indicators (selection)

The strings "134.209.82.225" and "svc-telemetry" appear in the extension.js file in the version 2.1.313 folder. On the network side: attacker IP 134.209.82.225, reverse SSH target tunnel@134.209.82.225 on port 22, a beacon on port 8099 and a local attempt on 127.0.0.1:8099. Persistence disguises itself as the LaunchAgent "com.apple.sysmond," the scheduled task "SysMon" and the script "sysmon.cmd." Requests to ifconfig.me and api.ipify.org are legitimate on their own and not an indicator. Questions go to security@cursor.com.

Context

The case joins a string of supply-chain attacks on developer extensions. According to StepSecurity, a similar case was the compromised Nx Console extension in May 2026. There, a stolen token was used to publish a malicious version to the VS Code Marketplace, which stole credentials and also targeted Claude Code configuration files. The sources don't say whether the two incidents are connected. They are separate events.

What matters for users: AI coding tools have far-reaching privileges on your machine, which makes fake extensions in the name of well-known vendors attractive. It remains unclear how the fake got into the marketplace and who is behind it. Cursor says nothing on that in its report. It's also unknown whether any machines were actually compromised. The figure of 5,000 is an upper limit. The comparison test of Codex, Cursor and Claude Code by The Mac Observer has nothing to do with this story and isn't considered here.