Backdoor implanted in official Claude Code for VS Code extension on Cursor Marketplace
Security researchers discovered a backdoor in the official Claude Code for VS Code extension on Cursor Marketplace. The affected version is Anthropic.claude-code 2.1.313, which was online for about 11 hours and is estimated to have affected about 5,000 users. The malicious extension collects information such as hostname, username, operating system, environment variables, Git email, and public IP; attempts to add attacker-controlled SSH keys to authorized_keys, enable the local SSH service, and establish a reverse SSH tunnel; and also uses a LaunchAgent or scheduled task to keep the tunnel active long-term, retrying about once every 60 seconds. Due to a bug in the malicious code, the SSH key implantation step will fail unless Cursor is launched with administrator privileges. This version has been taken down, Cursor has published a security advisory, and Anthropic has not yet made a statement; users who installed or updated to this version between 2:27 AM and 1:35 PM Pacific Time on October 29, 2026 need to check their systems.
Why read this
AI score 80
The original article lists the malicious extension's specific behaviors, affected versions, and installation time window, allowing developers to check whether their systems were compromised.
Topics
Body · AI translation
Security researchers discovered a backdoor in the official Claude Code for VS Code extension on the Cursor Marketplace. The malicious version has been taken down, and the attackers have also shut down their server. Cursor has published a security advisory, but Claude Code developer Anthropic has not made any statement. The affected version is Anthropic.claude-code 2.1.313, which was live for about 11 hours, with an estimated 5,000 affected users; the extension attempts to implant a persistent SSH backdoor. The malicious extension: collects host and user information: hostname, username, operating system, architecture, home directory path, environment variable names, working directory, configured Git email, and public IP. It attempts to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service, and establish a reverse SSH tunnel. Due to a bug in the malicious code, this step will fail unless Cursor was launched with administrator privileges (which is extremely rare). It attempts to make the reverse SSH tunnel persist via a LaunchAgent (macOS) or a scheduled task (Windows; the task attempts to run as SYSTEM, with a startup script as a fallback). A background script retries establishing the tunnel approximately every 60 seconds. It reports host details and backdoor status via HTTP POST to /beacon on port 8099. If users installed or updated to Anthropic.claude-code 2.1.313 or later from the Cursor VS Code extension marketplace between 2:27 AM and 1:35 PM Pacific Time on October 29, 2026, they need to check their systems.