Backdoor implanted in official Claude Code for VS Code extension on Cursor Marketplace

Security researchers discovered a backdoor in the official Claude Code for VS Code extension on Cursor Marketplace. The affected version is Anthropic.claude-code 2.1.313, which was online for about 11 hours and is estimated to have affected about 5,000 users. The malicious extension collects information such as hostname, username, operating system, environment variables, Git email, and public IP; attempts to add attacker-controlled SSH keys to authorized_keys, enable the local SSH service, and establish a reverse SSH tunnel; and also uses a LaunchAgent or scheduled task to keep the tunnel active long-term, retrying about once every 60 seconds. Due to a bug in the malicious code, the SSH key implantation step will fail unless Cursor is launched with administrator privileges. This version has been taken down, Cursor has published a security advisory, and Anthropic has not yet made a statement; users who installed or updated to this version between 2:27 AM and 1:35 PM Pacific Time on October 29, 2026 need to check their systems.