Cursor Discloses Malicious Claude Code Extension in Marketplace Attempting to Plant SSH Backdoor

Cursor on October 29, 2026 disclosed a security incident involving a maliciously modified version of the Anthropic.claude-code extension in its VS Code extension Marketplace. The company said the package was not developed by Anthropic and that it ran code attempting to install a persistent SSH backdoor. At most 5,000 users were affected.

In a security notice, the company said it will reach out to affected users directly. The malicious package, version 2.1.313 of Anthropic’s Claude Code extension, was available in the marketplace between about 2:27 a.m. PT and 1:35 p.m. PT on October 29, 2026.

How the Malicious Version Behaves

Cursor said the modified extension collects host and user information: hostname, username, operating system, architecture, home directory path, environment variable names, working directories, the configured Git email address, and the machine’s public IP address.

The extension attempts to add an attacker-controlled SSH key to the user’s authorized_keys file, enable the local SSH service, and open a reverse SSH tunnel. Cursor said this step would fail outside of highly unusual circumstances in which Cursor was started with administrator privileges, because of errors in the malicious code. The company added that enabling the local SSH service requires administrative rights the extension does not have on most macOS and Windows hosts, so on those machines the attacker could not have logged in through the tunnel. Even so, the extension still adds the attacker’s SSH key, installs persistence, and sends host details to the attacker.

For persistence, Cursor said the payload installs a LaunchAgent on macOS or, on Windows, a scheduled task that attempts to run as SYSTEM with a Startup-script fallback, while background scripts retry the tunnel roughly every 60 seconds. The extension reports host details and backdoor status through HTTP POST requests to a /beacon endpoint on port 8099.

Cursor’s Response

Cursor said it removed the malicious version from the marketplace immediately upon detection and blocked further distribution, then shut down the entire marketplace as a precaution. The company said it audited access and confirmed no other extensions were tampered with, rotated its keys, rebuilt the marketplace, and brought it back online.

Cursor also said it worked with the cloud provider hosting the attacker’s server to take it offline, and that the attacker server no longer functions, leaving the reverse shell and the host-detail POST non-functional. The company said its findings concern the identified package and that it has no evidence other versions of the extension, or the official distribution, are affected.

Remediation Steps and Indicators

Cursor advised anyone who installed or updated to Anthropic.claude-code 2.1.313 from its marketplace during the exposure window to run its impact check, search endpoint, network, and extension-installation telemetry for the published indicators, isolate hosts showing evidence of payload execution or backdoor installation, and remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes using its remediation scripts while assessing whether the host should be rebuilt. Affected users should rotate credentials and sessions accessible from affected hosts, working from a trusted system.

The company warned that uninstalling the extension may not be sufficient because the payload drops standalone persistence scripts that keep running, and said the limited environment-variable collection does not rule out later credential access over the backdoor.

The impact check looks for the attacker’s public key, labeled svc-telemetry, appended to the SSH authorized_keys file: a grep command on macOS, and a PowerShell check on Windows covering both the user’s authorized_keys file and the administrators_authorized_keys file under C:\ProgramData\ssh. A machine is impacted if the key is found, in which case Cursor directs users to its remediation script for that platform.

The macOS script, remediate-macos.sh, must be run as the affected user rather than as root, and the Windows script, remediate-windows.ps1, must be run from a PowerShell session opened with administrator rights. Both remove the malicious extension, the persistence mechanisms, the running tunnel processes, and the attacker’s SSH key, and they exit with a non-zero status if anything remains.

The published indicators of compromise include SHA-256 hashes for the modified darwin-arm64 and win32-x64 VSIX packages, and a modified extension.js file in the macOS or Windows 2.1.313 extension folder containing the strings 134.209.82.225 and svc-telemetry. Network indicators include the attacker endpoint 134.209.82.225, a reverse SSH target of tunnel@134.209.82.225 on TCP port 22, an external beacon at the same address on port 8099, and a loopback beacon attempt at 127.0.0.1:8099. Cursor also listed the unauthorized ssh-ed25519 public key with fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk, a reverse-tunnel key fingerprint, persistence file paths for macOS and Windows — including a LaunchAgent labeled com.apple.sysmond, a scheduled task named SysMon, and a Startup-folder fallback script named sysmon.cmd — and command-line indicators including ssh -N -R, autossh -M 0, schtasks /create /tn SysMon, systemsetup -setremotelogin on, and an Add-WindowsCapability command installing the OpenSSH server capability.

Cursor noted that the payload’s public IP lookups go to ifconfig.me and api.ipify.org, which are legitimate services, and that access to them alone is not an indicator. The company directed questions to security@cursor.com.