malicious claude code extension: The Cursor SSH Backdoor, Explained

The malicious claude code extension incident is the clearest supply chain warning yet for teams that live inside AI coding tools. On October 29, 2026, a tampered copy of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313 for Windows and macOS, was served through the Cursor VS Code Extension Marketplace for roughly eleven hours, from about 2:27am to 1:35pm Pacific Time. The payload tried to install a persistent SSH backdoor on every machine that installed or auto-updated to it. Cursor says at most 5,000 users were affected. Source

This post walks through what happened, what the malware actually does on a host, why the damage stayed limited, and what engineering teams should change about how they handle editor extensions. Every technical claim below comes from Cursor's security notice, Microsoft Threat Intelligence's analysis of the injected code, or reporting by The Hacker News.

What actually happened

Someone published modified builds of the extension under the extension's legitimate identity, anthropic.claude-code, on Cursor's own marketplace. This was not a lookalike typosquat with a similar name. The package presented itself as the real extension and carried a 66-line malicious JavaScript loader inserted ahead of the legitimate code, according to OpenSourceMalware co-founder Jenn Gile. The exact method the attackers used to publish the unauthorized update has not been disclosed. Source

The blast radius is well bounded by the sources. Anthropic confirmed its own systems were not compromised, and Microsoft confirmed the tampered packages were never published to the Microsoft Visual Studio Marketplace, Open VSX, or npm's @anthropic-ai/claude-code distribution. All evidence points to the incident being limited to the Cursor marketplace during that eleven-hour window. The current clean version published by Anthropic is 2.1.314. Source

Cursor's response was fast once detected: it removed the malicious versions, shut down the entire marketplace out of caution, audited access and found no other tampered extensions, rotated its keys, rebuilt the marketplace, and worked with the hosting provider to take the attacker's server offline. Cursor also said it would contact impacted users directly. Source

How the backdoor works

Microsoft Threat Intelligence's writeup is the deepest public analysis, and it is careful about epistemics: the attack chain reflects the order the code executes, not proof that every step succeeded on every host. With that framing, the loader does five things in sequence. Source

First, reconnaissance. When the extension module loads, before normal initialization, the injected function collects the hostname, username, operating system, CPU architecture, home directory, working directories, and the globally configured Git email. It also scans environment-variable names for terms like KEY, TOKEN, SECRET, PASS, AWS, and GCP, keeping up to forty matches. Microsoft is explicit that only the names leave the host in the initial beacon, not the values, though the names alone reveal which cloud providers and credential types a machine is configured for. Source

Second, it plants an SSH identity. The loader checks the user's authorized_keys file for the comment svc-telemetry and, if missing, appends an embedded Ed25519 public key under that harmless-looking label. That single line authorizes whoever holds the corresponding private key to log in as the user, subject to the local SSH server configuration. Source

Third, it opens a reverse tunnel. Rather than waiting for an inbound connection, the malware makes an outbound SSH connection to the attacker server at 134.209.82.225 with the arguments -N -R '*:0:localhost:22', which asks the server to forward a port back to the workstation's local SSH service. It disables host-key checking, prefers autossh on Unix-like systems, falls back to a hidden PowerShell loop on Windows, and retries every sixty seconds. Microsoft maps this to MITRE ATT&CK technique T1572, protocol tunneling. Source

Fourth, persistence outside the extension folder. On macOS it writes a LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist, a name chosen to look like an Apple system component. On Linux it adds a user crontab @reboot entry. On Windows it attempts a scheduled task named SysMon running as SYSTEM, with a batch file in the user's Startup folder as fallback. Supporting scripts live in ~/.config/.smt and ~/.config/.smtk. This is why Cursor's notice warns that uninstalling the extension is not enough: the persistence scripts are standalone and keep running after the extension is gone. Source

Fifth, reporting. A delayed callback sends the collected host details and the environment-variable names to hxxp://134.209.82.225:8099/beacon over unencrypted HTTP. Throughout, the loader suppresses command output and silently catches errors, and the extension itself kept working normally so users would notice nothing. Source

Why the damage stayed limited

Several independent factors shrank the impact, and the sources are careful not to overclaim any of them. Enabling the local SSH service requires administrator rights, which the extension did not have on most macOS and Windows hosts, so on those machines the login step failed even though the key, persistence, and beacon still landed. Cursor's notice also says errors in the malicious code itself would have blocked the tunnel step outside unusual privilege configurations. Source

The attacker server was taken offline through the hosting provider, so the reverse shell and the beacon endpoint no longer function. And Microsoft's analysis repeatedly notes that the presence of a persistence artifact does not prove the startup mechanism actually ran. None of this means affected hosts are clean: the SSH key, the persistence scripts, and the leaked host metadata are real even where the tunnel never worked, which is why both Cursor and Microsoft tell impacted users to remediate regardless. Source

The window matters too. Anyone whose editor auto-updates extensions could have pulled the malicious version during the eleven hours it was live, with no action on their part. Gile's comment to The Hacker News makes the same point: the package was pulled quickly, but auto-update is exactly the feature that turns a marketplace compromise into a fleet-wide event. Source

How to check and clean up

Cursor published a one-line check per platform. On macOS and Linux, grep for svc-telemetry in ~/.ssh/authorized_keys. On Windows, check both the user authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys in PowerShell. If the key is present, the machine is impacted and Cursor's remediation steps apply: isolate the host, remove the unauthorized key and persistence mechanisms, kill running tunnel processes, and rotate credentials and sessions accessible from that host from a trusted system. Cursor shipped platform remediation scripts, and Microsoft advises preserving evidence before cleanup and verifying each startup object by its configured action rather than its name, since the artifacts masquerade as monitoring components. Source

Both vendors also point at prevention. Microsoft's guidance for organizations using Cursor includes restricting extensions to approved publishers and configuring an extension installation cooldown so newly published versions do not roll out instantly. Those two controls would have converted this incident from an eleven-hour auto-updated exposure into a reviewable event for most fleets. Source

What this means for teams, in our assessment

This section is our read, separate from the sources. The pattern to internalize is that the AI coding tool is now a software supply chain with write access to your developers' machines, and this is the second supply chain event on our radar in weeks: we covered the LiteLLM PyPI compromise in our litellm supply chain attack post, and the shape is similar, a trusted distribution channel serving a tampered artifact to developers who had no reason to suspect it. The defense in both cases is the same class of control: pin and review what enters developer environments, and treat auto-update as a risk decision, not a convenience default.

The second lesson is that extension marketplaces are now part of the threat model for AI-generated code. Teams already auditing AI output for vulnerabilities should extend the same discipline to the tooling chain itself, which is the practice we laid out in our vibe coding security checklist. And the persistence design here, scripts dropped outside the install directory with system-mimicking names, is a reminder that uninstall is not remediation, a point that generalizes to the agent configuration risks we covered in our agents.md security risk post. If you ran Claude Code inside Cursor during the exposure window, run the check today even if everything looks normal.