Do Son 
TL;DR
On October 29, 2026, AI coding editor Cursor removed a tampered extension that exposed up to 5,000 developers. Specifically, attackers slipped a Claude Code extension backdoor into version 2.1.313 of the Anthropic.claude-code package. Furthermore, this Cursor Claude Code extension backdoor attempted to install a persistent reverse SSH tunnel on macOS and Windows workstations.
Delivery and Attribution
The malicious package appeared on the Cursor VS Code extension Marketplace and the Open VSX registry early Thursday morning. According to the Cursor security notice, “Between about 2:27am PT and 1:35pm PT today, a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace.” Consequently, the rogue build remained accessible for roughly 11 hours before maintainers pulled it.
Confirmed attribution does not connect this intrusion to a known threat group. However, confirmed records prove that Anthropic did not develop the modified release. Suspected attribution points to an independent cybercriminal attempting supply chain access against software engineers. After identifying the tampered file, Cursor took its marketplace offline, rotated internal keys, and deployed clean version 2.1.314.
Infection Chain and Backdoor Setup
Independent analysis by CellCog and security researcher Paul McCarty revealed 66 lines of malicious JavaScript injected into extension.js. These lines ran before the real extension initialized. Therefore, the Claude Code extension backdoor triggered without requiring the developer to start an AI conversation.
First, the script gathered system information, including hostnames, usernames, environment variable names, Git email addresses, and public IP addresses. Next, it appended an unauthorized public key labeled svc-telemetry to the user’s SSH authorized_keys file. The script then tried to enable the local SSH daemon and launch a reverse tunnel. However, the vendor stated that “Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail.”
Command-and-Control and Exfiltration Behaviour
To survive system restarts, the payload created persistence mechanisms. On macOS, it dropped a LaunchAgent plist file. Meanwhile, on Windows, it created a scheduled task attempting to run as SYSTEM alongside a Startup folder script. These background scripts retried the reverse SSH connection every 60 seconds.
Additionally, the extension sent collected host information via an HTTP POST request to a remote server on port 8099. Fortunately, Cursor collaborated with the cloud hosting provider to dismantle the command server quickly. This hosting shutdown neutralized the active command endpoint.
Defense and Detection Guidance
Developers who installed or updated the Claude Code extension backdoor during the 11-hour window must inspect their SSH keys immediately. Users should search their authorized_keys file for the svc-telemetry label. If the string appears, administrators must isolate the machine. In addition, defenders should remove the rogue LaunchAgent files, scheduled tasks, and tunnel processes. Finally, security teams should rotate all sensitive API tokens and credentials accessible from affected systems.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
