Malicious Anthropic Claude Code extension in Cursor AI marketplace deploys persistent SSH backdoor
A supply chain attack targeting the Cursor AI-assisted development environment has left thousands of developers potentially exposed to a persistent SSH backdoor. The incident centered on a trojanized version of the official Claude Code extension, which was distributed through the Cursor marketplace for approximately 12 hours on October 29, 2026.
This compromise specifically affected version 2.1.313 of the extension, which was published under Anthropic's legitimate publisher identity. According to Cursor, the malicious package was available from roughly 2:27 a.m. to 1:35 p.m. PDT, impacting at most 5,000 users who either manually installed the update or had their systems automatically fetch it. While a subsequent safe version, 2.1.314, was pushed shortly after, security researchers warn that simply updating the extension does not remove the malicious artifacts already planted on a compromised machine.
The Mechanics of the Backdoor
Once installed, the malicious extension executes a 66-line loader designed to grant attackers deep access to the host machine across Windows, macOS, and Linux. The primary goal of the loader is to install a persistent SSH backdoor by adding an attacker-controlled key, labeled "svc-telemetry" to avoid suspicion, to the user's authorized_keys file. It then attempts to enable the local SSH service and establish a reverse SSH tunnel to the IP address 134.209.82.225. To ensure the connection survives a reboot, the malware configures platform-specific persistence via LaunchAgents on macOS and scheduled tasks or startup scripts on Windows.
Beyond establishing a remote foothold, the extension performs extensive host reconnaissance. It collects the public IP address, hostname, local username, operating system, CPU architecture, and the user's global Git email. Most critically, the malware scans for up to 40 environment variables containing keywords such as KEY, TOKEN, SECRET, PASS, AWS, or GCP. While the values of these variables are not sent in the initial beacon, the mere presence of these names allows an attacker to identify which cloud providers and credential types are configured on a machine, enabling them to prioritize high-value targets for follow-up attacks. This reconnaissance data is transmitted via unencrypted HTTP POST requests to a beacon server at 134.209.82.225:8099.
Despite the sophistication of the reconnaissance, a significant flaw in the malware's design limited its impact. Enabling the local SSH service typically requires administrator privileges, which the extension does not possess on most standard macOS and Windows installations. In these cases, the attempt to open the reverse tunnel fails, preventing the attacker from logging in. However, researchers from Phorion and Microsoft note that the malware still successfully installs the SSH key and persistence mechanisms, and continues to beacon host data back to the operator.
Attribution and Remediation
The origin of the compromise has been a point of contention between the involved parties. While the malicious version was distributed under Anthropic's identity, Anthropic has explicitly denied that its own systems or employee laptops were breached. Technical staff from Anthropic stated that a malicious actor used access to Cursor's marketplace to publish a tampered copy of the extension that Anthropic did not build or host. Microsoft and Open VSX have also confirmed that the malicious version was never distributed through their respective marketplaces, limiting the scope of the attack to Cursor users.
In response to the breach, Cursor temporarily shut down its extension marketplace to rotate keys, audit access controls, and rebuild the marketplace. The company also coordinated with the cloud provider hosting the attacker's server to take the reverse shell offline. For affected users, the recommended remediation is extensive: isolating the host, manually removing the unauthorized SSH key and persistence artifacts, and rotating all cloud credentials and session tokens.
This incident highlights a growing vulnerability in the AI toolchain, where the integration of third-party extensions into development environments creates a high-leverage target for supply chain attacks. As developers increasingly rely on AI-assisted IDEs that possess broad permissions to local files and environment variables, the security of the marketplaces distributing these tools becomes a critical point of failure. The fact that a malicious package could be published under a legitimate identity for half a day suggests that the verification and publication pipelines for AI extensions may currently lack the rigor required to protect sensitive developer environments.
