Cursor said a tampered Claude Code extension in its VS Code marketplace tried to plant an SSH backdoor on developer machines on 29th October, 2026. The fake version 2.1.313, which Anthropic did not build, reached up to 5,000 users before Cursor pulled it.
Key Facts
- Cursor, the SpaceX-owned coding-tool company, said the malicious build was live from about 2:27 a.m. to 1:35 p.m. PT.
- The extension collected hostnames, usernames, Git emails, and public IP addresses, then reported them to an attacker server.
- A plain uninstall may not clean an infected machine, since the payload drops standalone persistence scripts that keep running.
- The attacker’s SSH key, labeled svc-telemetry, is the fastest way to check whether a machine took the payload.
The tampered build tried to open a reverse SSH tunnel
Cursor’s security notice walks through the payload step by step. It appended an attacker-controlled key to the user’s authorized_keys file. Then it tried to switch on the local SSH service and open a reverse tunnel to 134[.]209[.]82[.]225.
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the https://t.co/sJRGX5jLXW, Grok Bot, Grok or our other SpaceXSI products. In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk. If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314: https://t.co/ESqf7YEtHZ
— Cursor (@cursor_ai) October 30, 2026
That second step mostly failed. Turning on SSH needs admin rights, which the extension lacks on most macOS and Windows hosts. Cursor also said bugs in the malicious code would break it unless the editor ran with administrator privileges. On those machines, the attacker couldn’t log in through the tunnel.
The key still landed, though, and so did the persistence. On macOS the payload writes a LaunchAgent labeled com.apple.sysmond, borrowing Apple’s own naming prefix. On Windows it registers a scheduled task called SysMon that tries to run as SYSTEM, with a Startup-folder script as fallback. Background scripts retry the tunnel roughly every 60 seconds and report status via HTTP POST to a /beacon endpoint on port 8099.
That design explains the most uncomfortable line in Cursor’s notice: “Uninstalling the extension may not be sufficient.” The scripts sit outside the extension folder, so removing the extension leaves them running.
The fingerprinting also went past names and IP addresses. Cursor said the extension took the OS, CPU architecture, home directory path, working directories, and environment variable names. The company called that variable grab limited, yet warned it does not rule out later credential access over the backdoor. Its indicator list also flags public-IP lookups to ifconfig[.]me and api[.]ipify[.]org, though Cursor notes those are legitimate services and access alone proves nothing.
Cursor has not said how the package got in
Cursor removed version 2.1.313, blocked further distribution, and then shut its whole VS Code marketplace down as a precaution. It audited access, found no other tampered extensions, rotated its keys, and rebuilt the marketplace before bringing it back. Cursor also worked with the cloud host to take the attacker server offline, so the beacon and reverse shell no longer function. Cursor said it will reach out to affected users directly.
Cursor says it has no evidence that other versions or the official distribution were touched. It hasn’t explained how a package carrying the Anthropic.claude-code identifier got published to its store. Nor has it said how many affected users ended up with the svc-telemetry key on disk. Anthropic did not immediately respond to a Reuters request for comment.
The attack ran on trust in a brand name. A developer who accepted the update saw an Anthropic-labeled package in the store their own editor vendor runs. That’s the same weak point behind an earlier VS Code extension supply-chain attack on GitHub.
Cursor’s editor has had its own flaws, including a remote code execution bug in the AI editor. This incident hit the distribution channel instead, which puts the burden on marketplace controls.
What’s Next?
Anyone who installed or updated to 2.1.313 from Cursor’s marketplace in that window should search ~/.ssh/authorized_keys for svc-telemetry, plus C:ProgramDatasshadministrators_authorized_keys on Windows.
A match means the machine is impacted, and Cursor’s remediation scripts strip the extension, persistence, tunnel processes, and key. The macOS script runs as the affected user rather than root, while the Windows one needs an elevated PowerShell. Cursor also advises rotating credentials and sessions reachable from that host from a separate trusted system, which helps reduce risk.
