Cybersecurity researchers have disclosed that the official Anthropic Claude Code extension was compromised on the Cursor Marketplace to install a persistent SSH backdoor on infected hosts.
The issue has since been traced to the compromise of the Cursor Marketplace, prompting the AI coding platform Cursor to briefly take down the service to remove the malware.
“We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users,” Cursor said. “This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the cursor[.]com/marketplace, Grok Bot, Grok, or our other SpaceXSI product
“The package identifies itself as anthropic.claude-code version 2.1.313, but its main JavaScript bundle contains a malicious 66-line loader inserted before the legitimate extension code,” Jenn Gile, co-founder of OpenSourceMalware, said in a statement shared with The Hacker News.
As of October 30, 2026, the malicious version has been removed, and Anthropic has published version 2.1.314 to both Open VSX and Microsoft VS Code Marketplace.
The extension is designed to activate after VS Code startup and when its webview opens, then proceeds to add an attacker-controlled key to the user’s “~/.ssh/authorized_keys” file. The key is labeled “svc-telemetry” in an attempt to make it appear harmless.
Subsequently, it attempts to make the victim reachable through SSH across Windows, Linux, and macOS, establishes a reverse tunnel to “134.209.82[.]225,” installs platform-specific persistence in the form of a scheduled task, crontab, and LaunchAgent, and transmits host reconnaissance data to “134.209.82[.]225:8099/beacon” on port 8099 over an unencrypted HTTP request.
“Turning on the local SSH service requires admin rights, which the malicious extension does not have on most macOS and Windows hosts,” the SpaceXAI-owned company said in its own analysis of the incident.
“On those hosts the step fails and the attacker could not have logged in through the tunnel. The extension still adds the attacker’s SSH key, installs persistence, and sends host details to the attacker. Follow the remediation steps below regardless.”
The collected data includes –
- Public IP address from api.ipify[.]org
- Hostname and local username
- Operating system and CPU architecture
- Home directory and current working directory
- Global Git email from git config –global user.email
- Names of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS, or GCP
“Environment-variable values are not placed directly in the initial beacon,” security researcher Paul McCarty said. “Their names can still reveal which cloud providers, CI systems, and credential types are configured. More importantly, successful SSH access would allow the operator to inspect the account directly.”
No other follow-on payloads have been observed. That said, the establishment of a reverse tunnel provides a pathway to the victim’s SSH service, allowing the operator to issue commands or transfer files.
“It was pulled very quickly, but anyone who has their Claude Code instance set to auto-update could have consumed the malware,” Gile said.
Cursor has revealed that the incident has affected at most 5,000 users who installed the malicious version between about 2:27 a.m. and 1:35 p.m. PT on October 29, 2026. The company also said that it will be reaching out to impacted users directly.
Users who have installed the compromised extension during the window are advised to isolate the hosts, remove the unauthorized SSH key and persistence mechanisms, and rotate credentials and sessions.
The disclosure comes a little over a week after an unknown attacker replaced the release binaries of five already-published versions of OVHcloud’s official CLI (“ovh/ovhcloud-cli”) with a secret-stealing malware after uploading them through a GitHub account of a legitimate OVH contributor (“HassenBF”) hijacked in March 2026 as part of the GlassWorm operation.
(An earlier version of the story stated that the extension on the Open VSX registry was compromised. The incident has since been traced back to a compromise of the Cursor VS Code Marketplace.)
