Anthropic Extensão Claude Code para VS Code… · Exploitation confirmed

Cursor Confirms Claude Code Extension Backdoor; Up to 5,000 Hit

Oct 30, 2026 · 3 min read

Tampered copies of the Claude Code extension for VS Code (versions 2.1.312 and 2.1.313, not built by Anthropic) were published on Cursor's marketplace for roughly 11 hours on October 29 and installed a persistent SSH backdoor; Cursor confirms at most 5,000 users were affected. The marketplace was suspended and reopened after cleanup, all keys were rotated, and the attackers' server was taken offline with the cloud provider; Anthropic shipped the clean version 2.1.314. Update to 2.1.314 and, on hosts that installed the malicious versions, remove the attacker's SSH key and persistence scripts, because updating or uninstalling alone does not clean the machine.

By HIFY Radar newsroom Updated 11/02/2026 08:30 AM Get this every day →← Back to the feed 15 sources

CriticalSupply chainExploitation confirmedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A tampered copy of the Claude Code extension for VS Code was published on Cursor's marketplace and installed a persistent SSH backdoor. Cursor confirms at most 5,000 users were affected; versions 2.1.312 and 2.1.313 were live for roughly 11 hours on October 29. Anthropic says the malicious build was not developed by it and official channels were not affected.

Why it matters

The extension ran with the IDE's and user's permissions, with immediate access to local files, source code, and developer tooling. The malware collected machine data (hostname, username, OS, Git email), installed persistence, and opened a reverse tunnel to the attackers' server. Developers who installed it face potential remote access and theft of credentials and code.

What to do

Update immediately to version 2.1.314 and sweep the fleet with Cursor's detection script and IoCs. On hosts with 2.1.312 or 2.1.313, isolate the machine and remove the unauthorized SSH key, persistence scripts, and tunnel processes; uninstalling may not be enough and a rebuild should be assessed.

For the technical team

Affected: Anthropic Extensão Claude Code para VS Code comprometida no registro Open VSX e distribuída pelo marketplace de extensões do Cursor IDE; pacote malicioso anthropic.claude-code versão 2.1.313, com persistência v · Versions 2.1.312 and 2.1.313 of the anthropic.claude-code extension on the Cursor marketplace, on macOS, Linux, and Windows, for roughly 11 hours on October 29. Per Anthropic, the versions were not pushed to the Microsoft Visual Studio Marketplace, Open VSX, or npm, and official channels were not affected.
Exploitation: Distribution confirmed by Cursor: at most 5,000 users; Kevin Beaumont estimates roughly 5,000 systems downloaded the versions. Discovered by Phorion. Per Cursor and Microsoft, the step to enable the local SSH service failed on most macOS and Windows systems because it requires admin rights, preventing the attackers from logging in through the tunnel.
Fix: Malicious versions removed from the marketplace; Anthropic released 2.1.314; Cursor rotated all keys, rebuilt and reopened the marketplace, and took the attacker's server offline with the cloud provider. Cursor released a detection script and IoCs. On affected hosts: isolate, remove the unauthorized SSH key, persistence mechanisms, and tunnel processes; uninstalling the extension may not be enough and a rebuild should be assessed.
Vector: Supply chain compromise of Cursor's marketplace: a tampered copy of anthropic.claude-code published under the extension's legitimate ID. An injected IIFE prepended to extension.js runs when the module loads, before activate and without user interaction, with the IDE's and user's permissions. No privilege escalation exploit: it uses sudo -n and system calls, which fail without administrator rights.
More details: Chain: the loader collects host reconnaissance (hostname, username, OS, architecture, working directory, global Git email), appends an Ed25519 key to ~/.ssh/authorized_keys (0700 on the directory, 0600 on the file), tries to enable SSH (systemsetup on macOS, systemctl/service/init.d on Linux, PowerShell with OpenSSH Server on Windows), writes the tunnel private key to a .stk_* temp file, and connects outbound to the attackers' server; persistence via startup scripts and host details sent by a delayed callback. Malware bugs: on macOS, systemsetup -getremotelogin without admin prints an access error and exits with status 0, the /Off/i test fails, and the script never tries to enable Remote Login; on Windows, det hardcodes /bin/sh. Persistence keeps trying to open the tunnel every 60 seconds. Per The Hacker News, how the attackers published under the legitimate extension identity remains unexplained.

Timeline

11/02/2026 08:30 AM
SecurityWeek's analysis details that the backdoored extension performed host reconnaissance and attempted to create a reverse SSH tunnel.
10/30/2026 02:09 PM
Details on the malicious package's behavior: available for about 11 hours on October 29, it collected system information, added an attacker-controlled SSH key, installed persistence and tried to open a reverse SSH tunnel; Cursor says the backdoor generally failed to provide remote access.
10/30/2026 01:20 PM
Cursor confirmed the Oct 29 exposure window and capped the impact at no more than 5,000 users.

Want the next updates in your inbox? Get the daily edition →

See all 18 updates

10/30/2026 01:17 PM
Researcher warns that updating the extension leaves the attacker's SSH key and startup scripts in place, still trying to open a tunnel every 60 seconds; Cursor says even uninstalling may not be enough.
10/30/2026 12:22 PM
Warnings circulate that the compromised version installs an SSH backdoor on victims' machines for credential theft.
10/30/2026 11:38 AM
New reports detail that the malicious extension version planted SSH backdoors on infected machines.
10/30/2026 10:50 AM
Cursor estimates up to 5,000 users may have received the malicious extension version.
10/30/2026 10:19 AM
Analysis of the malicious sample details its persistence: package 2.1.313 plants an SSH key, opens a reverse tunnel and installs startup scripts; the analyzed sample targeted macOS on Apple Silicon.
10/30/2026 10:13 AM
Researcher Chris Wysopal commented on the case, citing Kevin Beaumont: the malware in the compromised extension acted as a remote access Trojan on victims' desktops.
10/30/2026 10:09 AM
The compromised extension case draws fresh discussion in the security community on r/netsec.
10/30/2026 08:43 AM
Cursor scopes the incident to marketplace version 2.1.313 during an 11-hour window on October 29 and tells victims to remove the backdoor and persistence scripts.
10/30/2026 08:41 AM
The malicious v2.1.313 shipped as an update under the legitimate Claude Code extension ID and installed an unauthorized SSH key, a reverse SSH tunnel and persistence mechanisms, while sending system details to the attackers' server; SSH access generally failed without admin rights.
10/30/2026 08:38 AM
The Hackers News says the trojanized update was version 2.1.313; how attackers pushed it under the legitimate extension's identity remains unclear.
10/30/2026 07:30 AM
Researchers say the malware installed a persistent SSH backdoor and that the incident was traced to the Cursor Marketplace compromise, taken down briefly for removal.
10/30/2026 06:00 AM
New technical details: a malicious loader injected into version 2.1.313 installed a persistent SSH backdoor, added the attackers' SSH key, and sent host data.
10/30/2026 05:45 AM
Cursor ties the malicious extension to its IDE marketplace, caps impact at up to 5,000 users, and confirms the marketplace was taken down.
10/30/2026 03:13 AM
Social media report details that the compromised version installed an SSH backdoor during a brief window.
10/30/2026 12:37 AM
Incident opened.