Claude Code Extension in Cursor Hit by Malicious SSH Backdoor: Developers Urged to Check Their Systems
Developers using the Claude Code extension in the Cursor editor should inspect their machines immediately after a tampered version of the extension was briefly distributed through Cursor’s extension marketplace.
The affected builds, versions 2.1.312 and 2.1.313 for Windows and macOS, were available for roughly 11 hours on October 29, between 9:27 a.m. and 8:35 p.m. UTC. Users with automatic updates enabled may have installed the compromised extension without noticing anything unusual.
The incident is a serious reminder that developer tools are now prime targets for supply chain attacks. Code editors, extensions, AI coding assistants, Git credentials, API tokens, SSH keys, and local environment variables can all provide attackers with valuable access if compromised.
The malicious Claude Code extension looked and behaved like the legitimate version. However, attackers inserted a small loader into the extension that ran as soon as Cursor launched. Users did not need to open a Claude chat or interact with the extension for the malicious code to activate.
Once running, the tampered extension collected system information and sent it to attacker-controlled infrastructure. The stolen details reportedly included the device hostname, username, operating system, configured Git email address, public IP address, and the names of environment variables that appeared to be related to passwords, tokens, or secrets.
The extension also attempted to create persistence on affected machines. On macOS, it registered a LaunchAgent. On Windows, it created a scheduled task. It also added an SSH key labeled svc-telemetry, which could allow continued access if the attack succeeded.
In most cases, the backdoor appears to have been limited because the extension needed administrator privileges to open its remote SSH tunnel. Many systems did not grant those privileges, reducing the attack’s effectiveness. Even so, some data may already have been transmitted, and the added SSH key and startup items can remain on a machine until manually removed.
Cursor says it has worked with the relevant hosting provider to take the attackers’ server offline. However, simply updating the extension is not enough. If the malicious version was installed, the persistence mechanisms may still be present.
Anthropic has stated that its own systems were not compromised. The issue appears to involve unauthorized access to Cursor’s extension marketplace, where a modified copy of the Claude Code extension was published. The Claude Code versions available through Microsoft’s marketplace, Open VSX, and the npm package are not believed to be affected.
Cursor estimates that as many as 5,000 users may have received the compromised extension and plans to contact affected users directly. The exact method used by the attackers to publish the tampered build has not yet been publicly confirmed.
Developers should check their systems even if the extension now appears to be working normally. The malicious version was designed to blend in, and the most important signs of compromise are not visible inside the editor.
On macOS, users should search the file ~/.ssh/authorized_keys for the entry svc-telemetry.
On Windows, users should check the authorized_keys file inside the .ssh folder of their user profile. They should also inspect C:ProgramDatasshadministrators_authorized_keys for the same svc-telemetry entry.
If the svc-telemetry key is present, the machine should be treated as compromised.
A proper cleanup should include removing the affected extension, deleting the unauthorized SSH key, removing the LaunchAgent or scheduled task, and stopping any related tunnel processes. Cursor has provided cleanup guidance for macOS and Windows users.
After cleanup, developers should rotate any passwords, API keys, Git credentials, cloud tokens, SSH keys, and other secrets that may have been accessible from the affected machine. This should be done from a separate trusted device, not from the potentially compromised computer.
For high-risk environments, sensitive projects, production infrastructure, or machines with broad access to repositories and cloud systems, reinstalling the operating system is the safest option. While that may feel extreme, developer workstations often contain enough credentials to make a partial cleanup risky.
This incident highlights the growing threat of malicious developer extensions and AI coding tool impersonation. As AI-powered coding assistants become more common, attackers are increasingly targeting the tools developers trust most. Keeping extensions updated is important, but it is no longer enough. Developers should also monitor installed extensions, limit automatic trust, review SSH keys regularly, and rotate credentials quickly after any suspected compromise.
