Trojanized Claude Code extension plants SSH backdoor via Cursor's marketplace

A tampered build of Anthropic's Claude Code extension was distributed through Cursor's own VS Code extension marketplace, and the extension ran malicious code that attempted to install a persistent SSH backdoor.

Cursor said the malicious version was available in its marketplace between about 2:27am PT and 1:35pm PT on October 29, 2026.

What happened

Cursor said it identified a security incident involving Anthropic.claude-code version 2.1.312 and 2.1.313 for Windows and MacOS in its own extension marketplace.

The company said these malicious versions of the extension were not developed by Anthropic.

The code attempted to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service, and open a reverse SSH tunnel, though errors in the malicious code meant this step would fail outside highly unusual circumstances where Cursor was started with administrator privileges.

Wired described the implant as the type malicious hackers often use as a stepping stone to deeper control inside a target network.

Impact

Cursor said the rogue extension was downloaded by at most 5,000 users.

The company said the incident does not impact other extensions downloaded from the cursor.com marketplace, Grok Bot, Grok or its other SpaceXSI products.

Cursor said it audited access and confirmed no other extensions were tampered with.

Wired reported that a flaw in the malware's design blocked it from fully establishing itself on the vast majority of targets.

Response

Cursor said it removed the malicious version from the marketplace immediately upon detection and blocked further distribution, then followed with a full shut down of the marketplace out of caution.

The company said it rotated its keys, rebuilt the marketplace, and brought it back online.

Cursor said it worked with the hosting provider to take the malicious server offline, disrupting the attack by blocking the connection to that server.

An Anthropic staff member told Wired that a malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which Anthropic did not build or publish.

Another Anthropic staff member said the episode did not involve a compromise of any Anthropic systems.

Cursor told affected users to rotate credentials and sessions accessible from affected hosts, from a trusted system.

Cursor also warned that uninstalling the extension may not be sufficient, since the payload drops standalone persistence scripts that keep running.

Lessons for security leaders

Security teams that let developers install extensions from editor marketplaces should treat those marketplaces as part of the software supply chain, since Cursor published remediation steps for the roughly 5,000 affected targets only after the fact.

Because Cursor itself warned that removal alone does not clear persistence mechanisms, incident response plans for developer-tooling compromises should assume credential rotation and host checks are required rather than optional cleanup steps.