Cursor Confirms Malicious Claude Code Extension With SSH Backdoor Was Available for 11 Hours

Cursor has confirmed that malicious Claude Code extension packages were available through its VS Code Extension Marketplace for roughly 11 hours on October 29, 2026. The altered packages targeted Windows and macOS users and attempted to install an SSH backdoor for lasting remote access.

According to Cursor’s security notice, the affected versions were Anthropic.claude-code 2.1.312 and 2.1.313. They were available between approximately 2:27 a.m. and 1:35 p.m. Pacific Time, a window of 11 hours and eight minutes. Cursor said Anthropic did not develop these malicious versions.

The confirmation adds distribution details to Cyber Security News’ earlier report on the weaponized Claude Code extension, which examined the injected loader and SSH access method. Cursor updated its notice on October 30 to clarify affected versions and expand detection details.

The malicious code collected the hostname, username, operating system, processor architecture, home directory, working directories, configured Git email, public IP address, and environment variable names. Cursor’s account identifies variable names, rather than their values, as part of this initial collection.

It also added an attacker-controlled SSH public key labeled svc-telemetry to authorized keys, attempted to enable the local SSH service, and opened a reverse SSH tunnel. That tunnel was designed to connect the attacker’s server back to the victim’s local SSH service.

However, Cursor said errors in the malicious code and missing administrator rights limited the remote login attempt on most Windows and macOS hosts. Enabling SSH required elevated rights that the extension normally lacked. This limitation did not prevent host data collection or other malicious changes.

The payload used a macOS LaunchAgent named com.apple.sysmond to maintain the tunnel. On Windows, it attempted a scheduled task named SysMon running as SYSTEM, with a Startup-folder script as a fallback. Background scripts retried the connection roughly every 60 seconds.

Cursor Removes Packages and Disrupts Server

Cursor removed the malicious packages, blocked further distribution, and temporarily shut down the marketplace. It then audited access, rotated its keys, rebuilt the marketplace, and restored service. The company said its review confirmed that no other extensions had been altered.

Cursor also worked with the hosting provider to disable the attacker’s server. It said the reverse connection and host information uploads no longer function. Its notice reports no evidence that other Claude Code versions or the official distribution were affected.

The incident follows other cases involving trusted developer tools, including the Nx Console extension compromise. Both cases involved malicious code inside extensions, but the available reporting does not establish a shared attacker.

Cursor’s published indicators include 134[.]209[.]82[.]225, SSH connections on TCP port 22, and HTTP POST traffic to port 8099 at /beacon. Teams should also inspect authorized keys for svc-telemetry and review extension installation records, endpoint alerts, and network logs.

Affected hosts should be isolated where evidence shows payload execution or backdoor installation. Removing the extension alone is insufficient because separate scripts can remain. Cursor provides platform-specific cleanup guidance. It advises rotating accessible credentials and sessions from a trusted system and assessing whether affected machines need rebuilding.

The post Cursor Confirms Malicious Claude Code Extension With SSH Backdoor Was Available for 11 Hours appeared first on Cyber Security News.