Claude Code Extension Backdoor in Cursor Explained: What Happened, How It Works, Limits and Risks

Last updated: 31 October 2026

On 29 October 2026, developers who use the Cursor code editor received what looked like a routine update to Anthropic’s Claude Code extension. It was not routine. A tampered build had been slipped into Cursor’s extension marketplace, and for roughly 11 hours it tried to plant an attacker’s SSH key on developer laptops, open a hidden tunnel back to the attacker’s server and quietly report details about each machine. Cursor has said that up to 5,000 users may have received it.

Anthropic says it did not build or publish the malicious version, and Cursor has said the same. The problem was not inside the AI model at all. It was in the plumbing that delivers AI tools to our editors: the extension marketplace. That is exactly why I think this incident deserves more attention from students than another benchmark chart. AI coding assistants now sit on the machines where we keep our code, our cloud keys and our SSH access, and attackers have noticed.

In this post I explain what happened, how the backdoor worked step by step, how to check whether your machine is affected, where the reports disagree, and what Indian students, educators and developers should learn from it.

Quick summary

• What happened: Tampered builds of the anthropic.claude-code extension (Cursor’s updated notice names versions 2.1.312 and 2.1.313) were served through the Cursor extension marketplace on 29 October 2026.
• Exposure window: About 2:27 am to 1:35 pm Pacific time on 29 October, which is roughly 2:57 pm on 29 October to 2:05 am on 30 October in India (IST).
• Who was hit: Cursor users who installed or auto-updated during that window. Cursor has been reported as saying at most 5,000 users were affected.
• What it did: A small loader added to the extension’s main JavaScript file tried to add an attacker SSH key, enable SSH, open a reverse SSH tunnel to a hard-coded server, set up persistence and send host information over plain HTTP.
• Who is responsible: Not yet public. Anthropic has said a malicious actor used access to Cursor’s marketplace to publish it. How that access was obtained has not been disclosed.
• Fix: Cursor removed the build, rotated keys, rebuilt its marketplace and had the attacker server taken offline. Anthropic shipped a clean version 2.1.314. Uninstalling or updating does not remove what the malware may already have written to your system.

What is the Claude Code extension, in plain language?

Claude Code is Anthropic’s AI coding agent. It can read your project, run commands and edit files on your behalf. Besides the command-line tool, Anthropic offers an extension for editors built on VS Code, which includes Cursor. Like any VS Code extension, it is a bundle of JavaScript that runs inside the editor with the same permissions as you, the logged-in user.

That last point is the key to understanding this incident. An editor extension is not a website in a sandbox. When it loads, it can read files in your home folder, start processes and make network connections. Extension marketplaces exist so that we can trust where that code comes from. When a marketplace serves a modified build under a trusted publisher’s name, every safety assumption we make about “official” tools breaks at once. Security people call this a software supply chain attack: instead of attacking you directly, the attacker poisons something you already trust and install automatically.

Timeline of the incident

Times below are drawn from Cursor’s security notice and StepSecurity’s analysis, converted where needed.

Public reports credit the macOS security firm Phorion with first flagging the tampered extension.

How the backdoor worked, step by step

Researchers who compared the tampered package with the genuine one found that only the main extension.js file had changed. About 66 lines of loader code had been added at the very top. Because it sat at the top of the file, it ran the moment the editor loaded the extension, before any normal Claude Code logic. You did not need to type a prompt or open a chat. The real extension kept working normally, which is part of what made the attack hard to notice.

Based on the analyses by Microsoft Threat Intelligence, Cursor and StepSecurity, the loader did the following:

1. Reconnaissance. It gathered the hostname, username, operating system, CPU architecture, home and working directories, the global Git email address and the public IP address. It also scanned the names of environment variables for words like KEY, TOKEN, SECRET, PASS, AWS and GCP, keeping up to 40 matches. Analysts agree it collected the variable names, not their values. That still tells an attacker which machines are worth returning to.
2. Planting an SSH key. It appended an attacker-controlled Ed25519 public key, labelled svc-telemetry, to the user’s ~/.ssh/authorized_keys file. Anyone holding the matching private key can then log in as that user wherever SSH is reachable.
3. Turning on SSH. It tried to enable the local SSH server (Remote Login on macOS, the OpenSSH server capability on Windows).
4. Opening a reverse tunnel. Most laptops sit behind home routers or campus firewalls, so the attacker cannot connect in directly. The loader solved that by connecting out to the attacker’s server and asking it to forward connections back to the laptop’s SSH port (the classic ssh -N -R reverse port forward). Host-key checking was disabled, and the tunnel retried about every 60 seconds if it dropped.
5. Persistence. It made itself survive reboots with an OS-specific startup entry: a LaunchAgent disguised as com.apple.sysmond on macOS, a scheduled task named SysMon (with a Startup-folder fallback) on Windows, and an @reboot cron entry on Linux. The names were chosen to look like system monitoring tools.
6. Beaconing. After a short delay, it sent the collected host details as JSON over unencrypted HTTP to port 8099 on the attacker’s server.

Analysts did not find the loader downloading any extra executable. It used Node.js and built-in operating system tools only, which is a common way to avoid antivirus attention.

Did it actually work? The good news and the bad news

Cursor says the SSH step would generally fail without administrator rights, and that errors and permission requirements blocked SSH access on most macOS and Windows machines. Help Net Security’s report adds that on macOS a faulty check often stopped SSH from being enabled, though the backdoor could still work if Remote Login was already switched on.

The bad news is that the other steps did not need admin rights. The SSH key could still be added, persistence could still be installed, and host details could still be sent. Cursor’s notice says plainly: “Uninstalling the extension may not be sufficient.” Security researcher Kevin Beaumont also warned that the clean auto-updates do not remove backdoors that were already planted. In other words, if your machine received the bad build, assume cleanup is a manual job.

How to check your machine (official method)

If you use Cursor and had the Claude Code extension installed between 29 and 30 October, follow Cursor’s official security notice, which includes check commands and remediation scripts. The simplified checks Cursor gives look for the attacker’s key label:

# macOS or Linux: any output means the machine is affected
grep -s svc-telemetry ~/.ssh/authorized_keys

# Windows (PowerShell): any output means the machine is affected
Select-String svc-telemetry "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys"

On Linux, Microsoft’s guidance also says to look for an @reboot crontab entry that refers to .smt files in ~/.config (you can list your crontab with crontab -l).

If a check finds something, the official guidance from Cursor, Microsoft and StepSecurity broadly agrees:

• Isolate the machine from sensitive networks and preserve evidence before cleaning, especially on an office or lab machine.
• Remove only the attacker’s key and the persistence entries listed in the notice, then confirm they do not come back after a restart. Read any remediation script before running it.
• Update the extension to 2.1.314 or later.
• Rotate secrets that were reachable from that machine (cloud keys, GitHub tokens, API keys, SSH keys), using a different, trusted device.
• Consider a rebuild if the tunnel may have connected. StepSecurity recommends rebuilding rather than cleaning in that case.

Key indicators published by Cursor and Microsoft include the attacker IP 134.209.82.225 (SSH on port 22, HTTP beacon on port 8099) and the key comment svc-telemetry. Microsoft Defender detects related components under names such as Trojan:JS/CredTheft.MS!MTB.

Where the reports disagree

This story moved fast, and early reports do not fully line up. I think it is important to be honest about that rather than pick one version:

• Which versions: Cursor’s notice, updated on 30 October, and Microsoft both name 2.1.312 and 2.1.313 as affected in the Cursor marketplace. StepSecurity, writing earlier, called 2.1.312 clean and named only 2.1.313. Most news coverage also mentions only 2.1.313. The likely explanation is that the build StepSecurity checked differed from the tampered 2.1.312 later found in Cursor’s marketplace, but that has not been confirmed. Treat both versions as suspect.
• Which marketplace: Some early reports, including Help Net Security, said the build was published on Open VSX, the open extension registry run by the Eclipse Foundation that several VS Code-based editors use. OpenSourceMalware later updated its analysis to say the Cursor marketplace was the origin, not Open VSX, and Microsoft found no evidence of distribution via the Visual Studio Marketplace or npm.
• Which platforms: Cursor’s notice lists modified builds for Windows and macOS. The loader code also contained a Linux path, so Linux users should still run the check.
• How many users: The “at most 5,000 users” figure is attributed to Cursor by several outlets, but it does not appear on Cursor’s public notice page, and no independent count exists yet. It is an upper bound, not a confirmed number of infections.
• How the attacker got in: Unknown. Cursor says it audited access and rotated keys, but has not said whether a stolen publishing credential, an insider, or a pipeline weakness was involved.

Why this is an AI story, not just a security story

There is nothing “AI” about an SSH backdoor. So why does it matter that the bait was Claude Code?

First, AI coding tools are high-value targets. They are installed by exactly the people who hold production credentials, and they update often, so one bad update reaches many machines quickly. Second, AI agents already have broad permissions. We let them run shell commands and edit files, so suspicious activity from the editor process is easier to miss. Third, the AI tooling ecosystem is young and is being built on top of the same extension, plugin and package systems that have been abused for years.

This is part of a pattern. Last week I wrote about a fake copy of the viral REA repository that delivered a Windows trojan. The details differ, but the lesson is the same: popular AI tools attract impersonators and supply chain attacks, and “it came from the official store” is no longer a complete safety check.

My view as an educator: none of this means you should stop using AI coding assistants. It means you should treat them like any other powerful software with access to your machine, and learn the security fundamentals that let you notice when something is wrong.

Risks, privacy and the legal angle in India

This is general information, not legal advice. Check the current rules or consult a professional for any specific situation.

For individual students, the main risk is personal: your GitHub, cloud and college accounts. If you keep API keys in environment variables or .env files on the same laptop, rotate them if you were affected, and enable two-factor authentication everywhere.

For companies, colleges and startups in India, an incident like this can create formal obligations. CERT-In’s directions of April 2022 require covered organisations, including service providers, data centres, body corporates and government bodies, to report specified cyber incidents to CERT-In within six hours of noticing them; unauthorised access to systems is among the listed categories. Where personal data may have been exposed, the Digital Personal Data Protection Act, 2023 and its Rules set out breach-notification duties for data fiduciaries, with obligations phased in over time. Unauthorised access to computers is also an offence under the Information Technology Act, 2000 (for example, Sections 43 and 66). If you run IT for a lab or a small company and any machine was affected, involve whoever handles security and compliance early.

Why this matters for Indian students and educators

This incident is a near-perfect case study that ties together several subjects you already study:

• Computer Networks: SSH, TCP ports, NAT and firewalls, and why a reverse tunnel lets an attacker reach a laptop that cannot accept incoming connections. Also why sending data over plain HTTP is visible to anyone on the path.
• Operating Systems: processes, user versus administrator privileges, and how startup mechanisms like cron, launchd and Windows scheduled tasks give malware persistence.
• Cryptography and Network Security: public-key authentication, what authorized_keys actually trusts, key fingerprints, and code signing.
• Software Engineering: dependency management, release pipelines, and why supply chain security (signed builds, reproducible builds, publisher verification) is now a core topic.
• AI agents and tools: the permission model of AI coding assistants and MCP-style tool integrations, and why “least privilege” applies to them too.

For careers, roles in security operations (SOC analyst), incident response, threat intelligence and DevSecOps all involve exactly the work you saw here: reading indicators of compromise, writing detection rules and cleaning up persistence. A good exercise for a lab session or study group: set up a throwaway virtual machine, add a test SSH key and a harmless @reboot cron job yourself, then write a small script that detects both. You will learn more about persistence in an hour than from a chapter of theory.

For educators running shared lab machines or teaching with AI tools, it is worth adding a simple policy: install extensions only from verified publishers, avoid auto-updating extensions on machines that hold sensitive credentials, and use separate machines or virtual machines for experiments. Microsoft’s guidance also points to Cursor’s hardening options, such as restricting extensions to approved publishers and adding a delay before new extension versions are installed.

Frequently asked questions

Was Anthropic or Claude itself hacked?

Based on what has been reported so far, no. Anthropic has said it “was not involved with building, publishing or hosting” the tampered extension, and told Microsoft its systems were not compromised. The issue was in the Cursor extension marketplace.

I use VS Code, not Cursor. Am I affected?

Microsoft found no evidence that the malicious package was distributed through the Visual Studio Marketplace or the npm package, and Cursor says the official distribution was not affected. If you only installed from the official VS Code Marketplace, the reported evidence suggests you were not exposed. Running the simple svc-telemetry check costs nothing, though.

I updated to the latest version. Am I safe now?

Not necessarily. Version 2.1.314 removes the malicious code from the extension, but it does not undo changes already written outside the extension folder, such as the SSH key or startup entries. Run the official check.

Did the malware steal my passwords or API keys?

The published analyses say it collected the names of environment variables that looked like secrets, not their values. However, if the SSH tunnel connected, an attacker could have accessed anything your user account could. That is why rotating credentials is recommended for affected machines.

Does this mean AI coding tools are unsafe to use?

No more than any other software that runs on your machine. The lesson is to verify publishers, be cautious with automatic updates on sensitive machines, keep secrets out of plain environment files where possible, and watch for official security notices from the tools you use.

How can I protect myself from similar attacks in future?

Install extensions only from verified publishers, review what an extension needs before installing, keep separate machines or profiles for sensitive work, use two-factor authentication, prefer short-lived tokens, and periodically check files like authorized_keys and your startup items.

The bottom line

The Claude Code extension backdoor in Cursor was not a flaw in an AI model. It was a classic supply chain attack aimed at the people most likely to hold valuable access: developers using AI coding assistants. The response was fairly quick (about 11 hours of exposure, a clean release within hours and detailed public indicators), but the damage that matters most, leftover keys and persistence on individual machines, has to be cleaned up by each user. Several details, from the exact versions to how the attacker got in, are still unclear. For students, the takeaway is practical: learn how SSH, privileges and startup mechanisms really work, because the next attack on AI tooling will rely on the same fundamentals.

Sources and further reading

• Cursor: Security notice on the malicious Anthropic.claude-code versions
• Microsoft Security Blog: Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
• StepSecurity: Trojanized Claude Code extension delivered persistent SSH backdoor
• OpenSourceMalware: Trojanized Claude Code extension plants an SSH backdoor
• BankInfoSecurity: Cursor confirms Anthropic Claude Code extension compromised
• Help Net Security: Claude Code extension poisoned with persistent SSH backdoor
• The Decoder: Malicious Claude Code extension in Cursor’s marketplace
• Cyber Security News: Weaponized Claude Code extension

Written by Piyush Wairale (M.Tech, IIT Madras), founder of PiyushAI Edtech. This is a developing story; versions, user counts and other figures are as reported on or before 31 October 2026.