Trojanized Claude Code Extension Opened an SSH Backdoor on Cursor Users’ Machines

A security incident involving Cursor and Claude Code has exposed 5,000 users. The cause? A trojanized version of the Claude Code extension that allowed an attacker’s SSH key to be pushed to infected machines. Here’s what we know.

On October 29, 2026, Cursor published a security advisory about a modified version of Anthropic’s Claude Code extension, made available in its code editor’s extension marketplace. Version 2.1.313 was distributed on October 29, roughly between 10:27 a.m. and 9:35 p.m. Paris time. Based on the investigation results, up to 5,000 users may be affected.

Cursor removed the version and temporarily shut down access to its marketplace while rotating some keys. What did this malicious version of the Claude Code extension contain? Let’s take a closer look. First, the malicious code is limited to 66 lines placed at the top of the extension.js file, executed as soon as the editor loads the extension. So there is no need to start a conversation with Claude.

An SSH key, a reverse tunnel, and persistence

According to analyses carried out by several researchers, including OpenSourceMalware, the malicious code chains together several steps:

• Reconnaissance: host name, user, system, Git email, and the names (not the values) of environment variables containing KEY, TOKEN, SECRET, PASS, AWS, or GCP.
• Attacker key: a commented Ed25519 key named svc-telemetry is added to the ~/.ssh/authorized_keys file.
• Reverse SSH tunnel: a looped connection to 134.209.82.225, with a port forwarded to the victim’s port 22.
• Persistence: a LaunchAgent named com.apple.sysmond on macOS, an @reboot entry in crontab on Linux, and a SysMon scheduled task on Windows.
• Beacon: collected data is sent over unencrypted HTTP to port 8099 on the same server.

This tunnel terminates on the machine’s port 22: without an SSH server listening, it goes nowhere. However, enabling the service requires administrator privileges that the extension usually does not have, Cursor notes, and Phorion spotted a bug that causes this step to fail on macOS. The real danger is on a machine where SSH is already running (a Linux box, or a Mac with Remote Login enabled), because the added key is enough to open the door.

Was Anthropic hacked? The accounts differ

"This malicious version of the extension was not developed by Anthropic.", Cursor says. That wording is disputed by researcher Kevin Beaumont on his DoublePulsar blog: according to him, the version was published using Anthropic’s verified account, which would indeed make this an Anthropic-side security incident. He also criticizes Anthropic for releasing 2.1.314 without notifying customers.

The path taken remains unclear. Version 2.1.313 has disappeared from Open VSX, the Microsoft Marketplace, and Cursor. On Open VSX, the history jumps from 2.1.312 to 2.1.314, published on October 30 at 2:07 a.m. OpenSourceMalware says it recovered the sample from Open VSX, while Cursor only mentions its own marketplace. As I write this, Anthropic has not commented on the incident, but there is still some uncertainty.

In any case, the exposure window lasted about 11 hours... which is far from negligible. Anyone who downloaded the trojanized version during that period may be impacted.

How can you check your machine?

If you use Claude Code in Cursor, be aware that uninstalling or updating the extension is not enough: the persistence scripts run independently. Once the damage is done, there are other things to check:

• Attacker SSH key: the svc-telemetry comment in ~/.ssh/authorized_keys, and on Windows in C:\ProgramData\ssh\administrators_authorized_keys, is a telltale sign.
• Files used to run the SSH tunnel: ~/.config/.smt and ~/.config/.smtk (macOS, Linux), smt.cmd and smtk in the profile’s .config folder (Windows).
• Attacker persistence on your machine: ~/Library/LaunchAgents/com.apple.sysmond.plist, an @reboot entry in crontab, the SysMon scheduled task, or a sysmon.cmd file in the Startup folder.
• Network connection tied to the SSH tunnel: ssh or autossh processes containing -R *:0:localhost:22, and any connection to 134.209.82.225 on ports 22 and 8099 (to block).

To help you, Cursor provides cleanup scripts for macOS and Windows, and Kevin Beaumont has published KQL queries for Microsoft Defender for Endpoint.

One question remains: how was this version able to be published under the identity of the official extension?

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio