A tampered Claude Code extension on Cursor’s marketplace planted a persistent SSH backdoor
On October 29, 2026, Cursor’s extension marketplace served a falsified Anthropic.claude-code build (2.1.312 and 2.1.313) for about eleven hours, planting an SSH key and a persistent tunnel on developers’ machines. Up to 5,000 users are affected, and uninstalling the extension is not enough.
October 29, 2026. Cursor’s extension marketplace serves, for roughly eleven hours (from 2:27 a.m. to 1:35 p.m. Pacific), a falsified build of the Anthropic.claude-code extension — versions 2.1.312 and 2.1.313 — that Anthropic never built. October 30, 2026. macOS security firm Phorion publishes its analysis and reveals the package installed an SSH key and a persistent outbound tunnel. October 30, 2026, again. Cursor puts the exposure at “at most 5,000 users” and publishes cleanup commands. The headline: an SSH backdoor was pushed to developers through a channel they considered safe, and uninstalling the extension does not remove it.
For a platform lead who let teams install AI extensions from a third-party marketplace, this is not a supply-chain anecdote. It is proof that AI agents and automatic updates have moved the trust boundary while the controls stayed behind.
What the payload contained
Phorion’s analysis, led by CEO Calum Hall, showed that the compromised extension.js began with an IIFE (immediately invoked function expression) prepended to the minified bundle. The rest looked like the legitimate extension — Claude Code strings, normal activate and deactivate exports, UI code — which made the tampering hard to spot by eye.
The injected prefix loaded standard Node.js modules (child_process, fs, os, path, http, crypto) and ran as soon as Node loaded the file, before the extension’s normal activate callback even fired. The user did not need to interact with the extension for the payload to go off.
The infection sequence was automatic from there. The payload added the attacker’s SSH key to the user’s authorized_keys file under the label svc-telemetry, letting the operator log in as that user. It also opened an outbound SSH connection to the attacker’s server, creating a reverse tunnel, and retried roughly every 60 seconds. The tunnel kept running after the editor closed.
Persistence, platform by platform
The payload made sure it survived a reboot on every system. On macOS it installed a startup file with an Apple-style name; on Linux it added a cron entry that ran at boot; on Windows it tried to create a scheduled task called SysMon and fell back to the Startup folder if that failed.
Reconnaissance was just as automated. The extension reported the hostname, username, operating system, home directory, working directory, Git email address, and public IP address back to the attacker’s server. Above all, it sent the names of up to 40 environment variables that looked like keys, tokens, passwords, or AWS and GCP credentials. The values stayed local, but the list gave the operator an inventory of which hosts to hit first.
A quirk limited the damage on macOS. The planted key only worked if the machine’s SSH service was running, and the step meant to enable it often failed: the script asked the system about the state of Remote Login without administrator rights, got an error back, and skipped the enable step. Hall warns that the bug is no defense — on a Mac where Remote Login is already on, or turned on later, the backdoor is ready to use.
A supply chain that slips past normal controls
The incident reignited a deeper debate. Ax Sharma, head of research at Manifold Security, disputed the early reports that framed it as publisher impersonation: “there was no impersonation to spot,” he noted. “This was the official Claude Code extension in Cursor’s own marketplace, and one poisoned listing pushed an SSH backdoor to up to 5,000 users.” Checking the publisher name, he adds, does not help when the publisher is real; what helps is watching behavior.
The point cuts to the heart of the problem. AI editor extensions are installed and updated by agents and automated mechanisms, not by humans reading each listing. A coding extension planting an SSH key should be caught “in seconds,” Sharma argues — but no control was watching that behavior at install time.
Cursor responded by pulling the malicious version, taking its marketplace offline as a precaution, auditing access, finding no other tampered extensions, then rebuilding the marketplace after rotating keys. The company says the malicious version “was not developed by Anthropic” and that it will contact affected users directly.
What to do now
Uninstalling the extension is not enough: the payload drops standalone scripts that keep running. The guidance converges on a sequence of detection and remediation. To find the planted key, a single command does it:
grep -i svc-telemetry ~/.ssh/authorized_keys- Look for the svc-telemetry key. Inspect the authorized_keys file on every affected machine for an svc-telemetry entry.
- Check SSH logs. Look for logins from localhost using the svc-telemetry key to determine whether the operator connected.
- Isolate, rebuild, rotate. Cursor advises isolating affected machines, considering a rebuild, and rotating from a trusted system any credentials and sessions the machine could reach.
- Watch behavior. Add detection that alerts when a coding extension modifies authorized_keys or opens an outbound tunnel — that signal would have stopped this in seconds.
The limited data collection does not rule out later credential access through the tunnel. Cleanup must therefore be treated as an incident, not an uninstall.
Verdict
The incident does not discredit AI coding tools; it discredits the idea that a third-party marketplace can be consumed without observability. If your teams use AI extensions in Cursor or any editor backed by Open VSX, audit machines now, search for the svc-telemetry key, and treat any presence as a compromise to rebuild. If you run a fleet of coding agents, add a rule that watches authorized_keys changes and outbound tunnels — because the editor now installs faster than a human reads.