Claude Code extension breach adds SSH backdoor via Cursor marketplace
A malicious build of Anthropic’s Claude Code extension for VS Code was distributed through Cursor’s IDE extension marketplace and may have affected up to 5,000 users. The package identified itself as anthropic.claude-code version 2.1.313, but contained code designed to establish persistent SSH access and collect host information.
Cursor said the affected build was available between about 2:27 a.m. and 1:35 p.m. PT on October 29, 2026. The company temporarily took down the marketplace to remove the malware and said it would contact affected users directly. Anthropic subsequently published version 2.1.314 to Open VSX and the Microsoft VS Code Marketplace.
A loader inserted ahead of legitimate extension code
Jenn Gile, co-founder of OpenSourceMalware, said the extension’s main JavaScript bundle had a malicious 66-line loader placed before the legitimate code. The extension could activate after VS Code started and when its webview opened.
Its first objective was to add an attacker-controlled public key to ~/.ssh/authorized_keys. The key was labelled svc-telemetry, a name intended to look routine. The malware then attempted to make a system reachable through SSH on Windows, Linux and macOS, create a reverse tunnel to 134.209.82[.]225, and install platform-specific persistence.
Persistence and reconnaissance remain material risks
The persistence mechanisms differed by operating system: a scheduled task on Windows, a crontab entry on Linux, and a LaunchAgent on macOS. It also sent reconnaissance to 134.209.82[.]225:8099/beacon over an unencrypted HTTP request on port 8099.
Collected details included the public IP address obtained from api.ipify[.]org, hostname, local username, operating system, CPU architecture, home and working directories, and the global Git email setting. The code also gathered the names of up to 40 environment variables containing terms such as KEY, TOKEN, SECRET, PASS, AWS or GCP. Values were not included in the initial beacon, but the names can reveal cloud, CI and credential configurations.
Cursor noted that enabling the local SSH service ordinarily needs administrator rights on most macOS and Windows systems, so that step would fail on many hosts. Even in that case, the unauthorized SSH key, persistence configuration and host-data transmission could still occur. A reverse tunnel, if successfully established, could give an operator a route to issue commands or transfer files through the victim’s SSH service.
Actions for development and security teams
The incident is another supply-chain exposure involving developer tooling, alongside the AI security concerns illustrated by Claude used in an OpenAI breach scenario where Claude was used in an OpenAI breach scenario. It also shows why extension provenance, version review and update controls deserve the same scrutiny as application dependencies.
Organizations that installed the affected extension during the stated window should isolate those hosts, remove the unauthorized SSH key and all persistence mechanisms, then rotate credentials and active sessions. Security teams should also review affected endpoints for the listed network indicators and validate that Claude Code has been updated to version 2.1.314 or a later trusted release.