The cursor reveals an SSH backdoor attempt in the Claude code malicious extension – Unite.AI

Cursor on October 29, 2026 disclosed a security incident involving a maliciously modified version of the Anthropic.claude-code extension in its VS Code Extensions Marketplace. The company said that the package was not developed by Anthropic and that it ran code that attempted to install a persistent SSH backdoor. A maximum of 5,000 users were affected.

In a security advisory, the company said it will contact affected users directly. The malicious package, version 2.1.313 of Anthropic’s Claude Code extension, was available on the market between approximately 2:27 AM PT and 1:35 PM PT on October 29, 2026.

How the malicious version behaves

Cursor said the modified extension collects host and user information: hostname, username, operating system, architecture, home directory path, environment variable names, working directory, configured Git email address, and the machine’s public IP address.

The extension attempts to add an attacker-controlled SSH key to the user’s authorized_keys file, enable local SSH service, and open a reverse SSH tunnel. Cursor said that this step could fail outside of very unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code. The company added that enabling local SSH requires administrative rights that the extension does not have on most macOS and Windows hosts, so on those machines the attacker could not have accessed through the tunnel. Even so, the extension still adds the attacker’s SSH key, installs persistence, and sends host details to the attacker.

For persistence, Cursor said the payload installs a LaunchAgent on macOS or, on Windows, a scheduled task that tries to run as SYSTEM with a launch script fallback, while background scripts retry the tunnel roughly every 60 seconds. The extension reports host details and backdoor status via HTTP POST aa requests /beacon endpoint on port 8099.

Cursor response

Cursor said it removed the malicious version from the market immediately after detecting it and blocked further distribution, then shut down the entire market as a precaution. The company said it checked the access and confirmed that no other extensions had been tampered with, rotated the keys, rebuilt the market and brought it back online.

Cursor further said that it worked with the cloud provider hosting the attacker’s server to take it offline, and that the attacker’s server no longer works, leaving the reverse shell and POST of the host details broken. The company said that its findings pertain to the identified package and that it has no evidence that other versions of the extension, or the official distribution, are affected.

Repair phases and indicators

Cursor advised anyone who installed or updated Anthropic.claude-code 2.1.313 from its marketplace during the exposure window to run the impact check, search endpoint, network, and extension installation telemetry for published indicators, isolate hosts that show evidence of payload execution or backdoor installation, and remove rogue SSH key, persistence mechanisms, and tunnel process execution using its repair scripts by assessing whether the host needs to be rebuilt. Affected users must rotate credentials and sessions accessible from affected hosts, working from a trusted system.

The company warned that uninstalling the extension may not be sufficient because the payload eliminates standalone persistence scripts that continue to run, and said that the limited collection of environment variables does not rule out subsequent access to credentials via backdoor.

The impact check looks for the attacker’s public key, labeled svc-telemetryattached to the SSH authorized_keys files: a grep command on macOS and a PowerShell check on Windows that covers both user files authorized_keys files and the administrators_authorized_keys archive below C:\ProgramData\ssh. A machine is affected if the key is found, in which case Cursor directs users to the repair script for that platform.

The macOS script, remediate-macos.shmust be run as affected user instead of root and the Windows script, remediate-windows.ps1must be run from an open PowerShell session with administrator rights. Both remove the malicious extension, persistence mechanisms, running tunnel processes, and the attacker’s SSH key, and if anything remains, exit with a non-zero state.

Published indicators of compromise include SHA-256 hashes for modified darwin-arm64 and win32-x64 VSIX packages and a modified VSIX package extension.js file in the .macOS or Windows 2.1.313 folder containing the strings 134.209.82.225 and svc-telemetry. Network indicators include the attacker’s endpoint 134.209.82.225, a reverse SSH target of [email protected] on TCP port 22, an external beacon at the same address on port 8099, and a loopback beacon attempt on 127.0.0.1:8099. The cursor also listed the rogue ssh-ed25519 public key with the fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk, a reverse tunnel key fingerprint, persistence file paths for macOS and Windows, including a labeled LaunchAgent com.apple.sysmonda named scheduled task SysMonand a startup folder fallback script named sysmon.cmd – and command line indicators included ssh -N -R, autossh -M 0, schtasks /create /tn SysMon, systemsetup -setremotelogin onand a Add-WindowsCapability command that installs OpenSSH server functionality.

Cursor noted that the payload’s public IP lookups go to ifconfig.me and api.ipify.org, which are legitimate services, and that accessing them alone is not an indicator. The company directed questions to [email protected].