A malicious build of the Claude Code editor extension, version 2.1.313, was distributed to developers on October 29, 2026. It planted an attacker-controlled SSH key, opened a reverse SSH tunnel to a server at 134.209.82.225, and installed persistence that survives an uninstall or an update. Cursor confirmed the build was available in its extension marketplace from about 2:27am to 1:35pm Pacific time and says at most 5,000 users received it. Anyone running Claude Code inside Cursor during that window should treat the machine as compromised until proven otherwise.

Check your machine first

The fastest test on macOS or Linux is one line:

grep svc-telemetry ~/.ssh/authorized_keys

Any output means the backdoor ran. On Windows, open %USERPROFILE%\.ssh\authorized_keys and look for the same svc-telemetry comment. The public key fingerprint is SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk.

Then look for the persistence it leaves behind:

  • macOS: ~/Library/LaunchAgents/com.apple.sysmond.plist, plus ~/.config/.smt and ~/.config/.smtk. The name imitates an Apple component. It is not one.
  • Linux: the same two files under ~/.config and an @reboot entry in the user's crontab.
  • Windows: a scheduled task named SysMon, or a sysmon.cmd file in the Startup folder if the task could not be created.
  • Any platform: a file named .stk_ followed by an identifier in the temp directory, and an ssh or autossh process with a reverse forward (-R) to 134.209.82.225.

Updating the extension does not fix any of this. Kevin Beaumont confirmed that the replacement versions published overnight leave the key, the tunnel and the persistence in place. Cursor says the same: uninstalling alone may not be enough and the host may need a rebuild.

What the backdoor does

Researchers at OpenSourceMalware published the analysis. The attacker prepended a 66-line loader to extension.js, wrapped so it runs the moment the editor activates the extension. Nobody has to open a Claude session. The legitimate extension code runs afterwards, and almost every operation in the loader sits inside a silent exception handler, so a failure never shows an error.

In order, the loader:

  1. Collects the hostname, username, operating system, architecture, home directory, working directories, the global Git email, and the names of up to 40 environment variables that match words like KEY, TOKEN or SECRET. Names only, not values.
  2. Creates ~/.ssh if needed and appends an Ed25519 public key labelled svc-telemetry to authorized_keys, with the normal 0700 and 0600 permissions so nothing looks out of place.
  3. Tries to turn on the local SSH service: Remote Login on macOS, an SSH service on Linux, OpenSSH Server through PowerShell on Windows.
  4. Writes an embedded private key to a temp file and runs ssh -N -R '*:0:localhost:22' to the attacker's server, with host key checking disabled. That gives the attacker a path back into the victim's port 22. It reconnects every 60 seconds and prefers autossh when installed.
  5. After a 1.5 second delay, looks up the public IP through ifconfig.me or api.ipify.org and sends the collected profile as plain HTTP JSON to port 8099 on the attacker's server.

There is no second-stage download. The tunnel is the payload. With a profile of every victim in hand, the attacker could pick which machines deserved hands-on-keyboard time. Cursor notes that because of mistakes in the malicious code, the step that enables SSH usually fails without administrator rights, which would leave the tunnel unable to reach a working SSH daemon. The key and the persistence were still installed on most hosts, so a later fix to the code, or an admin account, would have completed the job.

Which channel was hit

This was reported first as an Open VSX compromise, and that version of the story is still circulating. It appears to be wrong. Cursor's notice names its own marketplace as the source. Rescana checked the registries on the morning of October 30 and found that Open VSX has no record of a 2.1.313 at all, and the Microsoft Marketplace version list jumps from 2.1.312 to 2.1.314. OpenSourceMalware updated its post to say the npm package, the Open VSX extension and the Microsoft VS Code extension are not malicious. Cursor says it has no evidence that other versions or the official distribution are affected.

The extension is published under the anthropic.claude-code namespace. How the attacker obtained publishing rights to push into Cursor's marketplace has not been explained. Cursor's response was to remove the version, shut the marketplace down, audit access, rotate its keys, rebuild the service, and work with the hosting provider to take the attacker's server offline. The command server was confirmed offline by mid-morning UTC on October 30.

Anthropic has said nothing so far

As of publication, no statement from Anthropic appears on its newsroom, its status page, or the Claude Code GitHub security advisories. The changelog goes from 2.1.312 to 2.1.314 with no entry for the version in between. Beaumont's DoublePulsar write-up goes further than Cursor does. He describes this as Anthropic itself being compromised, says the extension's auto-update means every organisation using it on VS Code or Cursor was affected, and says the plugin has millions of installs. The registry evidence published later in the day supports a narrower reading: one bad version, one marketplace, a window of about eleven hours. The part of his account that is not in dispute, and matters most, is that the fix does not clean an infected machine and that the vendor whose name is on the extension has not told customers.

Those two things together are why this is an alert rather than a news item. If a developer's laptop in your organisation ran Cursor with Claude Code on October 29, the SSH key that machine trusts is not one you issued.

Remediation

  • Isolate any host where the key or persistence is present. Pull it off the network before anything else, which also kills the tunnel.
  • Preserve evidence first: SSH daemon logs, shell history, process listings, network flows.
  • Block 134.209.82.225 on ports 22 and 8099 at the edge and alert on any past connection to it.
  • Remove the svc-telemetry line from authorized_keys, delete the LaunchAgent, cron entry or scheduled task, and the files under ~/.config and the temp directory. Cursor publishes remediate-macos.sh and remediate-windows.ps1 scripts with its notice.
  • Remove extension version 2.1.313 and reinstall 2.1.314 or later only after the persistence is gone.
  • Rotate every credential, token and session reachable from that user account, from a clean machine. The loader catalogued which environment variables held secrets, so assume the attacker knew where to look.
  • Reimage if you cannot account for the full window the tunnel was up.

For everyone else, the lesson is the one that keeps repeating with Nx Console in May and the Open VSX attacks before that: an editor extension runs with the full rights of the developer and auto-updates without asking. Pinning extension versions, restricting outbound SSH from workstations, and alerting on changes to authorized_keys would have caught this one in minutes. File hashes for the malicious extension.js (ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15) and the embedded tunnel key (7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278) are in the OpenSourceMalware listing for fleet-wide scanning. This story is less than a day old and some details, including the entry point, will change. The indicators above are the parts that are confirmed.