Fake Claude Code extension in Cursor tried to plant SSH backdoor

Developers who use the AI code editor Cursor should check one extension. Cursor says a maliciously modified copy of Anthropic's Claude Code extension was available in its VS Code extension marketplace on 29 October, between about 2:27 am and 1:35 pm Pacific time. The affected versions are 2.1.312 and 2.1.313 for macOS and Windows. Cursor stresses that these versions were not made by Anthropic.

What the fake extension did

According to Cursor's security notice, the tampered code:

• collected the hostname, user name, operating system, home folder, environment variable names, Git email and public IP address and sent them to the attacker;
• tried to add an attacker-controlled SSH key to the user's authorized keys, switch on the local SSH service and open a reverse SSH tunnel;
• tried to make that tunnel survive reboots through a LaunchAgent on macOS or a scheduled task on Windows, retrying about every 60 seconds.

Cursor says that switching on the SSH service needs administrator rights, which the extension did not have on most Macs and Windows PCs, so on those machines the attacker could not log in through the tunnel. The attacker's server has since been taken offline with the help of its hosting provider. WIRED reported that at most about 5,000 users downloaded the rogue package. Microsoft's security team has also published a technical analysis of the backdoor.

What Cursor did

Cursor removed the malicious versions, shut the whole marketplace down as a precaution, audited access, rotated its keys and rebuilt the marketplace before bringing it back online. It says no other extensions were tampered with and it has no evidence that other versions or Anthropic's official distribution were affected.

How to check your machine

If you installed or updated Claude Code in Cursor on macOS or Windows during that window:

1. Look for an SSH public key labelled svc-telemetry in your authorized_keys file. Cursor's notice gives a one-line check for macOS and PowerShell.
2. If it is there, the machine is affected. Uninstalling the extension may not be enough, because the payload drops separate persistence scripts. Run Cursor's remediation script for your platform and consider rebuilding the machine.
3. From a clean device, rotate passwords, API keys and sessions that the affected computer could reach.

This is the developer version of a familiar problem: a convincing copy of a trusted name sitting in an official store. The same habits that help on phones, such as checking the publisher and recent version history, apply here too; see our guide on how to spot fake apps on Google Play. For another recent security story involving Anthropic's model, read our report on the Linux TCP bug found with Claude, and if you use AI assistants daily, our ChatGPT privacy settings guide shows what to lock down.