Hey there!

If you use Cursor and had the Claude Code extension on 29 October, it's worth checking your machine. For about 11 hours that day, the Cursor Marketplace served tampered versions of the extension that tried to install an SSH backdoor. Cursor says at most 5,000 users were affected, and uninstalling the extension may not clean things up.

In this post I'll go through who is affected, what the malicious code tried to do, how to check your computer and what's still unknown.

Who is affected by the Claude Code backdoor

According to Cursor's security notice, you're in scope if all of these apply:

• You got the extension from the Cursor Marketplace.
• You installed or updated to version 2.1.312 or 2.1.313 of anthropic.claude-code.
• It happened between about 2:27am and 1:35pm Pacific time on 29 October (09:27 to 20:35 UTC).

Cursor lists Windows and macOS as the affected platforms. Its list of warning signs also includes a Linux cron entry, and Phorion, the security firm that reported the backdoor, says the code covers Linux too, so I wouldn't assume a Linux machine is safe without checking.

Some early reports named the Open VSX registry, but the incident was later traced to Cursor's own marketplace. Microsoft's Visual Studio Marketplace and Open VSX aren't affected, according to reporting by The Hacker News, and Anthropic says its official channels weren't either. Cursor found no other extensions in its marketplace tampered with. The latest clean version is 2.1.314.

What the malicious extension tried to do

SSH is the standard way to log in to a computer remotely, and an SSH key is what lets you in without a password. The tampered extension tried to give the attacker that kind of access. Phorion says the code ran as soon as the extension loaded, so you didn't have to click anything. It tried to:

• Add the attacker's SSH key to ~/.ssh/authorized_keys.
• Open a reverse SSH tunnel, a connection from your machine out to the attacker's server that they can use to get back in.
• Set itself up to survive restarts, retrying the tunnel about every 60 seconds.
• Send the attacker details such as your hostname, username, Git email, public IP and the names of your environment variables.

That last item covers variable names, not their values. It would still show an attacker what to look for, such as a variable with TOKEN in its name, if they got in later.

Did the backdoor actually work?

In many cases, only partly. Cursor says errors in the code mean the step that enables SSH and opens the tunnel would fail unless Cursor was running with administrator rights, which is unusual. It also worked with the hosting provider to take the attacker's server offline, so the tunnel and the data reporting have stopped working.

That's no reason to skip the cleanup. Phorion points out that the macOS bug only helps if Remote Login is off, and the backdoor works if it's already on. The key and the startup files may also be sitting on your machine even where the tunnel failed. Cursor's advice is to follow its remediation steps regardless.

How to check your machine

These are the main signs from Phorion's analysis, which also has the full list and key fingerprints:

• Extension folder: a folder for version 2.1.312 or 2.1.313, such as anthropic.claude-code-2.1.313-darwin-arm64 on an Apple Silicon Mac.
• SSH key: an entry with the comment svc-telemetry in ~/.ssh/authorized_keys. A comment can be changed, so check the fingerprint too.
• macOS: ~/Library/LaunchAgents/com.apple.sysmond.plist, which borrows an Apple-style name to look legitimate.
• Windows: a scheduled task named SysMon or a sysmon.cmd script in the Startup folder.
• Linux: an @reboot cron entry.
• Network: outbound connections to 134.209.82.225 on port 22 or 8099.

Also check your SSH logs for svc-telemetry logins coming from 127.0.0.1 or ::1. Phorion says those would point to the attacker actually using the access.

What to do if you were affected

Cursor has published removal scripts in its notice. Going by Cursor and Phorion, the steps are:

• Isolate the machine and stop any running tunnel processes.
• Remove the SSH key, the startup files and the temporary key files, and consider rebuilding the machine entirely.
• Uninstall the bad version and move to a clean one.
• Change any passwords, API keys and sessions that machine could reach, doing it from a different, trusted computer.

If this is a work laptop, tell your security team first. Phorion advises organisations that find these versions to bring in incident response, and they may want to look at the machine before you change anything.

What's still unknown

The biggest gap is how the tampered package got into the marketplace. Cursor says the malicious versions weren't developed by Anthropic. Anthropic staff have said its systems and employee laptops weren't compromised, and that someone used access to Cursor's marketplace to publish the tampered copy. Cursor has since audited access, rotated its keys and rebuilt the marketplace, but as of The Register's report neither company had explained how the attacker got in.

Who was behind it hasn't been made public either. Phorion's report doesn't name anyone, and the 5,000 figure is Cursor's upper limit rather than a count of machines where the backdoor succeeded.

The takeaway

The package carried the legitimate extension ID, so checking the name and publisher wouldn't have caught this. Editor extensions generally run with the same permissions you have, so one bad update can reach your SSH folder without any prompt. An extension can also reach you through more than one marketplace, and each marketplace is its own point of failure, which is how the same extension could be poisoned in Cursor and clean in VS Code.

If you're in the affected window, run the checks above and rotate your credentials even if the tunnel appears to have failed. If you aren't, it's a good moment to look at which extensions you have installed and which ones update automatically.