Executive Summary
On 29 October 2026, the official Anthropic Claude Code extension was compromised on the Cursor Marketplace and used to install a persistent SSH backdoor on infected hosts. The issue was traced to a compromise of the Cursor Marketplace, and Cursor briefly took down the service to remove the malware. Cursor says the incident affected at most 5,000 users, and the malicious version was not developed by Anthropic. Affected users installed the malicious version between about 2:27 a.m. and 1:35 p.m. PT on 29 October 2026. As of 30 October 2026, the malicious version has been removed, and Anthropic has published version 2.1.314 to both Open VSX and Microsoft VS Code Marketplace.
Key Technical Details
Package and loader
The package identifies itself as anthropic.claude-code version 2.1.313, but its main JavaScript bundle contains a malicious 66-line loader inserted before the legitimate extension code.
Anyone with Claude Code set to auto-update could have consumed the malware.
Behavior
The extension activates after VS Code startup and when its webview opens, then adds an attacker-controlled key to the user’s “~/.ssh/authorized_keys” file.
The key is labeled “svc-telemetry” to appear harmless.
It attempts to make the victim reachable through SSH across Windows, Linux, and macOS, establishes a reverse tunnel to the attacker’s server, and installs platform-specific persistence in the form of a scheduled task, crontab, and LaunchAgent.
It transmits host reconnaissance data to the attacker’s server on port 8099 over an unencrypted HTTP request.
Limitations on exploitation
Enabling the local SSH service requires admin rights, which the extension lacks on most macOS and Windows hosts, so the step fails and the attacker could not log in through the tunnel on those hosts.
The extension still adds the attacker’s SSH key, installs persistence, and sends host details to the attacker.
Data Collected
The collected data includes:
- Public IP address from api.ipify[.]org
- Hostname and local username
- Operating system and CPU architecture
- Home directory and current working directory
- Global Git email
- Names of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS, or GCP
Environment-variable values are not placed in the initial beacon, but their names can reveal which cloud providers, CI systems, and credential types are configured. No other follow-on payloads have been observed, but the reverse tunnel provides a pathway to the victim’s SSH service, allowing the operator to issue commands or transfer files.
Related Activity
The disclosure comes a little over a week after an attacker replaced release binaries of five versions of OVHcloud’s official CLI with secret-stealing malware, using a hijacked GitHub account of a legitimate OVH contributor as part of the GlassWorm operation.
Mitigations
- Isolate hosts that installed the compromised extension during the exposure window.
- Remove the unauthorized SSH key and persistence mechanisms.
- Rotate credentials and sessions.
- Update to Claude Code version 2.1.314.
- Follow remediation steps even on hosts where SSH enablement failed, since the key, persistence, and data exfiltration still occur.
- Cursor will contact impacted users directly.
Indicators of Compromise (IOCs)
IP addresses
- 134.209.82[.]225 (reverse tunnel destination)
URLs and network artifacts
- hxxp://134.209.82[.]225:8099/beacon (host reconnaissance beacon over unencrypted HTTP on port 8099)
- api.ipify[.]org (queried to obtain the victim’s public IP address)
File paths
- ~/.ssh/authorized_keys (modified to add the attacker’s key, labeled “svc-telemetry”)
