Cybersecurity experts have revealed a significant breach involving the Anthropic Claude Code extension, which was manipulated to install a persistent SSH backdoor on vulnerable systems. This incident was linked to a compromise within the Cursor Marketplace, leading to the temporary suspension of the service by the AI coding platform Cursor to excise the malicious software.
Details of the Compromise
Cursor has identified a security breach regarding a tampered Claude Code VS Code extension accessible through their marketplace. The breach affected up to 5,000 users. The malicious variant, not created by Anthropic, was isolated to this particular extension, leaving other products like Grok Bot unaffected. The compromised package masqueraded as version 2.1.313 and included a 66-line malicious loader.
On October 30, 2026, the rogue version was removed, and Anthropic issued an updated version, 2.1.314, on both Open VSX and Microsoft VS Code Marketplace. The extension triggers upon VS Code startup, adding a deceptive SSH key labeled “svc-telemetry” to the user’s authorized keys, aiming to maintain a low profile.
Implications of the Security Breach
This extension attempts to enable SSH access across various operating systems, such as Windows, Linux, and macOS. It also establishes a reverse tunnel to a specified IP, sets up platform-specific persistence, and sends reconnaissance data to another IP via an unencrypted HTTP request. Such actions could allow unauthorized access and control over infected hosts.
However, the malicious extension often lacks the necessary admin privileges on most Windows and macOS systems to activate the local SSH service, limiting its effectiveness. Despite this, it still manages to embed the attacker’s SSH key, establish persistence, and transmit host information to the attacker.
Data and Response
The information gathered includes the system’s public IP, hostname, local username, operating system details, and environment variables, among others. Although direct access to sensitive environment variable values is not possible, their presence can suggest potential vulnerabilities and cloud service configurations.
In response, Cursor has advised affected users to isolate their systems, remove unauthorized keys, and update credentials. This incident follows a similar breach involving OVHcloud’s CLI binaries, underscoring the ongoing risks in software security.
While the malicious extension was quickly removed, users with auto-update settings may have inadvertently installed the malware. Cursor plans to contact affected users to ensure they take necessary protective measures.
This breach highlights the critical importance of maintaining vigilant cybersecurity practices, particularly in environments relying on extensions and third-party software.
