Rogue Claude Code Extension Plants SSH Backdoor in Cursor

On 29 October 2026, a tampered Claude Code extension was found in the Cursor VS Code extension Marketplace, affecting up to 5,000 developers before maintainers removed it. The rogue build modified Anthropic’s Claude Code extension package, version 2.1.313, with a backdoor that attempted to establish a persistent reverse SSH tunnel on macOS and Windows workstations. Cursor later rotated internal keys and deployed a clean version, 2.1.314, after pulling the compromised extension from the marketplace.

The rogue package also appeared in the Open VSX registry, and Cursor’s security notice attributes the incident to an independent cybercriminal rather than a confirmed threat group; Anthropic did not author the modified release.

Independent analysis by CellCog and security researcher Paul McCarty traced 66 lines of malicious JavaScript injected into extension.js. The backdoor executed prior to the extension’s normal initialisation, gathering system information (hostnames, usernames, environment variable names, Git email addresses, and public IPs) and appending an unauthorized public key labeled svc-telemetry to the user’s SSH authorised_keys file. It then attempted to enable the local SSH daemon and launch a reverse tunnel.

The payload created persistence: on macOS via a LaunchAgent plist, and on Windows via a SYSTEM-level scheduled task and a Startup-folder script, with retries every 60 seconds. Collected host data was exfiltrated via an HTTP POST to a remote server on port 8099. Cursor coordinated with their cloud hosting provider to dismantle the command server promptly, neutralising the active endpoint.