Tampered Claude Code extension planted backdoor on up to 5,000 developer machines
A fake version of the Claude Code extension was distributed through the marketplace of AI code editor Cursor. It tried to give attackers lasting remote access through an SSH key.
Symbolic image · Photo: Markus Spiske markusspiske / Wikimedia Commons, CC0 (cropped and resized)
A tampered version of the Claude Code extension for VS Code was distributed through the extension marketplace of AI code editor Cursor. Cursor said version 2.1.313 was available for about 11 hours on Oct. 29 and that at most 5,000 users were affected. The malicious version "was not developed by Anthropic," the company said. How the altered file reached the marketplace, and who was behind it, remains unclear.
According to Cursor and security firm Phorion, the code collected details such as host name, user name, operating system and public IP address. It also tried to add an attacker-controlled SSH key labeled "svc-telemetry" and to open a tunnel to the attackers' server. The payload ran as soon as the extension loaded, with no user action required. Cursor said turning on the SSH service usually failed because the extension lacked administrator rights.
Cursor said it pulled the version, temporarily shut its marketplace, rotated keys and had the attackers' server taken offline by the hosting provider. Users are urged to move to version 2.1.314. Uninstalling the extension may not be enough, Cursor warned, advising that affected machines be checked and isolated and that credentials be rotated.