# Cursor removes malicious Claude Code extension after SSH backdoor attempt > Source: > Published: 2026-11-02 11:42:28+00:00 A malicious version of Anthropic’s Claude Code extension distributed through the Cursor marketplace attempted to install a persistent Secure Shell (SSH) backdoor on developers’ machines, potentially giving attackers remote access to systems holding source code, credentials and other sensitive information. “Between about 2:27am PT and 1:35pm PT today, a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code Extension Marketplace,” Cursor said in a [security notice](https://cursor.com/blog/claude-code-extension-security-notice). Cursor removed the compromised versions, 2.1.312 and 2.1.313, after discovering they had been available in its VS Code extension marketplace for approximately 11 hours on October 29. The company said the malicious code attempted to add an attacker-controlled SSH key, enable local SSH access, and establish a reverse tunnel to an attacker-controlled server. “These malicious versions of the extension were not developed by Anthropic,” Cursor added in the notice. The affected versions were available for Windows and macOS. Anthropic subsequently clarified how the tampered extension had been distributed. In a post on X, Felix Rieseberg, a member of Anthropic’s technical staff, [said](https://x.com/felixrieseberg/status/2116170451466543578) the incident did not involve a compromise of Anthropic’s systems or employee laptops. A malicious actor had used access to Cursor’s marketplace to publish the modified extension, he said. “The versions on our official channels are not affected, and this only impacts Cursor users,” Rieseberg wrote. Anthropic said it was working with Cursor on the incident. Cursor and Anthropic had not responded to requests for comment by publication time. Security company Phorion, which analysed the compromised extension, found that malicious code had been inserted at the beginning of its JavaScript file. It ran as soon as the extension loaded, before its normal activation code. “The user doesn’t need to interact with the extension for the payload to fire,” Phorion [said](https://phorion.io/blog/offical-claude-code-vsx-compromise/?source=post_page-----1148a92baae2-----------------------------------------). The malware attempted to add an attacker-controlled SSH key to the user’s authorized_keys file and establish a connection to a remote server. It also created scripts and startup entries intended to keep the connection available after a system restart, the company added. Phorion identified a flaw in the macOS code. The malware tried to check whether Remote Login was disabled using a system command that required administrator privileges. When run without those privileges, the command returned an access error rather than the expected status. The malware consequently skipped the attempt to enable SSH. Phorion also found an error in the Windows code that could prevent its SSH service setup command from running correctly. Microsoft Threat Intelligence, in a separate analysis, detailed the information the malware collected, including machine names, usernames, operating systems, working directories, and Git email addresses. “It also looks for environment-variable names containing terms such as KEY, TOKEN, SECRET, PASS, AWS, or GCP*,* keeping up to forty matches,” Microsoft [wrote](https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/) in the analysis. It said the code collected matching variable names, not their values. Cursor said enabling the local SSH service would generally fail without administrator privileges on affected Windows and macOS machines. However, the extension could still add the attacker’s SSH key, install persistence mechanisms, and send host information to the attacker. The company warned that uninstalling the extension alone might not remove these components because the malware placed scripts outside the extension’s installation directory. Steve Povolny, vice president of AI strategy and security research at Exabeam, said the planted SSH key made cleanup particularly important. “Removing the extension only sends the visitor away while the spare key stays on the hook,” he said. Povolny recommended checking authorised SSH keys on machines accessible to affected developers, rotating potentially exposed credentials, and reviewing logs for logins using unfamiliar keys. Developers often have access to source code, cloud accounts, and production systems, he said, making a compromised workstation a potential route to other enterprise resources. Phorion also advised checking the SSH key’s fingerprint rather than relying only on the comment svc-telemetry attached to it. Yash Kadakia, founder and CTO of Security Brigade, said enterprises should treat extension marketplaces as part of the software supply chain. “An extension marketplace is effectively another software supply chain,” Kadakia said. “When malicious code can reach developers through what appears to be a legitimate, routine update, the traditional assumption that software from a trusted marketplace is safe starts to break down.” He recommended stronger publisher verification, checks on package integrity, and controls over which extensions and versions developers can install. Kadakia also called for extension allowlisting, controlled updates, endpoint monitoring, and restrictions on outbound connections. He said short-lived credentials, segregated development environments, and limited access to sensitive infrastructure could reduce the impact of a compromised developer machine. Cursor said it removed the malicious versions, temporarily shut down its marketplace, audited access, rotated keys, and rebuilt the marketplace before restoring the service. *The article originally appeared on [CSO](https://www.csoonline.com/article/4243210/cursor-removes-malicious-claude-code-extension-after-ssh-backdoor-attempt.html).*