{"slug": "cursors-claude-code-backdoor-what-users-must-do", "title": "Cursor’s Claude Code Backdoor: What Users Must Do", "summary": "A poisoned extension branded as Anthropic's Claude Code and distributed through Cursor's marketplace exposed up to 5,000 developers to a persistent SSH backdoor during an approximately 11-hour window on October 29, 2026, from 2:27 AM to 1:35 PM PDT, according to Cursor's incident estimate. The tampered builds v2.1.312 and v2.1.313 injected an immediately invoked function expression into extension.js that exfiltrated public IP addresses, usernames and Git config emails, appended an attacker-controlled SSH public key to authorized_keys, and scheduled a reverse SSH tunnel to 134.209.82[.]225 every 60 seconds; Microsoft Threat Intelligence and Sophos reported the tunnel often failed unless Cursor ran with administrative privileges, and the command-and-control server was neutralized. Cursor advises affected users that uninstalling the extension does not remove the planted keys or scheduled tasks and directs them to its official incident write-up and detection script.", "body_md": "## A trusted name hid a poisoned download\n\nA poisoned [Claude Code](https://www.stork.ai/en/claude-code) extension, distributed through [Cursor](https://www.stork.ai/en/cursor-ai)’s marketplace, not Anthropic’s official channels, put up to 5,000 users at risk. This was not an Anthropic compromise; rather, an attacker exploited Cursor’s store to push tampered builds.\n\nThe malicious listing appeared under Anthropic’s name, targeting Mac and Windows users. This deceptive branding created a false sense of legitimacy, convincing users they were downloading an official release.\n\nThe tampered extension was live for approximately 11 hours on October 29, 2026, from 2:27 AM to 1:35 PM PDT. During this window, Cursor estimates that up to **5,000 developers** may have been exposed to the backdoor.\n\nThe attacker injected an immediately invoked function expression (IIFE) in `extension.js`, meaning the payload triggered on load—no interactive command was needed. It exfiltrated basic host telemetry: public IP addresses, usernames, and Git config emails.\n\nCrucially, the backdoor planted an attacker-controlled SSH public key into `authorized_keys`. It also scheduled recurring tasks to open an outbound SSH reverse tunnel to the attacker's server every minute, even if Cursor was restarted. While implementation flaws in the payload minimized the execution rate on unprivileged machines, the threat was real and persistent.\n\n## The extension opened a door beyond the editor\n\nThe tampered extension wasn’t idle, activating immediately upon loading. It executed Node.js system calls, meaning users didn’t even need to invoke a Claude Code command for the payload to trigger. This backdoor swiftly collected sensitive information: users' public IP addresses, usernames, and Git email addresses.\n\nBeyond data exfiltration, the payload appended an attacker-controlled **SSH public key** to `authorized_keys`. It then relentlessly attempted to establish an outbound SSH reverse tunnel to the attacker's server (`134.209.82[.]225`), retrying every 60 seconds. This persistence was built to survive system restarts, a clear sign of a sophisticated attack.\n\nLuckily, implementation flaws often crippled the most dangerous aspect of the attack: the reverse tunnel. Microsoft Threat Intelligence and Sophos reported that the SSH service enablement frequently failed unless Cursor ran with **administrative privileges**. The attacker’s command-and-control (C2) server was also swiftly neutralized, limiting further damage.\n\nDespite these failures, the risk wasn't entirely mitigated. The injected SSH keys and scheduled persistence scripts could still leave local artifacts on affected machines. Users who downloaded trojanized builds `v2.1.312` or `v2.1.313` between October 29, 2026, and the extension's removal faced potential compromise, even if the tunnel never fully connected.\n\n## Why uninstalling may leave the danger behind\n\nUninstalling the compromised Claude Code extension from Cursor offers a false sense of security. The backdoor was engineered for **persistence**, meaning merely removing the visible extension does not clean the machine. Malicious artifacts, including scheduled tasks (cron jobs, plist files, or Windows scheduled tasks) and unauthorized entries in the `authorized_keys` file, remain embedded.\n\nAttackers appended their SSH public key to users' `authorized_keys`, establishing a persistent foothold. The payload also scheduled recurring attempts to open an outbound SSH reverse tunnel every 60 seconds. This ensures continued access even after an uninstallation, leaving a silent, open door.\n\nTo truly mitigate the risk, affected users must consult Cursor’s official incident write-up and utilize their provided **detection script**. This script helps identify and remove the planted SSH keys and persistence mechanisms. For a deeper technical dive into the attack's mechanics, see Microsoft's analysis: [Inside a malicious Claude Code-branded extension and its persistent SSH backdoor | Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2026/10/31/inside-a-malicious-claude-code-branded-extension-and-its-persistent-ssh-backdoor/).\n\nCritical next steps involve proactive security measures. Change all passwords, SSH keys, and other potentially exposed secrets. Perform these changes from a **separate, trusted device** to prevent further compromise. While the attacker’s C2 server was neutralized, and implementation bugs limited the reverse tunnel’s success on unprivileged machines, the threat of planted credentials and exfiltrated basic host telemetries remains.\n\nEnjoying this? Get one like it in your inbox each morning.\n\none email a day · unsubscribe in two clicks · no third-party tracking\n\n## The breach exposed a marketplace trust gap\n\nCursor responded swiftly: it purged the malicious extension, shuttered its store, rotated all production keys, and rebuilt its entire infrastructure, eventually releasing a patched `v2.1.314`. This decisive action contained the immediate threat, but the damage to trust was already done.\n\nAnthropic confirmed its systems were untouched; the official **Claude Code** distributions on Microsoft’s VS Code Marketplace, Open VSX, and npm remained secure. This clarified the incident’s scope, isolating the compromise to Cursor’s proprietary marketplace and its distinct security posture.\n\nThe core vulnerability remains: how did an attacker gain publishing access to Cursor’s store to distribute trojanized builds `v2.1.312` and `v2.1.313`? This unanswered question exposes a critical trust gap in third-party editor marketplaces.\n\nThe incident spotlights the urgent need for robust publisher verification, mandatory package signing, and stringent security controls within any platform that hosts developer tooling. Without these, every marketplace becomes a potential vector for supply chain attacks, turning trusted extensions into a backdoor for up to **5,000 developers**.\n\n## Frequently Asked Questions\n\n### Which users may have been affected by the Cursor extension incident?\n\nCursor users who installed or auto-updated the tampered Claude Code extension during its roughly 11-hour availability window may have been exposed. The estimate was up to 5,000 users.\n\n### Were Anthropic’s official Claude Code releases compromised?\n\nNo. Anthropic said its systems were not compromised, and official releases on Microsoft’s Visual Studio Marketplace, Open VSX, and npm were unaffected.\n\n### Is uninstalling the extension enough to remove the backdoor?\n\nNot necessarily. Persistence mechanisms and an unauthorized SSH key could remain after uninstalling, so affected users should run Cursor’s detection steps and inspect their systems.\n\n### What should potentially affected developers do first?\n\nUse a separate, trusted device to review Cursor’s cleanup guidance, remove unauthorized access, and rotate exposed credentials and keys.", "url": "https://wpnews.pro/news/cursors-claude-code-backdoor-what-users-must-do", "canonical_source": "https://www.stork.ai/blog/cursors-claude-code-backdoor-what-users-must-do", "published_at": "2026-11-02 01:21:54+00:00", "updated_at": "2026-11-02 01:50:38.814806+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "ai-products"], "entities": ["Cursor", "Anthropic", "Claude Code", "Microsoft Threat Intelligence", "Sophos"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/cursors-claude-code-backdoor-what-users-must-do", "markdown": "https://wpnews.pro/news/cursors-claude-code-backdoor-what-users-must-do.md", "text": "https://wpnews.pro/news/cursors-claude-code-backdoor-what-users-must-do.txt", "jsonld": "https://wpnews.pro/news/cursors-claude-code-backdoor-what-users-must-do.jsonld"}}