# Cursor’s Claude Code Backdoor: What Users Must Do > Source: > Published: 2026-11-02 01:21:54+00:00 ## A trusted name hid a poisoned download A poisoned [Claude Code](https://www.stork.ai/en/claude-code) extension, distributed through [Cursor](https://www.stork.ai/en/cursor-ai)’s marketplace, not Anthropic’s official channels, put up to 5,000 users at risk. This was not an Anthropic compromise; rather, an attacker exploited Cursor’s store to push tampered builds. The malicious listing appeared under Anthropic’s name, targeting Mac and Windows users. This deceptive branding created a false sense of legitimacy, convincing users they were downloading an official release. The tampered extension was live for approximately 11 hours on October 29, 2026, from 2:27 AM to 1:35 PM PDT. During this window, Cursor estimates that up to **5,000 developers** may have been exposed to the backdoor. The attacker injected an immediately invoked function expression (IIFE) in `extension.js`, meaning the payload triggered on load—no interactive command was needed. It exfiltrated basic host telemetry: public IP addresses, usernames, and Git config emails. Crucially, the backdoor planted an attacker-controlled SSH public key into `authorized_keys`. It also scheduled recurring tasks to open an outbound SSH reverse tunnel to the attacker's server every minute, even if Cursor was restarted. While implementation flaws in the payload minimized the execution rate on unprivileged machines, the threat was real and persistent. ## The extension opened a door beyond the editor The tampered extension wasn’t idle, activating immediately upon loading. It executed Node.js system calls, meaning users didn’t even need to invoke a Claude Code command for the payload to trigger. This backdoor swiftly collected sensitive information: users' public IP addresses, usernames, and Git email addresses. Beyond data exfiltration, the payload appended an attacker-controlled **SSH public key** to `authorized_keys`. It then relentlessly attempted to establish an outbound SSH reverse tunnel to the attacker's server (`134.209.82[.]225`), retrying every 60 seconds. This persistence was built to survive system restarts, a clear sign of a sophisticated attack. Luckily, implementation flaws often crippled the most dangerous aspect of the attack: the reverse tunnel. Microsoft Threat Intelligence and Sophos reported that the SSH service enablement frequently failed unless Cursor ran with **administrative privileges**. The attacker’s command-and-control (C2) server was also swiftly neutralized, limiting further damage. Despite these failures, the risk wasn't entirely mitigated. The injected SSH keys and scheduled persistence scripts could still leave local artifacts on affected machines. Users who downloaded trojanized builds `v2.1.312` or `v2.1.313` between October 29, 2026, and the extension's removal faced potential compromise, even if the tunnel never fully connected. ## Why uninstalling may leave the danger behind Uninstalling the compromised Claude Code extension from Cursor offers a false sense of security. The backdoor was engineered for **persistence**, meaning merely removing the visible extension does not clean the machine. Malicious artifacts, including scheduled tasks (cron jobs, plist files, or Windows scheduled tasks) and unauthorized entries in the `authorized_keys` file, remain embedded. Attackers appended their SSH public key to users' `authorized_keys`, establishing a persistent foothold. The payload also scheduled recurring attempts to open an outbound SSH reverse tunnel every 60 seconds. This ensures continued access even after an uninstallation, leaving a silent, open door. To truly mitigate the risk, affected users must consult Cursor’s official incident write-up and utilize their provided **detection script**. This script helps identify and remove the planted SSH keys and persistence mechanisms. For a deeper technical dive into the attack's mechanics, see Microsoft's analysis: [Inside a malicious Claude Code-branded extension and its persistent SSH backdoor | Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2026/10/31/inside-a-malicious-claude-code-branded-extension-and-its-persistent-ssh-backdoor/). Critical next steps involve proactive security measures. Change all passwords, SSH keys, and other potentially exposed secrets. Perform these changes from a **separate, trusted device** to prevent further compromise. While the attacker’s C2 server was neutralized, and implementation bugs limited the reverse tunnel’s success on unprivileged machines, the threat of planted credentials and exfiltrated basic host telemetries remains. Enjoying this? Get one like it in your inbox each morning. one email a day · unsubscribe in two clicks · no third-party tracking ## The breach exposed a marketplace trust gap Cursor responded swiftly: it purged the malicious extension, shuttered its store, rotated all production keys, and rebuilt its entire infrastructure, eventually releasing a patched `v2.1.314`. This decisive action contained the immediate threat, but the damage to trust was already done. Anthropic confirmed its systems were untouched; the official **Claude Code** distributions on Microsoft’s VS Code Marketplace, Open VSX, and npm remained secure. This clarified the incident’s scope, isolating the compromise to Cursor’s proprietary marketplace and its distinct security posture. The core vulnerability remains: how did an attacker gain publishing access to Cursor’s store to distribute trojanized builds `v2.1.312` and `v2.1.313`? This unanswered question exposes a critical trust gap in third-party editor marketplaces. The incident spotlights the urgent need for robust publisher verification, mandatory package signing, and stringent security controls within any platform that hosts developer tooling. Without these, every marketplace becomes a potential vector for supply chain attacks, turning trusted extensions into a backdoor for up to **5,000 developers**. ## Frequently Asked Questions ### Which users may have been affected by the Cursor extension incident? Cursor users who installed or auto-updated the tampered Claude Code extension during its roughly 11-hour availability window may have been exposed. The estimate was up to 5,000 users. ### Were Anthropic’s official Claude Code releases compromised? No. Anthropic said its systems were not compromised, and official releases on Microsoft’s Visual Studio Marketplace, Open VSX, and npm were unaffected. ### Is uninstalling the extension enough to remove the backdoor? Not necessarily. Persistence mechanisms and an unauthorized SSH key could remain after uninstalling, so affected users should run Cursor’s detection steps and inspect their systems. ### What should potentially affected developers do first? Use a separate, trusted device to review Cursor’s cleanup guidance, remove unauthorized access, and rotate exposed credentials and keys.