A modified build of Anthropic’s Claude Code extension was available in the Cursor Extension Marketplace for about 11 hours on October 29, 2026. The malicious extension added an attacker-controlled SSH key, installed persistence, and attempted to open a reverse SSH tunnel.
Overview
On October 29, 2026, Cursor disclosed that a maliciously modified version of the Anthropic.claude-code extension, version 2.1.313, was available in the Cursor VS Code Extension Marketplace between approximately 2:27 AM and 1:35 PM PT. The malicious version was not developed by Anthropic. According to Cursor, at most 5,000 users were potentially affected.
The malicious code collects host and user information, adds an attacker-controlled SSH key (svc-telemetry) to authorized_keys, installs persistence, and attempts to enable the local SSH service and establish a reverse SSH tunnel. It also reports host details to 134[.]209[.]82[.]225:8099.
Cursor removed the malicious version, shut down and rebuilt the marketplace, rotated its keys, and worked with the hosting provider to take the attacker server offline. Cursor says it audited access and found no evidence that other extensions were tampered with. Importantly, uninstalling the malicious extension may not be sufficient, because the payload drops standalone persistence scripts that can continue running after the extension is removed.
What is the Claude Code extension?
Claude Code is Anthropic’s AI coding tool. Cursor, an AI code editor built on VS Code, distributes the Claude Code extension through its own VS Code extension marketplace. It was this marketplace—not Anthropic’s official distribution—that was compromised and used to distribute the malicious build.
Compromised Packages
| Package | Version | Marketplace | Modified builds identified | Exposure window (PT) | Status |
| `Anthropic.claude-code` | 2.1.313 | Cursor VS Code Extension Marketplace | darwin-arm64 (macOS), win32-x64 (Windows) | Oct 29, 2026, approx. 2:27 AM – 1:35 PM | Removed |
Cursor reports no evidence that other versions of the extension, or the official distribution, are affected.
Stage 1 – Host reconnaissance
The malicious code collects information about the host and user, including the hostname, username, operating system, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP address.
Cursor also identified lookups to ifconfig[.]me and api[.]ipify[.]org to determine the host’s public IP. Both are legitimate services, and connections to them alone should not be treated as an indicator of compromise.
Stage 2 – SSH backdoor key and reverse tunnel
The malicious code appends an attacker-controlled ssh-ed25519 public key, labeled svc-telemetry, to the user’s SSH authorized_keys file. It then attempts to enable the local SSH service and establish a reverse SSH tunnel to tunnel@134[.]209[.]82[.]225 over TCP port 22.
Command lines identified by Cursor include:
- ssh -N -R ‘*:0:localhost:22’ and autossh -M 0
- SSH options StrictHostKeyChecking=no, UserKnownHostsFile=/dev/null, ServerAliveInterval=30, ServerAliveCountMax=3, ExitOnForwardFailure=yes, IdentitiesOnly=yes
- systemsetup -setremotelogin on (macOS)
- Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 (Windows)
Enabling the local SSH service requires administrator privileges, which the extension typically would not have. According to Cursor, errors in the malicious code meant this step failed except in highly unusual circumstances where Cursor was launched with administrator privileges. As a result, the attacker could not log in through the tunnel on those hosts.
However, the failed SSH-service step does not mean the payload was harmless: the extension still adds the attacker’s SSH key, installs persistence, and sends host information to the attacker.
Stage 3 – Persistence
The payload installs persistence mechanisms designed to keep the reverse SSH tunnel running independently of the extension, with background scripts retrying the connection approximately every 60 seconds.
- macOS — Creates a LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist (label com.apple.sysmond). Associated files include ~/.config/.smt, ~/.config/.smtk, and $TMPDIR/.stk_<10 hex>.
- Windows — Creates a scheduled task named SysMon that attempts to run as SYSTEM, with a fallback Startup script at %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd. Associated files include %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk, and %TEMP%\.stk_<10 hex>.
Stage 4 – Beacon
The malicious code reports host information and backdoor status via HTTP POST to hxxp://134[.]209[.]82[.]225:8099/beacon. It also attempts to send a beacon to 127[.]0[.]1:8099/beacon on the local host.
According to Cursor, the attacker-controlled server has since been taken offline. As a result, the external beacon and reverse SSH tunnel are no longer functional.
Am I affected?
The malicious extension adds an attacker-controlled SSH public key labeled svc-telemetry to the victim’s SSH authorized_keys file. If this key is present, the machine is impacted.
macOS:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo “svc-telemetry key found” || echo “No key found; machine not impacted”
Windows (PowerShell):
$files = “$HOME.ssh\authorized_keys”, “C:\ProgramData\ssh\administrators_authorized_keys” | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { “svc-telemetry key found” } else { “No key found; machine not impacted” }
Recommendations
Per Cursor’s guidance, if you installed or updated to Anthropic.claude-code 2.1.313 from the Cursor VS Code Extension Marketplace between 2:27 AM and 1:35 PM PT on October 29, 2026:
- Check for impact: Run the check above and search endpoint, network, and extension-installation telemetry for the indicators below.
- Isolate affected hosts: Isolate any systems showing evidence of payload execution or backdoor installation.
- Remediate: Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension alone may not be sufficient.
- Rotate credentials: From a trusted system, rotate credentials and sessions that were accessible from affected hosts. The limited environment-variable collection does not rule out subsequent credential access through the backdoor.
Indicators of Compromise
Packages
| Artifact | Value |
|---|---|
| VSIX SHA-256 (darwin-arm64) | `432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62` |
| VSIX MD5 (darwin-arm64) | `da5469c4221775e9fe2e413e59ca7fd9` |
| VSIX SHA-256 (win32-x64) | `3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081` |
| VSIX MD5 (win32-x64) | `bd3b71ddf3d0cc3af76249afd2c0eda1` |
| Modified file | `extension.js` in `anthropic.claude-code-2.1.313-darwin-arm64` / `anthropic.claude-code-2.1.313-win32-x64`, containing `134[.]209[.]82[.]225` and `svc-telemetry` |
Network
| Type | Value |
|---|---|
| Attacker endpoint | `134[.]209[.]82[.]225` |
| Reverse SSH | `tunnel@134[.]209[.]82[.]225`, TCP 22 |
| External beacon | `hxxp://134[.]209[.]82[.]225:8099/beacon` (HTTP POST) |
| Local beacon attempt | `127[.]0[.]0[.]1:8099/beacon` (HTTP POST, loopback) |
| Public IP lookup | `ifconfig[.]me`, `api[.]ipify[.]org` (legitimate services; access alone is not an indicator) |
SSH
| Type | Value |
|---|---|
| Unauthorized public key | `ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdvylCEJ/k2TpezcTfedrkHyFSK9IZ3vmP6vhY4Ss0P svc-telemetry` |
| Unauthorized key fingerprint | `SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk` |
| Reverse-tunnel key fingerprint | `SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ` |
| Key comment | `svc-telemetry` |
Files and persistence
| Platform | Value |
|---|---|
| macOS | Unauthorized key in `~/.ssh/authorized_keys`; `~/.config/.smt`, `~/.config/.smtk`; `$TMPDIR/.stk_<10 hex>`; `~/Library/LaunchAgents/com.apple.sysmond.plist` (label `com.apple.sysmond`) |
| Windows | `%USERPROFILE%\.ssh\authorized_keys`, `%USERPROFILE%\.config\smt.cmd`, `%USERPROFILE%\.config\smtk`, `%TEMP%\.stk_<10 hex>`; scheduled task `SysMon` (attempts to run as SYSTEM); fallback `%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd` |
Process / command line
- `ssh -N -R ‘*:0:localhost:22’`, `autossh -M 0`
- SSH options: `StrictHostKeyChecking=no`, `UserKnownHostsFile=/dev/null`, `ServerAliveInterval=30`, `ServerAliveCountMax=3`, `ExitOnForwardFailure=yes`, `IdentitiesOnly=yes`
- `schtasks /create /tn SysMon`
- `systemsetup -setremotelogin on`
- `Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0`
Takeaway
From the victim’s side, nothing suspicious had to be clicked and no vulnerability had to be exploited. A modified build of a trusted AI coding extension, published under the real `Anthropic.claude-code` name, arrived through the editor’s own marketplace and reached up to 5,000 users in about 11 hours. As this case shows, an extension update can write to a developer’s SSH keys, register startup tasks and open network tunnels. A poisoned update to a trusted extension is code execution on the developer’s machine.
The cleanup does not end at the uninstall button. The payload was built to outlive the extension: an SSH key in `authorized_keys`, a LaunchAgent or scheduled task, and scripts that retry the tunnel every 60 seconds. Even where the tunnel failed, the key and persistence stayed behind. Anyone who installed 2.1.313 should run the check above. If the key is found, isolate the host, confirm the key, persistence and tunnel processes are gone, and rotate every credential that host could reach.
