---
title: Malicious Claude Code Extension Compromised Up to 5,000 Cursor Users with SSH Backdoor
url: https://www.elseif.net/malicious-claude-code-extension-compromised-up-to-5000-cursor-users-with-ssh-backdoor
published: 2026-11-02T16:04:09+00:00
language: en
section: Agents
source: https://www.it-connect.fr/claude-code-extension-cursor-porte-derobee-ssh/
organizations: Cursor, Claude Code, Anthropic, OpenSourceMalware, Microsoft, Open VSX
publisher: elseif
---

# Malicious Claude Code Extension Compromised Up to 5,000 Cursor Users with SSH Backdoor

A security incident involving the Cursor code editor and the Claude Code extension exposed up to 5,000 users to a compromised software version that installed a persistent Secure Shell backdoor. The event occurred when a modified release of the extension was distributed through the editor's marketplace, allowing an attacker to push their encryption key onto infected machines and establish unauthorized remote access.

The compromised software, identified as version 2.1.313, was available for download on October 29, 2026, between 10:27 and 21:35 Paris time. Cursor removed the malicious version and temporarily suspended access to its extension marketplace to rotate specific security keys while investigators assessed the scope of the breach. The company stated that the incident affected a maximum of 5,000 individuals who installed the extension during this eleven-hour window.

Analysis of the tainted code revealed that the malicious payload consisted of only 66 lines inserted at the beginning of the extension.js file. This code executed immediately upon the editor loading the extension, requiring no user interaction or conversation with the artificial intelligence assistant. The script attempted to create a reverse tunnel connecting to port 22 on the host machine, which is the standard port for Secure Shell services. If the service was not already running, the malware tried to activate it, though this step typically requires administrator privileges that the extension usually lacks. Researchers noted a bug that caused this activation to fail on macOS systems unless remote session features were already enabled. However, on Linux machines or Macs where the Secure Shell service was already active, the added key successfully opened a door for persistent access.

Disagreement exists regarding the origin of the compromised release. Cursor asserted that the malicious version was not developed by Anthropic, the creator of the Claude Code tool. In contrast, security researcher Kevin Beaumont contested this claim, noting that the software was published using the verified account belonging to Anthropic, which suggests a security failure within that organization. Beaumont also criticized the company for releasing the subsequent clean version, numbered 2.1.314, without issuing an immediate warning to its customers. The distribution path remains unclear, as the malicious version vanished from the Open VSX registry, the Microsoft Marketplace, and the Cursor store, with historical records skipping directly from version 2.1.312 to 2.1.314.

Remediation efforts require more than simply uninstalling or updating the extension because the persistence scripts operate independently once installed. Cursor provided cleaning scripts for macOS and Windows users to remove the unauthorized access points. Additionally, Beaumont published specific query language statements for Microsoft Defender for Endpoint to help organizations detect the compromise. The investigation continues into how the malicious software was published under the identity of the official extension, leaving questions about the integrity of the supply chain.