Fake coding extension in Cursor's marketplace planted an SSH key

Fake coding extension in Cursor's marketplace planted an SSH key

29 October 2026: Cursor, the AI code editor, says a tampered build of the Anthropic.claude-code extension, version 2.1.313, was available in its VS Code extension marketplace from about 2:27am to 1:35pm Pacific time on 29 October and tried to install a persistent SSH backdoor on the machines of developers who installed or updated it. Cursor says the package was not made by Anthropic, that at most 5,000 users were affected and that it will contact them directly. The genuine extension and other versions are not affected, by Cursor's account.

Not yet independently verified. Cursor has not said how the package reached its marketplace, and the maker of the genuine extension has published no statement we could find. The user count is Cursor's upper bound. We will update this when it can be confirmed, and remove this note.

What the payload does

The modified extension.js collected the host name, user name, operating system, architecture, home directory, working directories, the names of environment variables, the configured Git email and the public IP, and posted them to an attacker server. It then appended an attacker's public key, labelled "svc-telemetry", to the user's SSH authorised keys, tried to switch on the local SSH service and opened a reverse SSH tunnel to the same server, retrying about every 60 seconds.

Persistence came through a LaunchAgent named com.apple.sysmond on macOS, and on Windows through a scheduled task that tries to run as SYSTEM, with a sysmon.cmd file in the Startup folder as a fallback. Cursor notes that enabling the SSH service needs administrator rights, which the extension lacked on most machines, so on those the attacker could not log in through the tunnel. The key, the persistence and the data collection still happened, and Cursor says the collected variable names "do not rule out later credential access over the backdoor".

What Cursor did

Cursor removed the version, shut the whole marketplace down as a precaution, audited access and found no other extension tampered with, rotated its keys, rebuilt the marketplace and brought it back. It worked with the hosting provider to take the attacker's server offline. It has not said how the malicious build was published.

Checking a developer machine

Anyone who installed or updated the extension from Cursor's marketplace in that window should search ~/.ssh/authorized_keys (and, on Windows, C:\ProgramData\ssh\administrators_authorized_keys) for "svc-telemetry". A match means the machine is affected. Cursor's notice gives remediation scripts for macOS and Windows that remove the extension, the persistence entries, the tunnel processes and the key, and exit with an error if anything is left. Cursor warns that uninstalling the extension may not be enough because the payload drops standalone scripts, and suggests considering a rebuild. Credentials and sessions reachable from an affected machine, including Git hosting tokens and cloud keys held in environment variables, should be rotated from a different, trusted computer.

For a security team, the notice lists indicators to search endpoint and network logs for: connections to 134.209.82.225 on TCP 22 and on port 8099, the two VSIX hashes and the LaunchAgent and scheduled task names. Extension marketplaces that sit outside Microsoft's own are a gap many software inventories miss. Our AI coding assistant software category lists six products.

Company profile on TrustList: Cursor

Sources

• Cursor: Security notice, malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace, 29 October 2026