What the Cursor Claude Code extension backdoor means

For about 11 hours on October 29, Cursor’s extension marketplace served a tampered copy of Anthropic’s Claude Code extension, version 2.1.313, that tried to install a persistent SSH backdoor, according to BleepingComputer. The window ran from 2:27 a.m. to 1:35 p.m. Pacific Time, and BleepingComputer says up to 5,000 developers were exposed. Cursor extensions update automatically by default, so you may have received the bad version without clicking anything. The question for you is whether Cursor was running with that extension during that window.

The background you need

Cursor and VS Code extensions. Cursor is an AI code editor built from Microsoft’s open-source Visual Studio Code, and it can run VS Code extensions. An extension is a plug-in that adds features to the editor. Claude Code is Anthropic’s AI coding assistant, and its extension brings it into the editor. Cursor runs its own marketplace, a store where extensions are published and from which the editor downloads them.

Why extensions are powerful. An extension is not sandboxed the way a browser tab is. As Ars Technica explains, Cursor extensions run with the permissions of the editor itself. That means a malicious one can likely reach your local files, your source code, and your developer tools. According to BleepingComputer, the injected code ran as soon as the extension loaded. You did not need to open Claude Code or type a prompt.

Supply-chain attack. This is an attack on the delivery route rather than on you directly. You trust a publisher and a store, and the attacker slips bad code into that trusted path. Here, researchers at Phorion and OpenSourceMalware found that the attackers added a JavaScript loader to the start of the extension’s main file and left the rest of the real code alone, according to BleepingComputer. The extension still worked normally, which makes this kind of tampering hard to notice.

SSH, keys, and reverse tunnels. SSH is the standard tool for logging into a machine remotely. Instead of a password, you can use a key pair. The machine keeps a list of public keys it trusts, and anyone holding a matching private key can log in. Adding a key to that list is like adding a name to the guest list at a building’s front desk. A reverse tunnel solves the attacker’s next problem. Your laptop usually sits behind a router or firewall that blocks incoming connections. So the malware has your machine dial out to the attacker’s server and hold that line open. The attacker then rides the line back in. In the analogy, someone inside props open a side door and phones the visitor to say where it is.

The analogy breaks in one important place. A guest list and a propped door are useless if there is no front desk to check names. For SSH, the front desk is the SSH server, a background service that must be running to accept logins. Many laptops do not run one. That detail decides how bad this incident was for a given machine.

Persistence and reconnaissance. Persistence means the malware sets itself up to survive restarts and updates. Reconnaissance means collecting facts about a machine so the attacker can decide what to do with it later.

What actually changed

Nothing about how extensions work is new. They have always run with broad access, and marketplaces have always been a target. What is new is that a trusted, widely used AI coding extension was replaced with a malicious build in one specific store.

Cursor’s advisory, as quoted by BleepingComputer, said: “The extension runs malicious code that attempts to install a persistent SSH backdoor.” Ars Technica reports that, according to Cursor, the code adds an attacker-controlled SSH key, enables the local SSH service, and opens a reverse SSH tunnel, with versions for Windows, macOS, and Linux.

Phorion found bugs that likely stopped the backdoor from working on many Windows and macOS machines, according to BleepingComputer. On macOS, the malware checked whether Remote Login was on without elevated privileges, got an admin-access error instead of a status, and so skipped the step that turns SSH on. On Windows, it tried to run PowerShell through /bin/sh, a Unix shell that standard Windows does not have, so SSH setup failed. The Register gives a different explanation for both platforms: it says the script needed admin rights on macOS and Windows and in most cases did not have them. The two accounts agree on the macOS cause but differ on Windows. Neither source describes a similar bug on Linux.

The bugs do not make the malware harmless. According to BleepingComputer, it still installs its SSH key, sets up persistence, and tries the tunnel. If an SSH server was already running, the tunnel can work. It also sends your username, hostname, public IP address, Git email, and the names of environment variables tied to credentials. It does not send the values. Phorion, via Ars Technica, said the variable names let the operator take stock of cloud credentials and API tokens, likely to pick targets for follow-up attacks.

Cursor removed the extension, shut its marketplace down to audit other extensions and rotate keys, and worked with a hosting provider to take the attacker’s server offline, according to BleepingComputer. Cursor says it found no evidence that other extension versions or the official distribution were affected. BleepingComputer also reports that early claims about npm, Open VSX, and Microsoft’s VS Code Marketplace were wrong, and Cursor was the only source.

What it means for you

The lever is the narrow scope: one version, one store, one time window. That lets you check exposure precisely instead of guessing. Ars Technica says anyone who installed or updated the extension from Cursor between 5:27 a.m. and 4:35 p.m. Eastern on Thursday should consider themselves affected. Because auto-update is on by default, according to Phorion co-founder Luke Roberts speaking to Ars, an open Cursor window that day counts.

If you might be in scope:

• Look for an SSH key named svc-telemetry on the machine, as BleepingComputer advises.
• Follow Cursor’s remediation instructions, which The Register says include cleanup scripts.
• Use the indicators of compromise, IP addresses and file hashes, that Ars Technica says Cursor and Phorion have published.
• If you confirm infection, isolate the machine, rotate any secrets it could reach, invalidate sessions, and rebuild from a safe backup, per BleepingComputer.

If you use Claude Code in plain VS Code or another channel, the sources say you were not hit. Anthropic’s Felix Rieseberg said its official channels are not affected, according to The Register.

Phorion’s summary, via Ars Technica, is the right frame: “the malware is still a significant threat that installs persistence and beacons host reconnaissance back to the operator.”

What we don’t know yet

The biggest gap is how the attacker got in. Beaumont and Roberts told Ars Technica the build was published through Anthropic’s official account on Cursor. Rieseberg, per The Register, said Anthropic’s systems and employee laptops were not compromised and that a malicious actor used access to Cursor’s marketplace. Cursor says Anthropic did not develop the extension, but has not explained how it was published under Anthropic’s name, according to BleepingComputer. Those accounts are not yet reconciled.

The sources also differ on Anthropic’s public response. Ars Technica says Anthropic had not warned customers and that neither company answered its questions. The Register reports Rieseberg’s public statement. BleepingComputer says it is still waiting for replies from both companies.

We also do not know how many of the up to 5,000 exposed machines ended up with a working tunnel, whether any attacker logged in, or who is behind the attack. No source names an attacker.