Anthropic's Claude Code extension for Cursor shipped with an SSH backdoor

A tampered version of Anthropic’s official Claude Code extension was distributed through the Cursor VS Code extension Marketplace and ran code that tried to install a persistent SSH backdoor on developer machines, according to security researcher Kevin Beaumont and a security notice from Cursor that he quotes. The malicious build is version 2.1.313, and Cursor says around 5,000 developer systems were impacted.

Beaumont, who writes the DoublePulsar security blog, describes the incident as a supply chain attack. He says the compromise happened the day before his post and that the extension auto-updated to the malicious version inside Cursor. The security firm Phorion was the first to notice the malicious activity on endpoints. Phorion’s advisory says it detected a backdoor in the official Claude Code for VS Code extension bundle on the Cursor Marketplace.

How a tampered Claude Code build reached Cursor users

Claude Code is Anthropic’s coding agent. Developers who work in Cursor, an AI code editor built on VS Code, can install it as an extension. Beaumont calls it a Cursor VS Code extension “used by tens of millions of developers for Claude access”. That figure is his own characterisation and does not appear in Cursor’s quoted notice.

Cursor’s notice, as quoted by Beaumont, says “a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace” and that it “runs malicious code that attempts to install a persistent SSH backdoor”. SSH (Secure Shell) is the standard protocol for logging into a machine remotely. A backdoor of this kind would let an outside party connect to a developer’s computer without the owner’s knowledge.

Beaumont disputes one line in Cursor’s post: “This malicious version of the extension was not developed by Anthropic.” He writes that the build was in fact uploaded through Anthropic’s verified account. He adds that Anthropic obviously did not write the backdoor, but that a security incident led to a supply chain attack. The sources do not say how the attacker gained the ability to publish under that account.

Version 2.1.313 is now missing from OpenVSX, the Visual Studio Marketplace and Cursor, according to Beaumont. The sources do not establish whether the malicious build was ever offered through OpenVSX or the Visual Studio Marketplace. Cursor’s notice and Phorion’s advisory both refer specifically to the Cursor Marketplace.

What version 2.1.313 tried to do

Cursor’s notice lists the steps the malicious code takes:

• Reconnaissance: it collects hostname, username, operating system, architecture, home directory path, environment variable names, working directories, configured Git email and public IP address.
• Backdoor: it tries to add an attacker-controlled SSH key to the authorized_keys file, enable the local SSH service and open a reverse SSH tunnel, meaning a connection that starts from the victim’s machine and lets the attacker reach back in.
• Persistence: it tries to keep the tunnel alive through a LaunchAgent on macOS, or on Windows through a scheduled task that attempts to run as SYSTEM, with a Startup-script fallback. Background scripts retry the tunnel roughly every 60 seconds.
• Beaconing: it reports host details and backdoor status by HTTP POST to /beacon on port 8099.

The sources describe the severity differently. Beaumont calls the payload a remote access trojan that “allowed hands on and automated remote access to developer laptops and desktops”. Cursor’s notice is more limited on the key step. It says that, outside of “highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code,” adding the attacker’s SSH key, enabling SSH and opening the tunnel “would fail”. The reconnaissance and beaconing steps are listed without that caveat. Machines that ran the build may therefore have sent system details to the attacker even where the backdoor itself did not take hold.

Item	Detail (as reported)
Malicious version	2.1.313
Replacement version	2.1.314, published by Anthropic
Distribution channel	Cursor VS Code extension Marketplace
Delivery	Auto-update inside Cursor
Systems impacted	Around 5,000, per Cursor
Platforms with persistence logic	macOS (LaunchAgent), Windows (scheduled task, Startup-script fallback)
Command-and-control	HTTP POST to /beacon on port 8099
First detected by	Phorion

Who is affected, and what remains unclear

The exposed group is Cursor users who had the Claude Code extension installed and received version 2.1.313. Because the extension auto-updated in Cursor, users did not need to take any action to receive it. Cursor’s count of about 5,000 impacted systems is the only figure in the sources. Beaumont names Binance as a notable customer that runs Claude Code and Cursor on laptops, “amongst thousands of others”. He does not say Binance was affected.

Several points remain open in the sources:

• How the publishing account was compromised. Beaumont writes that Anthropic “were compromised” but gives no technical detail.
• Whether 2.1.314 is fully clean. Beaumont says the replacement “appears to remove the backdoor from the extension,” but that he is not sure it contains no malicious code.
• How many backdoors actually worked. Cursor says the tunnel step would usually fail. Its notice, as quoted, does not say how many of the roughly 5,000 systems were running Cursor with administrator rights.
• Linux. The quoted notice describes persistence for macOS and Windows only, and Beaumont’s published file hashes cover a macOS (darwin-arm64) build and a Windows (win32-x64) build.

Beaumont calls it “an emerging situation”.

What Anthropic and Cursor have said

No statement from Anthropic appears in the sources reviewed for this article. Beaumont writes that “Anthropic has not informed customers” and that the backdoored version was deleted “without telling anybody”. What the sources do show is action: Anthropic replaced 2.1.313 with version 2.1.314, about eight hours before Beaumont’s post.

Cursor has published a security notice acknowledging the incident. Beaumont says Cursor “has admitted the issue”. The notice identifies the malicious package as Anthropic.claude-code version 2.1.313 and gives the technical breakdown summarised above.

Beaumont also warns about the limits of the fix. Version 2.1.314 “does not remove the SSH backdoor from systems already infected, nor the prior recon activity”. Updating the extension is therefore not enough for a machine that ran 2.1.313.

How developers can check their machines

Beaumont’s post includes indicators of compromise (IoCs), the file hashes and network addresses that security teams use to detect an attack. He has also published KQL queries for hunting the malicious version with Microsoft Defender for Endpoint. KQL is the query language Defender uses for searching endpoint logs.

Checks based on the published details

1. Check the extension version history. Look for any record of Claude Code 2.1.313 having been installed in Cursor.
2. Inspect authorized_keys. The malware tries to add an attacker-controlled SSH key there. Unknown keys are a red flag.
3. Check whether the local SSH service is enabled when it was not before, since the code tries to switch it on.
4. Look for persistence: unfamiliar LaunchAgents on macOS, or on Windows new scheduled tasks set to run as SYSTEM and new Startup scripts.
5. Search network logs for the indicators below.

Published indicators (defanged as in the source)

• VSIX SHA-256 (darwin-arm64, Mac): 432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62
• Modified VSIX SHA-256 (win32-x64): 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081
• Reverse SSH tunnel: 134[.]209[.]82[.]225 port 22
• C2: hxxp://134[.]209[.]82[.]225:8099/beacon (HTTP POST)
• Local beacon attempt: 127[.]0[.]0[.]1:8099/beacon (HTTP POST, loopback)

Beaumont notes that the malware also looks up the machine’s public IP through ifconfig[.]me and api[.]ipify[.]org. These are legitimate services, and he says access to them alone is not an indicator.

Because the reconnaissance step collected environment variable names, working directories and Git email, teams may also want to review what credentials were present on affected machines. A separate October incident shows the risk. Bugtraq Solutions notes that the configuration files AI agents keep on disk, including API keys, session tokens and repository access, are now “as sensitive as a cloud credential”. The same post advises isolating a machine before revoking tokens on it, because the malware in that incident wiped the home directory when a stolen GitHub token was revoked.

A pattern of attacks on AI coding tools

This is not the first security problem involving Cursor’s extension ecosystem or AI coding agents more broadly.

• Extension access to credentials. Security firm LayerX reported in 2026 that any installed Cursor extension could access API keys and session tokens stored in a local SQLite database. That included credentials for third-party integrations such as OpenAI, Anthropic and Google. LayerX disclosed the issue to Cursor on February 1, 2026. Cursor responded on February 5 that defining the trust boundary for extensions is the user’s responsibility. As of April 28, LayerX said the issue remained unpatched.
• Repository-triggered code execution. Novee disclosed CVE-2026-26268 (CVSS 8.1), a flaw where cloning a crafted repository could run code when Cursor’s agent performed routine Git actions. Cursor completed a fix in February 2026.
• Impersonated extensions. In 2025, a malicious extension posing as a “Solidity Language” plugin on the Open VSX registry led to cryptocurrency theft and gave attackers full remote access to systems, according to a LinkedIn post summarising BleepingComputer’s report.
• Targeting agent configs. On October 8, a tampered Tensorlake SDK package on npm harvested credentials and explicitly targeted configuration folders for Claude, Cursor, Kiro, Windsurf and Zed, according to Bugtraq Solutions.

Mindgard’s public catalogue of vulnerability patterns in AI IDEs and coding agents lists Claude Code and Cursor among the tools covered. It includes a “Supply Chain & Persistence” category of attack patterns.

What sets this incident apart, by Beaumont’s account, is that the malicious code arrived through the official, verified publisher listing and was delivered automatically by update. Checking the publisher name before installing would not have helped.

What this means for builders

For teams that use AI coding extensions, the incident shows how far an editor plug-in can reach. Version 2.1.313 tried to change SSH configuration, create operating-system-level scheduled tasks and contact an outside server. Those actions go well beyond what a coding assistant needs. Teams that let extensions auto-update cannot control which version runs on a developer laptop at a given moment.

Practical steps drawn from the sources include hunting for the published indicators and treating the agent configuration and credentials on affected machines as exposed. Pinning versions before a package reaches automated pipelines is another measure that Bugtraq Solutions recommends for npm dependencies. LayerX’s earlier recommendations for Cursor were to move secrets into encrypted system keychains and enforce stricter extension isolation.

What to watch next

• An Anthropic disclosure: how the verified publishing account was used to upload the build, and whether other distribution channels were touched.
• A clean bill for 2.1.314: Beaumont has not yet confirmed that the replacement contains no malicious code.
• Exploitation numbers: how many of the roughly 5,000 systems actually ended up with a working backdoor, given Cursor’s statement that the step usually failed.
• Cursor’s extension model: whether Cursor changes how extensions are isolated or auto-updated, after earlier telling LayerX the trust boundary is the user’s responsibility.