Trojanized Claude Code extension in Cursor: an SSH backdoor on developer computers
On October 29, 2026, for about eleven hours, developers who installed or updated the “Claude Code” extension in the Cursor editor could receive a trojanized version. It carried the official name, Anthropic.claude-code, but it was not built by Anthropic. Once running, it tried to open an SSH backdoor on the computer.
If your team, a freelancer or your web provider codes with Cursor, here is what happened, how to check a computer in two minutes and which rules to adopt for code editor extensions.
Trojanized Claude Code extension: the risk window
Thursday, October 29, 2026 (Eastern Time)
Only Cursor’s extension marketplace was affected. According to Cursor, other extensions, the official Visual Studio Marketplace, Open VSX and npm are not affected.
Cursor removed the malicious versions as soon as they were detected, shut down its whole marketplace as a precaution, rotated its keys and brought the service back online. According to published analyses, at most about 5,000 users could have received the trojanized version. How the attacker was able to publish to the marketplace is not yet known. The attacker’s server was taken offline with the hosting provider’s help.
What the extension did on the computer
| Action | Detail | Why it matters |
|---|---|---|
| Host inventory | Computer name, user, OS, public IP address, Git email, working folders and the names of environment variables (not their values) | The attacker knows where it landed and which secrets exist on the machine |
| SSH key added | An attacker key, labelled svc-telemetry, appended to authorized_keys |
A way in that stays even if the extension is removed |
| SSH service enabled | Attempt to turn on the local SSH server | Needs admin rights: fails on most computers |
| Reverse tunnel | Outbound SSH connection to 134.209.82.225, retried about every 60 seconds | Lets someone in despite the firewall |
| Persistence | macOS: LaunchAgent com.apple.sysmond. Windows: scheduled task SysMon or a sysmon.cmd script in the Startup folder |
Restarts with the computer |
The relatively good news: according to Cursor, because of errors in the malicious code, the step that enables the SSH service almost always failed without admin rights. So the attacker probably could not get in through the tunnel. But the key, the persistence and the data upload did work. Cursor asks everyone affected to clean up regardless.
Check a computer in two minutes
The easiest trace to look for is the svc-telemetry key. Cursor publishes a command for each system and official clean-up scripts (see the sources).
If the key is found: clean-up rules
Affected computer: in this order
🔌 Isolate the computer
Take it off the network before anything else.
🧹 Clean up, don’t just uninstall
Uninstalling the extension is not enough: the persistence scripts keep running. Use Cursor’s script or rebuild the computer.
🔑 Rotate secrets from another computer
API keys, GitHub tokens, cloud access, saved passwords: change them from a clean computer.
🔎 Look elsewhere
Check your firewall logs for connections to 134.209.82.225 and check other developer computers.
This is not the first time a developer tool has been used as a way in. We recently covered a compromised OVHcloud CLI extension that stole secrets and the AGENTS.md trap targeting AI coding agents. Developer computers often hold the company’s most valuable keys.
Rules to adopt for editor extensions
📋
An approved extension list
For Cursor, VS Code and other editors, per developer computer.
⏸️
No auto-updates on sensitive computers
Wait a few days before installing a new version of a critical extension.
👤
No everyday admin rights
That is what limited the damage here.
🔐
Secrets off the computer
A secrets manager rather than .env files and permanent environment variables.
How NeoTech can help
Our cybersecurity services include an inventory of the extensions installed on your computers, a check for traces of this attack and rotation of exposed secrets. Our automated 24/7 monitoring with on-call technician intervention spots unusual outbound connections, such as an SSH tunnel to an unknown server.
Book your free cyber check
In 30 minutes, we look together at your team’s development tools, the rights on each computer and where your access keys live.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- Cursor — Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313), October 29, 2026, updated October 30
- Microsoft Security Blog — Inside a malicious Claude Code-branded Cursor extension with a persistent SSH backdoor, October 30, 2026
- matt.security — Analysis of the trojanized Claude Code extension in Cursor
Photo: Antonio Batinić, Pexels (Pexels licence).