A poisoned Claude Code extension backdoored developer machines: what to check

For about 11 hours on October 29, anyone who installed or updated Anthropic's official Claude Code extension inside the Cursor code editor could have received a tampered copy that quietly opened a back door into their computer. The poisoned Claude Code extension was published under the real extension's name, on Cursor's own marketplace, so nothing about it looked unusual.

If your business has developers, or works with an agency that uses AI coding tools, this one is worth ten minutes. Not because the damage is known to be large (no confirmed break-ins have been reported), but because it shows how attackers are now going after the tools that build your software.

What happened

Cursor is a popular AI-first code editor built on the same foundation as Microsoft's VS Code, and it runs its own marketplace for add-ons ("extensions"). According to Cursor's security notice, tampered builds of the anthropic.claude-code extension were available there from roughly 2:27am to 1:35pm Pacific time on October 29. The bad builds were version 2.1.313, and in Cursor's revised notice also a tampered 2.1.312. A clean 2.1.312 exists too, so the version number alone doesn't tell you whether you got a bad copy. Anthropic has since released 2.1.314 to make the clean version unambiguous.

Nobody has said publicly how the attacker got the upload in. Anthropic says its own systems weren't compromised and that someone used access to Cursor's marketplace to publish a copy Anthropic didn't build. Cursor says the versions weren't developed by Anthropic, and that it shut the marketplace down, audited access, rotated keys, rebuilt it, and had the attacker's server taken offline. Cursor also says no other extensions were tampered with; that is its own finding, not independently confirmed.

Two things were not affected: VS Code's official Visual Studio Marketplace and the @anthropic-ai/claude-code package on npm. Microsoft, Anthropic and several research firms agree on that. If your developers use plain VS Code or the Claude Code command-line tool, this incident didn't reach them.

What the malicious code did

Researchers at Microsoft, Phorion, StepSecurity and OpenSourceMalware took the tampered build apart. In plain terms, it:

• Ran as soon as the editor loaded it. No click or approval was needed.
• Added the attacker's SSH key to the machine's list of trusted logins (~/.ssh/authorized_keys), labeled svc-telemetry so it would look like a harmless service.
• Opened a reverse tunnel to the attacker's server, retrying every minute, so they could reach the machine from outside without the network allowing it in.
• Set itself to restart after a reboot: a LaunchAgent on macOS, a cron entry on Linux, and a scheduled task on Windows.
• Reported back the computer's name, the user's name, their Git email address, the public IP address, and the names of up to 40 environment variables that looked like keys, tokens or passwords.

That last point matters: researchers found it collected the names of those secrets, not their values, and found no second-stage download. Several parts of the code were also buggy and often failed on macOS and Windows. The real risk is what someone could do once a tunnel was working: with a remote login on a developer's laptop, everything that laptop can reach is in play.

How many people were exposed

Cursor says at most 5,000 users received the tampered build, and it is contacting them. Every outlet's number traces back to that figure; the headlines differ only in whether they call it "exposed", "affected" or "infected". As of November 1, no source has reported a confirmed intrusion through the back door.

Why it matters for a small business

• Your developers' laptops hold the keys to your business. Source code, cloud accounts, payment integrations and customer databases are often one SSH session away from a developer's machine.
• "Official" isn't a guarantee. This was the real extension name from the real publisher. One researcher noted that publisher-verification checks wouldn't have caught it, because nothing about the listing was fake.
• It's part of a pattern. The same month, a malicious release of the LiteLLM library went out through its own release pipeline, and earlier this year GitHub said internal code was taken after a poisoned VS Code extension. AI tools spread fast, which makes them an attractive way in.

What to check this week

1. Ask who uses Cursor. If anyone on your team or at your agency does, ask whether the editor installed or updated the Claude Code extension on October 29. Updates are often automatic.
2. Look for the attacker's key. On macOS or Linux, this command prints a warning only if the key is present: grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "FOUND - follow Cursor's remediation steps" On Windows, also check C:\ProgramData\ssh\administrators_authorized_keys.
3. Don't just uninstall it. Removing the extension does not remove the key, the tunnel or the restart entries. If the key is there, isolate the machine, follow the remediation steps in Cursor's notice (Cursor published cleanup scripts; Microsoft advises reading them before running them), and rotate every password, token and key that machine had access to, from a different, clean computer. Rebuilding the machine is the safest option.
4. Block the known server. Researchers advise blocking the attacker's address, 134.209.82.225, at your firewall, particularly on ports 22 and 8099.
5. Slow down automatic extension updates. Cursor's hardening guide describes an approved-publisher list and an install cooldown that delays brand-new versions. A delay of even a day would have sidestepped this attack, which was live for half of one.

If any of this is unfamiliar territory for your team, it's a good prompt to write down which AI tools people actually use, who approved them, and what they can reach. That list is the starting point for every other decision.

Sources

• Cursor: Security notice on the malicious Anthropic.claude-code versions (Oct 29, updated Oct 30, 2026) and Security and privacy hardening
• Microsoft Security: Inside a malicious Claude Code-branded extension and its persistent SSH backdoor (Oct 30, 2026)
• Phorion: Official Claude Code extension compromise: security advisory (Oct 30, 2026)
• StepSecurity: Trojanized Claude Code extension delivered persistent SSH backdoor (Oct 30, 2026)
• OpenSourceMalware: Trojanized Claude Code extension plants an SSH backdoor (Oct 30, 2026)
• BleepingComputer: Malicious Claude Code extension on Cursor planted SSH backdoors (Oct 30, 2026)
• The Hacker News: Official Claude Code extension on Cursor marketplace trojanized (Oct 30, 2026)
• The Register: Anthropic: That Claude Code extension compromise… couldn't be us (Oct 30, 2026)
• Help Net Security: Claude Code extension poisoned with persistent SSH backdoor (Oct 30, 2026)
• BankInfoSecurity: Cursor confirms Anthropic Claude Code extension compromised (Oct 30, 2026)
• The Register: GitHub says internal repos exfiltrated after poisoned VS Code extension attack (May 20, 2026)

This post reflects reporting available on November 1, 2026.