In 11 Hours of Installing a Plugin, the Backdoor Moved Into Developer Machines
On October 29, 2026, Cursor distributed tampered Claude Code extensions through its own marketplace for about 11 hours. Versions 2.1.312 and 2.1.313 carried a built-in SSH backdoor; uninstalling the extension does not remove the implanted public key or persistence, and the fixed version is 2.1.314.
- 01THE DISTRIBUTION — October 29, 2026: tampered 2.1.312 and 2.1.313 enter the Cursor marketplace.
- 02THE IMPLANT — The injected code runs on extension load and appends the attacker's SSH public key.
- 03THE TUNNEL — A reverse tunnel points to 134.209.82.225; persistence is written outside the extension directory.
WHAT HAPPENEDWhat Happened
On October 29, 2026, tampered versions of the Claude Code extension appeared in Cursor's own extension marketplace: versions 2.1.312 and 2.1.313, covering macOS and Windows, in a window of roughly 11 hours, from 09:27 to 20:35 UTC. Cursor revised its security notice on October 30, adding the two versions and four file hashes, plus Linux-related indicators.
The changes were hidden at the top of extension.js. The moment the extension loaded, the injected code ran, with no click required from the user. It appended an attacker SSH public key, commented as svc-telemetry, to authorized_keys, tried to start the local SSH service, and opened a reverse tunnel to 134.209.82.225. Persistence also lived outside the extension directory: on macOS a LaunchAgent disguised as system monitoring, on Windows a SysMon scheduled task plus a startup script.
The most troublesome part is that uninstalling does not work. Remove the extension, and the public key, the tunnel retry loop and the startup entries all remain. Cursor says at most 5,000 users received the malicious versions; the fixed release is 2.1.314. Official channels were not affected, and Anthropic says its own systems were not breached; the tampered packages never appeared on Open VSX or Microsoft's marketplace.
THE MARKETPLACE AS ATTACK SURFACEThe Marketplace Itself Became the Attack Surface
Developers trust extension marketplaces the way they trust app stores. Packages distributed by a marketplace carry editor permissions by default: they can read files, run tools and reach keys. Where Cursor failed was precisely in the marketplace it operates itself, not in Anthropic's release channel.
That means the defensive line has to move earlier. Check the publisher and version before installing an extension, and treat automatic updates as deployments. Marketplaces need signature verification and comparison against official hashes at the listing stage; without that step, no amount of user caution helps, only after-the-fact cleanup.
REMEDIATION IS LONGER THAN UNINSTALLThe Cleanup List Is Much Longer Than an Uninstall
Microsoft Threat Intelligence's analysis lays out the full cleanup path: preserve evidence first, then kill the tunnel process, delete the LaunchAgent or scheduled task and startup scripts, remove the svc-telemetry public key from authorized_keys, and finally upgrade to 2.1.314 or later. Doing only one of these steps is the same as doing none.
One detail deserves its own warning. The beacon sent only host information and the names of up to 40 key-related environment variables, not their values. That does not mean there was no loss: the variable names alone tell an attacker what is on the machine that is worth coming back for.
WHY MOST HOSTS ESCAPED THE TUNNELThe Permission Boundary at the SSH Service Limited the Damage
On most machines the tunnel never actually connected, because starting the SSH service requires administrator rights, which Cursor normally does not have. Microsoft and Cursor agree this step was blocked on most macOS and Windows hosts.
But that was luck, not design. Machines that already had SSH running were outside that protection, and the public key and persistence worked on them as intended. Keeping SSH off by default and auditing authorized_keys regularly remains the cheapest insurance on a developer machine.
THE SHIFTWhat Changed
SIGNAL JUDGMENT — ANALYSISTrust in Extension Marketplaces Is Becoming a Single Point of Failure
Tokenta Signal's judgment: the security of the developer toolchain now depends on signature verification in the distribution channel, not on developer vigilance. Miss the marketplace check once, and thousands of developer machines are hit at the same time.
WHAT REMAINS UNCERTAINWhat Remains Uncertain
EVIDENCEEvidence
The original report confirms Cursor's marketplace distributed tampered Claude Code 2.1.312 and 2.1.313 for about 11 hours on October 29, 2026; the injected code appended an svc-telemetry public key and built a reverse tunnel, and the fixed version is 2.1.314.
PRIMARY SOURCESPrimary Sources
- Cursor Security Notice: Security notice, malicious version of Anthropic.claude-code
https://cursor.com/blog/claude-code-extension-security-notice - Rescana: Trojanized Claude Code 2.1.312 and 2.1.313 in Cursor Marketplace Plants SSH Backdoor
https://www.rescana.com/post/claude-code-extension-2-1-313-cursor-marketplace-trojanized-ssh-backdoor
RELATEDRelated Intelligence
- Microsoft Winds Down Its Oracle AI Cloud Rental as Older Nvidia Chips Fall Behind
- An Unreleased Anthropic Model Proved an 18-Year-Old Quantum Conjecture, Machine-Checked in Lean
- IBM Unveils Quantum System Two in Chicago, Its Most Advanced Computer Yet, Powered by Nighthawk
- Vistra Posts $1.14B Q3 Profit as Power EBITDA Jumps Over 50%, Lifts 2026 Outlook