Official Claude Code extension backdoored to open persistent SSH access
Official Claude Code extension compromise
Phorion found a backdoor in the official Claude Code for VS Code extension (version 2.1.313) on the Cursor Marketplace. The injected code runs on load, plants an SSH key, opens a reverse tunnel to an attacker server, and sets up persistence on macOS, Linux, and Windows. A macOS bug in the SSH-enablement logic may block inbound access, but the malware still beacons host details and survives reboots. Cursor has pulled the release.
It effectively treats “I don’t have permission to check if SSH is off” as “SSH is already on,” which also explains why you won’t see the enablement attempt in process telemetry when the extension runs as a normal user.
- felixrieseberg
Felix from Anthropic here.
We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.
- AdrianCX
https://www.reuters.com/business/media-telecom/cursor-says-u...
> Cursor said the extension was not developed by Anthropic and the maliciously modified extension was live on the marketplace from about 2:27 a.m. PT to 1:35 p.m. PT on Thursday
So is this or isn't this from Anthropic and how did this happen?
- yubblegum
The original Phorion report really should be up here. It even details what exactly happened. So they simply added a ssh key to the authorized keys.
- helsinkiandrew
> Yesterday, Anthropic were compromised and Cursor extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor
That's a bit hyperbolic: someone released a version of the Claude Code VS Code extension with a backdoor on the Cursor marketplace:
> a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace
https://cursor.com/blog/claude-code-extension-security-notic...
- xx_ns
I think it should be important to note that this affected the Claude Code extension on the Open VSX extension registry (and by extension, the Cursor marketplace). From what is currently known, the build on the official marketplace was/is clean.
EDIT: I am now actually unsure if this is the case. From what I can see, all of the write-ups mention the Cursor marketplace and Open VSX specifically, but make no explicit mention of the official Microsoft registry.
EDIT 2: The version that was compromised (2.1.313) seems to have never been published on the official Microsoft registry. As per the documentation [1], unpublished versions should still be discoverable:
> When you unpublish an extension, the Marketplace preserves the extension statistics. The extension remains publicly discoverable and available via an existing API.
[1]: https://code.visualstudio.com/api/working-with-extensions/pu...
- orlp
So if this happened to OpenAI it would've been instantly auto-updated everywhere? VS Code has an "auto update delay" which I have configured to a week, but I just found out that (https://code.visualstudio.com/updates/v1_123):
> Note: This delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI. These extensions continue to update immediately.
You can't even configure which publishers you "trust"...
- 1shooner
Cursor reporting this:
https://cursor.com/blog/claude-code-extension-security-notic...
What appears to be an official Binance account reporting it also:
https://www.binance.com/en/square/post/10-30-2026-claude-cod...
- anon-3988
I have this realization recently that everyone that uses Claude Code or Codex have basically been running RCE code on a daily basis (me included). So much for "be careful about running curl | bash!". That puts it into perspective what does security and privacy really mean? For all I know, these CLIs could have been secretly scraping my entire directory. Who's checking?
- rietta
Do publishers not sign their packages before it gets to Cursor for distribution? Does Cursor itself apply and enforce any package integrity?
- paxy
So let me get this straight – Elon was trolling Binance on Twitter, when in fact it was his own company that got hacked and led to the theft?