Malicious Claude Code extension with SSH backdoor hit Cursor's marketplace, up to 5,000 users
cyb3rops · x · 2026-10-30
cyb3rops clarifies misinformation around the Claude Code incident: the tampered extension was distributed via Cursor's own marketplace — no compromise of Anthropic's official distribution, the VS Code Marketplace, or Open VSX has been established.
Key facts from Cursor's security notice:
- Malicious version Anthropic.claude-code 2.1.313 was live from 2:27am to 1:35pm PT, affecting at most 5,000 users
- It attempted a persistent SSH backdoor: collecting hostname, username, OS, Git email, public IP, and more
- It tried adding an attacker-controlled SSH key and opening a reverse SSH tunnel; the step usually failed due to bugs unless run as admin
- Persistence via macOS LaunchAgent or Windows scheduled task, retrying every 60 seconds
- Beacon server on port 8099 has been taken offline with the cloud provider
More from coding & agent
- Anthropic pushes unremovable server-side rule banning game rewrites in Claude Code — astralmatrix · 2026-10-30
- Agent Island: a live 3D world where any skill-using AI agent can hang out — swarmagent · 2026-10-30
- He can't edit video, so he built an MCP server: 300 shorts, millions of views — wooing0306 · 2026-10-30
- Ontographia: LLMs Emit Constrained Intent, Never Raw Cypher — JeremyCMorgan · 2026-10-30
- Coinbase for Agents goes live on NousResearch Hermes with persistent memory and MCP trading — MurrLincoln · 2026-10-30
- Indie dev launches one-off-purchase WYSIWYG editor Better Rich Text, itemizing TinyMCE and CKEditor fees — CtrlAltDwayne · 2026-10-30