Cursor: Malicious Claude Code extension versions sat in marketplace 11 hours, tried SSH backdoor
dl_weekly · x · 2026-11-09
Cursor disclosed a security incident: maliciously modified versions of the Anthropic.claude-code extension (2.1.312 and 2.1.313, not built by Anthropic) were available in its VS Code Extension Marketplace for roughly 11 hours.
- The extension harvested hostname, username, OS, environment variable names, Git email, and public IP.
- It attempted to add an attacker-controlled SSH key to authorizedkeys, enable SSH, and open a reverse tunnel, persisting via a LaunchAgent (macOS) or a SYSTEM-level scheduled task (Windows), retrying every 60 seconds.
- Due to bugs in the malicious code, the backdoor step usually failed unless Cursor ran with admin privileges.
- The attacker's server has been taken offline with the cloud provider, disabling the reverse shell and data exfiltration.
Users should remove these versions and audit their systems for leftover SSH keys or persistence tasks.
More from coding & agent
- Exody: a macOS coding workbench with a 5-stage agent loop and per-step multi-model router — Smokiezzz · 2026-11-09
- tldraw and Every converge on a product thesis: build agents for high-trust networks and get security for free — danshipper · 2026-11-09
- Agent edits Qwen 0.8B weights to inject personal facts—no training, no gradients — burny_tech · 2026-11-09
- itr8 puts Claude, GPT, Gemini and Grok in one group chat with a rich agent canvas — cantrell · 2026-11-09
- Xcode ships 11 built-in agent skills you can export to any coding agent with xcrun — pcuenq · 2026-11-09
- Reddit thread: which enterprise AI use cases actually delivered real value, not just demos? — averageChilean · 2026-11-09