Claude Code extension backdoor: Cursor users got an SSH key

Picture this: you open Cursor on Thursday morning, the Claude Code extension updates itself like it does every other week, and somewhere in the background a script quietly drops an attacker’s SSH key on your machine. No popup, no warning, nothing. That’s the Claude Code extension backdoor story in one sentence, and it’s the kind of story that makes me want to go back to vim and a candle.

Here’s what actually happened. Version 2.1.313 of the Claude Code extension showed up on Cursor’s marketplace with a little extra inside. It was downloadable for roughly eleven hours, from 02:27 to 13:35 Pacific, before anyone pulled it. During that window, up to 5,000 developers grabbed it, according to figures cited by The Register. The EDR vendor Phorion spotted it first, which tells you something about how much the marketplace itself was watching.

What the Claude Code extension backdoor did

The payload wasn’t subtle, just patient. It harvested your username, your configured Git email and your public IP, shipped all of that off to a server, then tried to open a reverse SSH tunnel back to the attacker. On Windows, macOS and Linux. The tunnel part needed admin rights, which most developers (thankfully) don’t run with all day, so it mostly failed.

Don’t celebrate yet. The extension still planted the attacker’s SSH key and installed persistence. And here’s the bit I’d underline twice if this were paper: updating to a clean version does not remove any of it. The malicious update is gone from the marketplace, your machine is not automatically clean. If you had Cursor open on Thursday, you’re threat-hunting this weekend, not patching.

Cursor’s advisory says they “removed the malicious version from the marketplace immediately upon detection and blocked further distribution”, then followed with “a full shutdown of the VSCode Marketplace out of an abundance of caution”. They rotated their own keys, checked that no other extension had been tampered with, and got a cloud provider to block the attacker’s server. Fine. Good, even. But notice what’s missing from that list.

Anthropic says “not us”

Within hours, the usual theory was circulating: Anthropic got breached, and the poisoned extension came out the other end. Felix Rieseberg, from Anthropic’s technical staff, shot that down on X: “it wasn’t a compromise of Anthropic’s systems or employee laptops.” His version is that “a malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish.” Official channels untouched, Cursor users only.

I’m inclined to believe him, mostly because the alternative would be a much bigger story and companies generally can’t keep those quiet for long. But it leaves the actual question wide open: how does a random party get to push an update to one of the most downloaded extensions on an official marketplace? A leaked publisher token? A compromised maintainer account on Cursor’s side? A flaw in the marketplace itself? Neither company has said. Two days later, that silence is louder than the statements.

And this isn’t a one-off. GitHub had internal repos exfiltrated through a poisoned VS Code extension back in May. Last week I wrote about how a stray AGENTS.md in your Downloads folder can hijack Codex. The pattern is the same every time: we’ve handed our editors and our AI agents the keys to our machines, and the supply chain feeding them is held together with marketplace trust and good intentions.

What I’d do right now

If you use Cursor, check ~/.ssh/authorized_keys on every machine where it ran, and look for keys you didn’t put there. Check for new launch agents, systemd user units or scheduled tasks created on Thursday. Rotate anything the extension could have seen, starting with Git credentials and any API keys sitting in your shell environment. Then read Phorion’s write-up, because they list the indicators better than any vendor advisory does.

If you don’t use Cursor, don’t get smug. Pin your extension versions where you can, turn off auto-update for anything that gets shell access, and accept that “official marketplace” is a label, not a guarantee.

Eleven hours is all it took to turn a coding assistant into a doorbell for strangers.