Fake Claude Code with an SSH backdoor found in Cursor Marketplace: up to 5000 users at risk

Cursor has published a security notice: a malicious version of Anthropic.claude-code 2.1.313 was available in its VS Code extension marketplace. The company stresses that this is not an Anthropic build. Someone swapped in a fake package and tried to use it to install a persistent SSH backdoor on developers' machines. Cursor estimates that no more than 5000 users were affected and says it will contact them directly.

The malicious package was live in the marketplace from about 2:27 to 13:35 Pacific time. Cursor removed it immediately after detection and blocked further distribution. As a precaution, the company then shut down the marketplace entirely, audited access, and confirmed that no other extensions had been touched. It then rotated its keys, rebuilt the marketplace, and brought it back online. Separately, Cursor and a cloud provider took down the attacker's server, so the reverse tunnel and the exfiltration of host data no longer work.

A brief note on dates: the post is dated 13 August 2026, but the user instructions tie the installation window to 29 October 2026. The text does not make clear which date is correct, so rely on the time interval and on the key-based check described below.

What the malicious code did

The extension collected data about the host: the machine and user names, OS, architecture, home directory, names of environment variables, working directories, the email from Git settings, and the public IP. It then tried to add the attacker's SSH key, with the comment svc-telemetry, to authorized_keys, enable the local SSH service, and open a reverse SSH tunnel.

For persistence, the code used a LaunchAgent on macOS (com.apple.sysmond) and a scheduled task named SysMon on Windows, with a fallback through the Startup folder. Background scripts retried the tunnel connection about every 60 seconds. The code reported the backdoor's status and host details with an HTTP POST request to /beacon on port 8099.

According to Cursor, bugs in the code itself meant the tunnel step would not have worked on almost any machine. Enabling the SSH service requires administrator rights, and the extension does not have them on most macOS and Windows hosts. The exception is the rare case where Cursor was launched with elevated privileges. The other steps did not need those rights, though: the key was added, autostart was installed, and host data was sent out. That is why Cursor asks everyone who installed this package to follow the recommendations.

How to check your machine and what to do

The check is simple: search for the string svc-telemetry in ~/.ssh/authorized_keys. On Windows there are two files: the same path in the user profile and C:\ProgramData\ssh\administrators_authorized_keys. If the key is there, the machine is affected.

Cursor then advises isolating any host that shows traces of the payload running and running a cleanup script. On macOS that is remediate-macos.sh, which should be run as a regular user, not as root. On Windows it is remediate-windows.ps1, run in PowerShell with administrator rights. The scripts remove the extension, the autostart mechanisms, the tunnel processes, and the attacker's key, and they exit with a non-zero code if anything is left. After that, you should decide whether it is simpler to rebuild the machine.

Removing the extension alone is not enough: the payload leaves behind separate autostart scripts that keep running. Credentials and sessions accessible from the affected machine should be changed from a trusted system. Collecting the names of environment variables does not expose the values themselves, but Cursor explicitly warns that this does not rule out access to secrets later through the backdoor.

For security teams, the notice includes indicators of compromise: SHA-256 hashes for darwin-arm64 and win32-x64, the server's IP address, key fingerprints, and commands such as ssh -N -R and schtasks /create /tn SysMon. Requests to ifconfig.me and api.ipify.org alone are not considered an indicator, since those are legitimate services.

The incident exposes a weak spot in AI editors: marketplace extensions run with the user's privileges, and a developer's machine holds SSH keys, tokens, and repository access. A package spoofed under a well-known vendor's name is designed to exploit exactly that. Cursor has not explained how the attacker uploaded the package to the marketplace, and the company has no evidence that other versions are affected.