Tampered Claude Code Extension in Cursor Marketplace Attempted SSH Backdoor
Cursor said a tampered Claude Code for VS Code extension reached at most 5,000 users through its marketplace and was not developed by Anthropic. Phorion found that version 2.1.313 contained code that collected host and user information, sought the names of environment variables associated with keys, tokens and secrets, added an attacker-controlled SSH key, and attempted to establish a reverse tunnel with cross-platform persistence. Reports noted that errors may have prevented remote access from working on many systems; one report also listed version 2.1.312 as affected. Cursor removed the malicious releases, temporarily disabled the marketplace, worked with providers to neutralize the malware, restored the marketplace and asked users to update to version 2.1.314.
The incident shows how tampering with an AI developer tool’s distribution channel can expose host details and reveal which cloud credentials are present on a machine, while including code designed to preserve remote access. Successful remote access was not established on every affected system.
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the http://cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products. In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk. If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314: https://cursor.com/blog/claude-code-extension-security-notice