A trojanized Claude Code extension on Cursor tried to leave an SSH backdoor

Extension marketplaces inherit the trust of the editor. On October 29, 2026, a malicious build of Anthropic’s Claude Code extension was distributed through Cursor’s marketplace under the extension’s legitimate publisher identity. Public reporting puts the window at roughly eleven hours and the possible exposure in the low thousands of developers. The payload’s goal, according to those reports, was a persistent SSH backdoor on the machine that installed the update.

BleepingComputer and The Hacker News both covered the incident. Cursor temporarily shut the path down and removed the bad release. Version 2.1.313 is the build named in the public accounts. The important sentence for a security team is not the version string. It is that “official publisher” was not enough. The update looked like the real Claude Code channel. People who auto-update extensions did what the product taught them to do.

Why this lands harder than a random VS Code spam extension

Claude Code is a developer tool. It sits next to repositories, credentials, and often cloud keys. An SSH backdoor on that workstation is not a nuisance miner. It is a path into the same boxes the developer can reach from a terminal. The fake ChatGPT desktop apps that shipped miners earlier in the week preyed on search. This one preyed on the update mechanism inside an IDE that many teams have already blessed.

The distribution path matters for every editor marketplace, not only Cursor. A package that carries the right name and publisher metadata will clear a visual check. Signature and publisher checks are necessary. They are not a substitute for pinning, for delay windows on auto-update, or for watching what an extension process does after install. This desk will not describe how the backdoor was installed, which keys it touched, or how to recreate it. Those belong in vendor advisories and internal IR notes.

What to do if Cursor is on the fleet

Assume anyone who had marketplace updates enabled during that window may have pulled the bad build. Do not wait for a user to remember whether they saw a Claude Code update on the 29th.

Check installed extension versions against the vendor’s good builds. Remove 2.1.313 if it is present. Rotate credentials that lived on those laptops: source-control tokens, cloud access keys, SSH keys, and any secret the IDE could read from the environment or from local config. Review authorized_keys and unexpected SSH listeners on developer workstations and on bastions those users can reach. Reimage if your playbook already says that a persistent remote-access implant is a reimage event. Half measures leave the door you cannot see.

For the program, not only the incident: turn off automatic marketplace updates for high-risk extensions until a human or a pipeline approves the version. Prefer vendor-verified install paths where they exist. Alert when an extension binary or its helper process opens outbound SSH, rewrites authorized_keys, or drops a new persistence entry. Treat AI coding assistants as production software. They have the privileges of the people who love them.

Cursor’s response — pull the package, close the window — is the minimum bar. The durable control is on the buyer side: know which extensions can run as the developer, and do not let “publisher name matched” finish the thought.

This briefing relies on public reporting by BleepingComputer and The Hacker News. It does not include malware procedures or reproduction steps.