As reported by BleepingComputer, a maliciously modified version of Anthropic's Claude Code extension was distributed through Cursor's extension marketplace for approximately 11 hours on October 29, 2026, exposing up to 5,000 developers to malware that installed persistent SSH backdoors. The incident is a textbook supply chain compromise — but it carries implications that extend well beyond a single bad extension.
Why This Matters
The attack surface for developer environments has expanded dramatically with the proliferation of AI coding assistants and the editors that host them. Cursor, built on VS Code's open-source foundation, inherits the entire VS Code extension ecosystem — but as this incident demonstrates, the marketplace trust model is not equivalent. A malicious extension loaded silently at startup, required no user interaction with Claude Code to trigger its payload, and blended in by keeping the legitimate code intact.
The attackers inserted a malicious JavaScript loader at the beginning of extension.js, leaving the rest of the legitimate extension unchanged. The payload executed on load — no prompt, no interaction, no consent.
This is the core problem: extension marketplaces for AI-powered editors are becoming high-value targets. Developers install extensions with minimal scrutiny, the extensions run with full local privileges, and the tooling to verify extension integrity at scale is essentially nonexistent in most organizations.
Attack Breakdown
| Attribute | Detail |
|---|---|
| Malicious Version | 2.1.313 (Claude Code extension) |
| Distribution Window | Oct 29, 2026 — ~02:27 to 13:35 PT |
| Affected Users | Up to ~5,000 developers |
| Payload | SSH backdoor, reverse tunnel, persistence via LaunchAgent / Scheduled Task |
| C2 IP | 134.209.82[.]225 |
| Active Exploitation | Backdoor deployment attempted; remote access likely limited due to coding errors in SSH setup |
What the Malware Did
Phorion researchers noted that coding errors in the SSH setup routine likely prevented successful remote access on many systems. On macOS, the malware ran systemsetup -getremotelogin without elevated privileges, causing an error instead of a status check. On Windows, similar logic flaws undermined the enablement step. This is a fortunate break — but it is not a guarantee that all systems were unaffected. Systems where SSH was already enabled would have been fully compromised.
Who Is at Risk
- Any developer who installed or auto-updated the Claude Code extension on Cursor during the distribution window
- Source code repositories connected to affected developer machines — Git credentials, tokens, and SSH keys may have been exfiltrated
- CI/CD pipelines and infrastructure accessible from compromised developer endpoints, especially if SSH keys were reused or lateral movement was possible
- Organizations without endpoint monitoring on developer workstations — the persistence mechanisms and C2 beaconing could easily go unnoticed without EDR
Broader Implications
This incident exposes three structural weaknesses in the current AI-assisted development landscape:
- Marketplace verification gaps. It remains unclear how attackers published under Anthropic's name. Whether through account compromise, name collision, or insufficient publisher verification, the trust chain failed. Marketplace operators must implement cryptographic signing, publisher identity verification, and rapid anomaly detection for extension updates.
- Extension auto-update is a liability. Developers rarely inspect what changes when an extension updates. A silent malicious update — especially one that injects code into the startup path — can compromise a machine before any human review occurs.
- AI tools are now a supply chain category. AI coding assistants and their host editors are not just productivity tools — they are privileged development infrastructure. They warrant the same governance as build servers and package registries.
Shield53 Recommendations
Immediate Actions
- Audit all developer workstations for the presence of Claude Code extension version 2.1.313 installed via Cursor between Oct 29 02:27–13:35 PT. Remove the extension immediately if found.
- Check for attacker SSH keys: inspect
~/.ssh/authorized_keys(macOS/Linux) andC:\Users\(Windows) for unrecognized entries.\.ssh\authorized_keys - Hunt for persistence mechanisms: review macOS LaunchAgents (
~/Library/LaunchAgents/) and Windows scheduled tasks / startup folder for unknown entries created on Oct 29. - Block and investigate C2: block 134.209.82[.]225 at the network perimeter and query DNS, firewall, and proxy logs for any developer endpoints that communicated with this IP.
- Rotate credentials: rotate SSH keys, Git tokens, API keys, and any secrets stored on affected machines. Assume exfiltration.
- Review Git history on repositories accessed from affected machines for unauthorized commits, hook changes, or modified CI configurations.
Longer-Term Hardening
- Implement extension allowlisting for all developer endpoints — restrict installation to a vetted, organization-approved set
- Disable auto-update for extensions in managed VS Code / Cursor deployments; route updates through an internal review process
- Deploy EDR on all developer workstations with detection rules for new SSH key additions, LaunchAgent creation, and reverse tunnel establishment
- Require SSH key passphrase protection and use hardware-backed keys (e.g., YubiKey) to limit the impact of key theft
- Establish a developer tooling supply chain policy that includes marketplace risk assessment, publisher verification, and periodic extension audits
The reality is stark: in the age of AI-assisted development, the extension marketplace is now part of the critical supply chain. Treating it as anything less is a liability organizations cannot afford.
