Overview
On October 30, 2026, cybersecurity researchers disclosed that the official Anthropic Claude Code extension distributed through the Cursor IDE marketplace had been trojanized with a persistent SSH backdoor. The compromise affected up to 5,000 users who installed the malicious version 2.1.313 of the extension. Cursor briefly took the marketplace offline to remediate the incident, and Anthropic subsequently published a clean version 2.1.314 to both Open VSX and the Microsoft VS Code Marketplace. The incident highlights the growing risk of AI developer tooling as a high-value supply chain attack surface.
Technical Analysis
The malicious package identified itself as anthropic.claude-code version 2.1.313. A 66-line JavaScript loader was inserted before the legitimate extension code in the main bundle, activating after VS Code startup and when the extension’s webview opens.
Execution chain:
- SSH Key Injection — Appends an attacker-controlled public key labelled
svc-telemetryto~/.ssh/authorized_keys. - SSH Service Activation — Attempts to enable the local SSH daemon across Windows, Linux, and macOS (requires admin rights; fails silently on hardened macOS/Windows hosts).
- Reverse Tunnel — Establishes a reverse SSH tunnel to
134.209.82[.]225, providing the attacker a pathway into the victim’s machine. - Persistence — Installs platform-specific persistence: Windows scheduled task, Linux crontab, macOS LaunchAgent.
- Host Beacon — Transmits host reconnaissance data via unencrypted HTTP POST to
134.209.82[.]225:8099/beacon.
Beaconed data includes:
- Public IP (via
api.ipify.org) - Hostname and local username
- OS and CPU architecture
- Home and working directories
- Global Git email
- Names (not values) of up to 40 environment variables matching patterns:
KEY,TOKEN,SECRET,PASS,AWS,GCP
While environment variable values are not exfiltrated in the initial beacon, successful SSH tunnel access would allow direct inspection of the full environment.
Framework Mapping
| Framework | Technique | Rationale |
|---|---|---|
| MITRE ATLAS | AML.T0010 – AI Supply Chain Compromise | Attacker compromised an AI coding tool’s marketplace distribution |
| MITRE ATLAS | AML.T0115 – Publish Poisoned AI Artifacts | Trojanized extension published as legitimate Anthropic package |
| MITRE ATLAS | AML.T0083 – Credentials from AI Agent Config | Harvesting cloud credential names from developer environments |
| OWASP | LLM05 – Supply Chain Vulnerabilities | Compromise via third-party marketplace, not the core model |
| OWASP | LLM06 – Sensitive Information Disclosure | Credential metadata and host data exfiltrated |
| OWASP | LLM07 – Insecure Plugin Design | Extension granted filesystem and network access without adequate integrity controls |
Impact Assessment
Up to 5,000 developer workstations may have been compromised. Developers represent a high-value target: their machines typically hold cloud credentials, source code, API tokens, and access to CI/CD pipelines. Even where the SSH service could not be enabled (most macOS and Windows hosts without admin rights), the attacker’s SSH key remains installed and persistence mechanisms are active. The recon beacon also provides enough metadata to prioritise high-value targets for follow-on manual access.
Mitigation & Recommendations
- Update immediately to Claude Code v2.1.314 from the official marketplace.
- Purge the rogue SSH key: remove any entry labelled
svc-telemetryfrom~/.ssh/authorized_keys. - Remove persistence: delete associated scheduled tasks (Windows), crontab entries (Linux), or LaunchAgents (macOS).
- Rotate credentials: treat all secrets and API tokens on affected machines as compromised; rotate immediately.
- Network block: add
134.209.82.225to firewall blocklists and audit historical DNS/HTTP logs for beacon traffic. - Audit extension provenance: enforce extension allowlisting in enterprise VS Code/Cursor deployments.