PulseAugur
EN
LIVE 19:12:07

Malicious Claude Code extension in Cursor marketplace attempted SSH backdoor

By PulseAugur Editorial · [3 sources] ·

A malicious version of the Anthropic.claude-code extension (2.1.313) was distributed through the Cursor VS Code extension Marketplace between October 29, 2026, 2:27 AM PT and 1:35 PM PT. This unauthorized version attempted to install a persistent SSH backdoor by collecting user information, enabling local SSH services, and opening reverse SSH tunnels. While the attacker's server is offline and some backdoor functionalities were hindered by permission errors, users who installed the compromised extension are advised to remove the unauthorized SSH key and persistence mechanisms. AI

IMPACT Compromised AI-powered development tools can lead to widespread security risks for developers and their systems.

RANK_REASON Security incident involving a third-party extension for a development tool.

Read on Mastodon — mastodon.social →

AI-generated summary · Google Gemini · from 3 sources. How we write summaries →

Malicious Claude Code extension in Cursor marketplace attempted SSH backdoor

How we ranked this

Signal score
0 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
Security incident involving a third-party extension for a development tool.
Source corroboration
3 independent sources
Multiple independent publishers reporting the same story raises confidence that it's real and newsworthy.
Topics
product, safety
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
1 days old
Coverage has settled into its steady-state source set.
Coverage growth since scoring
+1 source(s) since last score
New sources have picked up this story since our last re-score. Score will update on the next scoring pass.

Full methodology in our editorial standards.

COVERAGE [3]

  1. The Decoder TIER_1 English(EN) · Matthias Bastian ·

    Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft

    <p><img alt="Logo of Cursor.ai" class="attachment-full size-full wp-post-image" height="800" src="https://the-decoder.com/wp-content/uploads/2024/08/cursor_AI_logo.png" style="height: auto; margin-bottom: 10px;" width="1200" /></p> <p> A tampered Claude Code extension was live on…

  2. HN — claude cli stories TIER_1 English(EN) · meetpateltech ·

    Malicious Claude Code Extension Found in Cursor Marketplace

  3. Mastodon — mastodon.social TIER_1 English(EN) · madrobotblog ·

    A hacked Claude Code extension in Cursor tried to backdoor up to 5,000 developers’ computers A malicious Claude Code extension in Cursor’s marketplace on Oct 29

    A hacked Claude Code extension in Cursor tried to backdoor up to 5,000 developers’ computers A malicious Claude Code extension in Cursor’s marketplace on Oct 29 tried to plant an SSH backdoor on up to 5,000 machines. How to check and clean up. # ClaudeCode # Infosec # AI https://…

    LINKS madrobot.blog/…/cursor-claude-code-extens…

RELATED ENTITIES

RELATED TOPICS