Security firm Phorion claims that a tampered version of Anthropic’s “Claude Code” extension, intended for Visual Studio Code-compatible editors, would have installed an SSH backdoor on developers’ computers. According to the publisher Cursor, which distributed this version, up to 5,000 users may have been affected.
The malicious package, numbered 2.1.313, appeared on Open VSX, an open-source extension platform managed by the Eclipse Foundation. Publishers like Cursor and Windsurf, which rely on Visual Studio Code’s codebase, use this store because the default store, Microsoft’s Visual Studio Marketplace, is reserved for its own products. No malicious version has been reported there. According to Cursor, the tampered version remained available in its store for about 11 hours on October 29, 2026.
A hidden access installed on the machine
Anthropic is a U.S. AI company whose flagship product is Claude, a series of large language models (LLMs). The malicious code, however, was not developed by the company. According to Cursor, it was added to a version of the extension that was not its own.
According to Phorion, the malicious payload adds the attacker’s SSH key to the machine’s authorized keys. SSH is a secure remote connection protocol: an authorized key allows connection to the computer without a password. The software then opens a tunnel to the attacker’s server, which can thus reconnect to the machine. The tunnel remains active after the editor is closed, and the software attempts to re-establish the connection approximately every 60 seconds. It also implements mechanisms allowing it to survive a reboot on Mac, Linux, and Windows.
According to Phorion, the extension transmits to the attacker’s server the machine name, username, operating system, working directory, Git email address, and public IP address. It also sends the names, but not the values, of up to 40 environment variables that resemble keys, tokens, passwords, or AWS and GCP credentials. “This list provides the operator with an inventory of hosts containing cloud credentials or API tokens,” emphasized Calum Hall, CEO of Phorion.
On macOS, the key only works if the SSH service is active, which is often not the case. Phorion attributes this limitation to a faulty check in the script but clarifies that it does not constitute protection. “The user does not need to interact with the extension for the payload to trigger,” added Calum Hall.
Cursor’s response
In a security advisory, Cursor states that it removed the malicious version, closed its store as a precaution, audited accesses, and renewed its keys. The company says it found no other tampered extensions. It worked with the cloud service provider hosting the attacker’s server to take it offline, which interrupted the tunnel and data transmission. Cursor rebuilt its store and put it back online “after ensuring there was no further risk,” the company said on X.
Cursor also claims that no other version of the extension or the official distribution was affected, to its knowledge. According to the publisher, enabling SSH requires administrator privileges that the extension does not obtain on most Mac and Windows machines, which would limit the attacker’s access on these systems.
Checks to perform
Phorion warns that uninstalling the extension does not remove the backdoor. Cursor indicates that the malicious payload drops standalone scripts that continue to run. Anyone who installed or updated the extension to version 2.1.313 should therefore check if their SSH authorized keys file contains an entry titled “svc-telemetry”. Cursor has published verification commands as well as cleanup scripts for macOS and Windows. Both companies have also shared indicators of compromise.
