Markdown edition

# Malicious Claude Code extension in Cursor

> Cursor reports a malicious extension.

By BIGCHANGE.AI Editorial

Published: 2026-10-30T16:54:39.148Z
Updated: 2026-10-30T16:54:39.148Z
Canonical: https://bigchange.ai/blog/cursor-claude-code-extension-ssh-backdoor-attempt

![AI-generated conceptual illustration of a laptop and abstract software extension shapes, one highlighted orange.](https://bigchange.ai/api/media/file/claude-extension-concept.png)
AI-generated conceptual illustration by BIG CHANGE; not an image of the incident or a software interface.

[Cursor says](https://cursor.com/blog/claude-code-extension-security-notice) malicious Claude Code extension 2.1.313 was available in its marketplace October 29 between approximately 2:27 a.m. and 1:35 p.m. Pacific time. Anyone who installed or updated that build there should check. At most 5,000 were affected; Anthropic did not develop it.

## The big change

- Extensions can execute code before a conversation. Installation source and version determine exposure.
- Failed SSH activation can limit access, while other changes still need investigation.
- Updating alone cannot establish whether startup items remain or an account was accessed.

## What the code attempted

[OpenSourceMalware](https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor) analyzed a loader ahead of normal extension code. Its page claims an Open VSX source but says the analyzed directory’s provenance is unestablished. It does not independently identify Cursor’s distributed package. Cursor separately reports similar backdoor and persistence attempts. Without administrator rights, SSH activation fails on most macOS and Windows hosts, it says; other actions can succeed.

The researchers describe activation without a conversation, an attempted SSH key and tunnel, and persistence via a macOS LaunchAgent or Windows task with Startup fallback. The initial beacon includes credential-related variable names, not values; static analysis found no additional executable download.

[OpenSSH documentation](https://man.openbsd.org/sshd.8) describes an authorized keys file as a list of public keys usable to log in as a user. [Remote forwarding](https://man.openbsd.org/ssh_config#RemoteForward) directs connections arriving at a remote port over the SSH connection to a chosen destination. These are separate functions: access authorization and a route to a service. The service must accept the key and be reachable through the route for a login to work; a key in a file on its own does not show that a login happened.

[Apple’s archived documentation](https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html) describes user agents loaded by the system when a user logs in. [Windows Task Scheduler](https://learn.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler) can start a program when specified conditions occur.

The entry route, attacker identity and successful logins remain unknown.

## Who should check

Cursor removed the build and rebuilt the marketplace; it says the attacker server is offline. Its notice provides `svc-telemetry` checks and remediation.

In its [ransomware response guidance](https://learn.microsoft.com/en-us/security/ransomware/incident-response-playbook-dart-ransomware-approach), Microsoft recommends isolating compromised systems while preserving them for investigation. That advice is general incident-response context, not a finding that ransomware was involved here. A team can review available endpoint and network records, preserve relevant evidence and decide whether a rebuild is appropriate; records can only show events they captured.

[Socket's registry investigation](https://www.socket.dev/blog/claude-code-extension-compromise) found no corresponding Open VSX publication or removal records. Cursor found no evidence other versions or official distribution were affected.

BIG CHANGE reviewed public reports and did not download or execute the extension.

## Sources

- [Cursor security notice](https://cursor.com/blog/claude-code-extension-security-notice) — Cursor’s incident scope, indicators, detection and remediation; company account.
- [OpenSourceMalware: Trojanized Claude Code extension](https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor) — Independent static analysis of an artifact; its page presents inconsistent claims about provenance.
- [Socket: Cursor removes malicious Claude Code extension](https://www.socket.dev/blog/claude-code-extension-compromise) — Independent registry investigation and assessment of early distribution claims.
- [OpenSSH manual: sshd and remote forwarding](https://man.openbsd.org/sshd.8) — OpenSSH documentation describes authorized keys; its SSH configuration manual explains remote forwarding.
- [OpenSSH configuration: RemoteForward](https://man.openbsd.org/ssh_config#RemoteForward) — OpenSSH remote forwarding mechanics; both manual entries count as one underlying work.
- [Apple: Creating Launch Daemons and Agents](https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html) — Archived Apple documentation explains per-user launch agents and launchd.
- [Microsoft: About the Task Scheduler](https://learn.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler) — Windows documentation explains event-triggered programs.
- [Microsoft: Incident response ransomware approach](https://learn.microsoft.com/en-us/security/ransomware/incident-response-playbook-dart-ransomware-approach) — Ransomware response guidance used only for general isolation and preservation principles.