{
  "@context": "https://schema.org",
  "@type": "Report",
  "url": "https://optimuslabs.io/research/briefings/claude-code-extension-cursor-marketplace-backdoor",
  "identifier": "claude-code-extension-cursor-marketplace-backdoor",
  "headline": "Claude Code Extension: The Update Was the Backdoor",
  "name": "Claude Code Extension: The Update Was the Backdoor",
  "abstract": "Tampered builds of the Claude Code extension, 2.1.312 and 2.1.313, sat in Cursor's extension store for about 11 hours under the real publisher ID. Up to 5,000 developers installed them as a normal update. Anthropic did not build them.",
  "description": "For about 11 hours on Oct 29, Cursor's extension store served tampered builds of Anthropic's Claude Code extension under its real publisher ID, anthropic.claude-code. It was not a typosquat. Editors set to auto-update installed it with no click. A 66-line loader ran as soon as Cursor opened: it added an attacker SSH key, set itself to restart on every boot, reported the host and the names of secret environment variables, and kept trying to open a tunnel to 134.209.82.225. A bug stopped the attacker logging in on most machines. The next one may not make that mistake.",
  "datePublished": "2026-10-29",
  "dateModified": "2026-10-29",
  "inLanguage": "en",
  "isAccessibleForFree": true,
  "author": {
    "@type": "Organization",
    "name": "Optimus Labs · Civilizations",
    "url": "https://optimuslabs.io/research/briefings"
  },
  "publisher": {
    "@type": "Organization",
    "name": "Optimus Labs",
    "url": "https://optimuslabs.io"
  },
  "keywords": [
    "Cursor",
    "Anthropic",
    "Microsoft",
    "Plugin",
    "Package",
    "Credential",
    "agentic AI security",
    "AI agent supply chain"
  ],
  "about": [
    {
      "@type": "Thing",
      "name": "Cursor"
    },
    {
      "@type": "Thing",
      "name": "Anthropic"
    },
    {
      "@type": "Thing",
      "name": "Microsoft"
    }
  ],
  "citation": [
    {
      "@type": "CreativeWork",
      "name": "Cursor: Security notice, malicious Anthropic.claude-code 2.1.312 and 2.1.313 (Oct 29, 2026)",
      "url": "https://cursor.com/blog/claude-code-extension-security-notice"
    },
    {
      "@type": "CreativeWork",
      "name": "Phorion: Official Claude Code extension compromise, security advisory (Oct 30, 2026)",
      "url": "https://phorion.io/blog/offical-claude-code-vsx-compromise/"
    },
    {
      "@type": "CreativeWork",
      "name": "OpenSourceMalware: Trojanized Claude Code extension plants an SSH backdoor (Oct 30, 2026)",
      "url": "https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor"
    },
    {
      "@type": "CreativeWork",
      "name": "Microsoft Security: Inside a malicious Claude Code-branded extension (Oct 30, 2026)",
      "url": "https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/"
    },
    {
      "@type": "CreativeWork",
      "name": "Wired: A supply chain attack put malicious Claude extensions on thousands of devices (Oct 30, 2026)",
      "url": "https://www.wired.com/story/trojan-malware-targets-thousands-of-anthropic-claude-developer-systems/"
    },
    {
      "@type": "CreativeWork",
      "name": "Socket: Cursor removes malicious Claude Code 2.1.313 extension (Oct 30, 2026)",
      "url": "https://socket.dev/blog/claude-code-extension-compromise"
    },
    {
      "@type": "CreativeWork",
      "name": "Ars Technica: Anthropic VS Code extension on Cursor backdoored for nearly 12 hours (Oct 30, 2026)",
      "url": "https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/"
    },
    {
      "@type": "CreativeWork",
      "name": "Hacker News: Anthropic's Felix Rieseberg on the incident",
      "url": "https://news.ycombinator.com/item?id=50300683"
    }
  ],
  "encoding": [
    {
      "@type": "MediaObject",
      "encodingFormat": "text/markdown",
      "contentUrl": "https://optimuslabs.io/research/briefings/claude-code-extension-cursor-marketplace-backdoor.md"
    },
    {
      "@type": "MediaObject",
      "encodingFormat": "application/json",
      "contentUrl": "https://optimuslabs.io/research/briefings/claude-code-extension-cursor-marketplace-backdoor.json"
    }
  ],
  "additionalProperty": [
    {
      "@type": "PropertyValue",
      "name": "severity",
      "value": "HIGH · TAMPERED PACKAGE, NO CVE"
    },
    {
      "@type": "PropertyValue",
      "name": "blastRadius",
      "value": "Every developer machine that ran Cursor with the Claude Code extension between 09:27 and 20:35 UTC on Oct 29, 2026, on macOS or Windows: up to 5,000 users per Cursor. The prize is what those laptops reach: source code, cloud keys, Git and CI tokens, SSH keys and package publish tokens."
    }
  ],
  "briefing": {
    "slug": "claude-code-extension-cursor-marketplace-backdoor",
    "number": 16,
    "title": "Claude Code Extension: The Update Was the Backdoor",
    "dek": "Tampered builds of the Claude Code extension, 2.1.312 and 2.1.313, sat in Cursor's extension store for about 11 hours under the real publisher ID. Up to 5,000 developers installed them as a normal update. Anthropic did not build them.",
    "tldr": "As of Nov 2, 2026. Someone with publish access to Cursor's extension store shipped tampered Claude Code builds that ran when Cursor opened, added an attacker SSH key, set up a startup item that survives uninstall, and reported which secrets the laptop held. Check every Cursor machine, block 134.209.82.225 and rotate credentials from a clean computer.",
    "date": "2026-10-29",
    "severity": "high",
    "severityLabel": "HIGH · TAMPERED PACKAGE, NO CVE",
    "types": [
      "plugin",
      "package",
      "credential"
    ],
    "relatedUseCase": "shadow-agent-discovery",
    "vendors": [
      "Cursor",
      "Anthropic",
      "Microsoft"
    ],
    "blastRadius": "Every developer machine that ran Cursor with the Claude Code extension between 09:27 and 20:35 UTC on Oct 29, 2026, on macOS or Windows: up to 5,000 users per Cursor. The prize is what those laptops reach: source code, cloud keys, Git and CI tokens, SSH keys and package publish tokens.",
    "summary": "For about 11 hours on Oct 29, [Cursor's extension store served tampered builds](https://cursor.com/blog/claude-code-extension-security-notice) of Anthropic's Claude Code extension under its real publisher ID, anthropic.claude-code. It was not a typosquat. Editors set to auto-update installed it with no click. A 66-line loader ran as soon as Cursor opened: it added an attacker SSH key, set itself to restart on every boot, reported the host and the names of secret environment variables, and kept trying to open a tunnel to 134.209.82.225. A bug stopped the attacker logging in on most machines. The next one may not make that mistake.",
    "whatHappened": [],
    "whyItMatters": [],
    "whatToDo": [
      "On every Cursor machine, run `grep svc-telemetry ~/.ssh/authorized_keys` and remove the key if it is there.",
      "Collect evidence before you remove anything: the extension folder, startup items, the files below and SSH logs.",
      "Look for the startup item: `~/Library/LaunchAgents/com.apple.sysmond.plist` on macOS, a crontab `@reboot` line pointing at `~/.config/.smt` on Linux, or a SysMon scheduled task or Startup-folder `sysmon.cmd` on Windows. Check what each one runs before you delete it; the names copy real monitoring tools. Uninstalling the extension does not remove them.",
      "Delete the dropped scripts and keys: `~/.config/.smt` and `~/.config/.smtk` (macOS and Linux), `%USERPROFILE%\\.config\\smt.cmd` and `smtk` (Windows), and any temporary `.stk_` file. On Windows, also check `C:\\ProgramData\\ssh\\administrators_authorized_keys` for svc-telemetry.",
      "Block 134.209.82.225 at the network edge and alert on outbound traffic to ports 22 and 8099.",
      "Rotate passwords, cloud keys, Git and CI tokens and package publish tokens from a clean computer, not the affected one.",
      "Update the extension to 2.1.314 or later, and decide whether agent extensions should auto-update at all."
    ],
    "narrativeSections": [
      {
        "heading": "What happened",
        "paragraphs": [
          "Between 09:27 and 20:35 UTC on Oct 29, 2026, Cursor's own extension store offered Claude Code 2.1.312 and 2.1.313 for macOS and Windows. Both carried Anthropic's genuine publisher ID. [Cursor](https://cursor.com/blog/claude-code-extension-security-notice) says at most 5,000 users got them and that Anthropic did not develop them.",
          "The bundle was the real extension with a [66-line loader added in front of it](https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor). The loader ran when the extension loaded, which happens every time Cursor starts. No Claude chat was needed.",
          "How the attacker got publish access to Cursor's store has not been disclosed. Cursor pulled both versions, shut down and rebuilt the store, rotated its keys and worked with the hosting provider to take the attacker's server offline."
        ]
      },
      {
        "heading": "What the implant did",
        "paragraphs": [
          "Per [Phorion](https://phorion.io/blog/offical-claude-code-vsx-compromise/) and [Microsoft](https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/), it appended an attacker key labelled svc-telemetry to ~/.ssh/authorized_keys and tried to switch on the local SSH service. It installed a startup item, a LaunchAgent called com.apple.sysmond on macOS or a SysMon scheduled task on Windows, that retried a reverse SSH tunnel about every 60 seconds.",
          "Microsoft found Linux code as well: a user crontab `@reboot` entry. Cursor says its store served macOS and Windows builds, so treat any Linux machine with the extension as worth a check. On Windows, a batch file in the Startup folder is the fallback if the scheduled task fails.",
          "It downloads nothing else. It uses autossh where present, silences every error and leaves the extension working, so the user sees nothing wrong. The tunnel points back at the laptop's own SSH port, so the attacker connects in through a connection the laptop opened.",
          "It also sent the hostname, username, OS, home and working directories, Git email, public IP and the names (not the values) of up to 40 environment variables that look like keys, tokens or cloud credentials to the attacker's server on port 8099.",
          "The saving grace: enabling SSH needs admin rights, and coding errors meant that step failed on most Macs and Windows machines. The key, the startup item and the report still landed, so every affected machine needs cleaning."
        ]
      },
      {
        "heading": "Why laptops running agents are easier targets",
        "paragraphs": [
          "More access. A coding agent reads your files, runs your terminal and uses your credentials. Anything hiding inside it gets the same reach.",
          "More ways in. Each agent brings extensions, plugins, MCP servers and SKILLs, each updating from a store you do not control.",
          "Less scrutiny. Teams approve the tool once. Every update after that installs on its own. Approve an agent once, and you have approved every update it takes."
        ]
      },
      {
        "heading": "Why threat feeds were late",
        "lede": "Civilizations timeline, UTC.",
        "paragraphs": [
          "Oct 29, 09:27: tampered 2.1.312 and 2.1.313 go live in Cursor's store. 20:27: Daylight sees the tunnel start on a customer's Mac. 20:35: Cursor pulls both versions. Oct 30: OpenSourceMalware lists it (2.1.313 only). Oct 30, 07:59: ThreatFox lists the attacker's server. Oct 31, 02:00: still no entry in OSV.",
          "The bad builds used the same name and version numbers as the real releases. Only the bytes changed. A feed that matches on name and version cannot flag the bad copy without flagging the clean one, and Cursor's store is not one of the registries OSV tracks.",
          "What caught it first was behaviour on real laptops, seen by Phorion, Daylight and Coralogix. A code editor extension had no reason to add a login key, create a startup item or open a tunnel to an unknown server."
        ]
      },
      {
        "heading": "What it was not",
        "paragraphs": [
          "Not a compromise of Anthropic's systems, per [Anthropic's Felix Rieseberg](https://news.ycombinator.com/item?id=50300683) and Microsoft. Not served by Open VSX, the Microsoft VS Code Marketplace or the @anthropic-ai/claude-code npm package; an early report naming Open VSX was corrected, as [Socket](https://socket.dev/blog/claude-code-extension-compromise) documents. We found no link to the Mar 2026 Claude Code source leak.",
          "Socket's records show why the Open VSX claim did not hold. Open VSX keeps a permanent change log. From Oct 27 it lists all eight builds of 2.1.312 and 2.1.314, and nothing for 2.1.313. In the same window it kept both the publish and removal events for 42 other pulled versions, one gone after about 90 seconds. npm's publish history also jumps from 2.1.312 to 2.1.314, and so do Anthropic's GitHub releases. A skipped number proves nothing on its own; other numbers are skipped too.",
          "Socket also found that the download sizes in the first report's screenshot match 2.1.314 exactly. The lesson for responders: confirm the channel against the store owner's notice and the store's own records before acting on an early report."
        ]
      }
    ],
    "vendorPerspective": {
      "heading": "How Optimus Labs helps on a day like Oct 29",
      "paragraphs": [
        "Optimus Labs keeps a live inventory of the agent assets on every developer machine: agents, their extensions and plugins, MCP servers and SKILLs, with versions and owners. When a bad build is named, you know in minutes who has it and what that machine can reach.",
        "Behaviour detection flags the actions that gave this one away: an editor extension writing to ~/.ssh, adding a startup item or opening a tunnel to an unknown host."
      ]
    },
    "mitre": [
      {
        "id": "T1195.002",
        "name": "Compromise Software Supply Chain",
        "url": "https://attack.mitre.org/techniques/T1195/002/"
      },
      {
        "id": "T1098.004",
        "name": "Account Manipulation: SSH Authorized Keys",
        "url": "https://attack.mitre.org/techniques/T1098/004/"
      },
      {
        "id": "T1543.001",
        "name": "Create or Modify System Process: Launch Agent",
        "url": "https://attack.mitre.org/techniques/T1543/001/"
      },
      {
        "id": "T1053.003",
        "name": "Scheduled Task/Job: Cron",
        "url": "https://attack.mitre.org/techniques/T1053/003/"
      },
      {
        "id": "T1053.005",
        "name": "Scheduled Task/Job: Scheduled Task",
        "url": "https://attack.mitre.org/techniques/T1053/005/"
      },
      {
        "id": "T1547.001",
        "name": "Boot or Logon Autostart Execution: Startup Folder",
        "url": "https://attack.mitre.org/techniques/T1547/001/"
      },
      {
        "id": "T1572",
        "name": "Protocol Tunneling",
        "url": "https://attack.mitre.org/techniques/T1572/"
      }
    ],
    "sourcing": {
      "confirmed": [
        "Cursor: tampered 2.1.312 and 2.1.313 served 09:27 to 20:35 UTC on Oct 29, up to 5,000 users, not developed by Anthropic.",
        "Phorion, OpenSourceMalware, Microsoft: SSH key, startup persistence, reverse tunnel and host report to 134.209.82.225.",
        "Microsoft: Linux crontab persistence, Windows Startup-folder fallback, and the .smt, .smtk and .stk_ files.",
        "Socket: no Open VSX change-log or npm publish record for 2.1.313.",
        "Wired: Phorion first spotted it running on a customer's Mac.",
        "Cursor and Phorion: SSH enablement fails without admin rights on most macOS and Windows hosts."
      ],
      "assessed": [
        "Optimus Labs: the feed timeline above is our reconstruction from public listings.",
        "No public reports of tunnel logins, stolen credentials or a second-stage payload as of Nov 2, 2026.",
        "No CVE assigned; this is a tampered package."
      ]
    },
    "indicators": [
      "anthropic.claude-code 2.1.312 or 2.1.313 installed from Cursor's store",
      "SSH key with comment svc-telemetry in ~/.ssh/authorized_keys",
      "~/Library/LaunchAgents/com.apple.sysmond.plist (macOS); scheduled task or Startup script SysMon (Windows); crontab @reboot entry (Linux)",
      "~/.config/.smt, ~/.config/.smtk, temporary .stk_ files; %USERPROFILE%\\.config\\smt.cmd and smtk; Startup folder sysmon.cmd",
      "Outbound traffic to 134.209.82.225 on ports 22 or 8099",
      "extension.js SHA-256 starting ecb58cb2 and ending 3ab6bf15"
    ],
    "faq": [
      {
        "q": "Was I affected by the tampered Claude Code extension?",
        "a": "Only if Cursor installed Claude Code 2.1.312 or 2.1.313 from its own store between 09:27 and 20:35 UTC on Oct 29, 2026. Check ~/.ssh/authorized_keys for svc-telemetry and look for the com.apple.sysmond, SysMon or crontab @reboot startup item."
      },
      {
        "q": "Was Anthropic breached?",
        "a": "No. Anthropic and Cursor say the builds were published through Cursor's store, not built by Anthropic. The VS Code Marketplace, Open VSX and the npm package were not affected."
      },
      {
        "q": "Does uninstalling the extension remove the backdoor?",
        "a": "No. The SSH key, the startup item and the files in ~/.config stay on the machine. Collect evidence, remove them, block 134.209.82.225 and rotate credentials from a clean computer."
      }
    ],
    "sources": [
      {
        "label": "Cursor: Security notice, malicious Anthropic.claude-code 2.1.312 and 2.1.313 (Oct 29, 2026)",
        "url": "https://cursor.com/blog/claude-code-extension-security-notice"
      },
      {
        "label": "Phorion: Official Claude Code extension compromise, security advisory (Oct 30, 2026)",
        "url": "https://phorion.io/blog/offical-claude-code-vsx-compromise/"
      },
      {
        "label": "OpenSourceMalware: Trojanized Claude Code extension plants an SSH backdoor (Oct 30, 2026)",
        "url": "https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor"
      },
      {
        "label": "Microsoft Security: Inside a malicious Claude Code-branded extension (Oct 30, 2026)",
        "url": "https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/"
      },
      {
        "label": "Wired: A supply chain attack put malicious Claude extensions on thousands of devices (Oct 30, 2026)",
        "url": "https://www.wired.com/story/trojan-malware-targets-thousands-of-anthropic-claude-developer-systems/"
      },
      {
        "label": "Socket: Cursor removes malicious Claude Code 2.1.313 extension (Oct 30, 2026)",
        "url": "https://socket.dev/blog/claude-code-extension-compromise"
      },
      {
        "label": "Ars Technica: Anthropic VS Code extension on Cursor backdoored for nearly 12 hours (Oct 30, 2026)",
        "url": "https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/"
      },
      {
        "label": "Hacker News: Anthropic's Felix Rieseberg on the incident",
        "url": "https://news.ycombinator.com/item?id=50300683"
      }
    ],
    "image": "/research/diagrams/claude-code-extension-cursor-backdoor.png",
    "imageAlt": "Trust-boundary diagram by Civilizations. Zone one, attacker: an unknown actor with publish access to Cursor's store, the genuine extension plus a 66-line loader, and the offline C2 at 134.209.82.225. Zone two, trusted store: Cursor's marketplace serving both builds under the real ID for about 11 hours; Open VSX ruled out. Zone three, developer workstation: the code loads when Cursor opens, adds the svc-telemetry key, adds a startup item and calls home with host details and secret env var names. The prize: source code, cloud keys, Git and CI tokens, SSH keys and publish tokens. Panels cover root cause, evidence and fleet checks.",
    "pdfUrl": "/__l5e/assets-v1/1286899f-400f-4e9d-83f5-289b771849c2/claude-code-extension-cursor-backdoor-brief.pdf",
    "featured": true
  }
}