Fake AI coding extension opens a back door to company systems
A tampered version of the Claude Code extension, designed to set up an SSH back door, was distributed through the marketplace of the Cursor code editor for about 11 hours on 29 October; Cursor estimates up to 5,000 users were affected.
The attack targets not the AI model but the channel through which developers install their AI tools. Those affected cannot get rid of the back door simply by uninstalling.
What happened
According to Cursor's security notice, versions 2.1.312 and 2.1.313 of the extension for Windows and macOS were tampered with; they were not produced by Anthropic, which makes Claude Code. The malicious code ran as soon as the extension loaded, with no action by the user. It sent the host name, user name, operating system and public IP address to an attacker's server, added an outside SSH key labelled svc-telemetry and tried to open an outbound tunnel that rebuilds itself roughly every minute and survives a restart. Help Net Security reports that it also read the names, though not the values, of up to 40 environment variables resembling access keys. Switching on SSH requires administrator rights and probably failed on most machines; the key, persistence and data leakage could still succeed. The case was discovered by Phorion, a security firm. Cursor removed the version, rebuilt its marketplace and rotated its own keys. Assessment: reports so far show no confirmed follow-on attacks and no identified perpetrator.
What follows
Developers' machines are valuable to attackers because they hold access to cloud accounts, code repositories and APIs. AI tools run there with broad permissions and are distributed through several marketplaces, not only the maker's own. Every distribution point thus becomes part of a supply chain that companies must check. According to Field Effect, the cause was not a flaw in Claude Code itself but a package published under the genuine identifier. Anthropic released version 2.1.314 on 30 October. Assessment: the case resembles earlier attacks on package registries, but it hits a class of tools that is only now spreading through companies and is often installed without central approval.
What changes in practice
- IT departments
- Machines that installed or updated the extension via Cursor on 29 October are suspect; one marker is the SSH key svc-telemetry.
- Developers
- Uninstalling is not enough because standalone scripts remain; Cursor advises isolating, cleaning and issuing new credentials.
- Companies
- Access to cloud, code and APIs held on affected machines should be treated as possibly exposed until it is renewed.
What to watch
- Whether Cursor discloses the number of machines actually affected
- Further tampered extensions in marketplaces for AI editors
- Signs of misuse of cloud and code access at affected firms
Sources
- Cursor: Claude Code extension security notice
- Phorion: Analyse der kompromittierten Claude-Code-Erweiterung
- Help Net Security: Claude Code extension poisoned with persistent SSH backdoor
- Field Effect: Trojanized Claude Code extension distributed via Cursor marketplace