unixshadow — cursor-backdoor

The Cursor Marketplace Backdoor

A trusted editor extension auto-updated, and a stranger’s SSH key quietly moved into authorized_keys. No click, no prompt, no broken assistant to warn you.

On October 29, 2026, maliciously modified builds of Anthropic’s Claude Code extension were served through Cursor’s extension marketplace for about eleven hours, roughly 09:27 to 20:35 UTC. Cursor says at most 5,000 users received them. The affected versions were 2.1.312 and 2.1.313, for macOS and Windows. The fixed version is 2.1.314. No CVE has been assigned.

Anthropic says its own systems were not compromised, and the tampered builds were never on Microsoft’s Visual Studio Marketplace, the npm package, or Open VSX. All evidence so far points to Cursor’s marketplace alone. How the attacker obtained publishing access there has not been explained.

HOW IT WORKED

The malicious code was a short loader prepended to the extension’s main JavaScript file, ahead of the legitimate code. It ran as soon as Node loaded the extension, before the extension’s normal activation — so the user did not need to interact with anything, and the assistant kept working normally afterwards. That is the part that should worry you: nothing looked broken.

1. SSH keyAn attacker-controlled Ed25519 key, comment svc-telemetry, appended to ~/.ssh/authorized_keys.

2. Reverse tunnelAn outbound SSH connection to 134.209.82.225, using an embedded tunnel key, asking for a forwarded port back to the victim’s port 22.

3. PersistencemacOS LaunchAgent, Linux cron entry, and a Windows scheduled task, so the backdoor survived closing the editor.

4. Recon beaconA plaintext HTTP beacon carrying hostname, username, OS, public IP, git email, and the names (not values) of up to 40 environment variables matching KEY, TOKEN, SECRET, PASS, AWS, or GCP.

The beacon sending names rather than values is not a kindness — it is a shopping list. It tells the operator which machines hold interesting credentials, and where to look next.

THE SPLIT VERDICT ON BLAST RADIUS

Two implementation bugs blunted the attack, and neither is a defence. On macOS, the code’s check for Remote Login exits successfully even on a permissions error, so it skipped turning SSH on where it was already off. On Windows, the step to install the OpenSSH server is likely to fail on a standard install, and the scheduled task only ran from elevated sessions. So on many machines the tunnel could only connect where SSH was already running — but the planted key and the persistence mechanism were still installed regardless. A machine that later enables SSH, or already had it on, was fully exposed.

Cursor’s notice lists macOS and Windows as the affected platforms. The implant itself also carries Linux persistence logic, which is why you will see “all three OSes” in some write-ups. Read that as: code for three platforms, confirmed distribution on two. Check Linux machines too if they touched Cursor in the window; do not let the platform list talk you out of checking.

Uninstalling the extension does not remove the backdoor. The key, the tunnel, and the persistence artefacts survive package removal. If you had either version, treat the machine as compromised until you have checked it, not until you have uninstalled something.

CHECK YOUR MACHINE

$ grep -n svc-telemetry ~/.ssh/authorized_keys

$ ssh-keygen -lf ~/.ssh/authorized_keys

Match on the key fingerprint, not just the comment — a comment is trivial to change. The published fingerprint for the planted key is SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk. Then look for the persistence artefacts: ~/Library/LaunchAgents/com.apple.sysmond.plist and ~/.config/.smt* on macOS, a suspicious @reboot cron entry on Linux, and a “SysMon” scheduled task on Windows. Also check for extension folders named anthropic.claude-code-2.1.31[23]* and for outbound SSH to the address above.

CLEANUP, IN ORDER

Isolate the machine, then kill any SSH process talking to the attacker’s address, remove the planted key by fingerprint, delete the persistence artefacts, and confirm Remote Login was not silently enabled. Then rotate every credential that user account could reach — and do it from a trusted machine, not the compromised one. If the machine held production keys or tokens, assume they are in the shopping-list category and rotate those first.

THE LESSON

Extensions run with the permissions of the editor and its user. That means full access to local files, source code, and developer tooling, with no permission prompt in between. A marketplace is a supply chain, and this one was compromised at the publisher level, not by a typo-squatted package name. The defences that actually help are boring ones: audit authorized_keys on machines you care about, do not run agent tooling as a user with production credentials lying around, keep agent work in a separate account or container where you can, and treat an auto-update to a coding assistant the same way you would treat a deploy — because that is what it is.

Sources: Cursor security notice, Phorion analysis, Microsoft Threat Intelligence analysis, StepSecurity static analysis.Published November 2, 2026