Malicious Claude Code Extension Distributed Through Cursor Marketplace

Summary

Cursor reported that malicious Claude Code extension version 2.1.313 was available in its marketplace for about 11 hours. Phorion found it attempted to install an SSH backdoor; Cursor estimated up to 5,000 users were affected.

Key points

Cursor reported the malicious extension was available from approximately 09:27 to 20:35 UTC on October 29, 2026, and identified affected macOS and Windows packages.
Cursor estimated that up to 5,000 users were affected.
Phorion found the extension attempted to add an attacker-controlled SSH key to authorized_keys and open a reverse SSH tunnel to 134.209.82[.]225.
The extension also attempted to establish persistence and send host details to the attacker.
Coding errors caused SSH enablement to fail on most macOS and Windows hosts.
Sophos recommends checking for version 2.1.313 during the exposure window; uninstalling the extension alone does not remove the backdoor. Remove the SSH key, persistence mechanisms, and tunnel processes, and rotate accessible credentials.

Article Details

Event Type: Malicious extension distributed through the Cursor extension marketplace.
Impact: A malicious version of Anthropic’s Claude Code extension (2.1.313) was available from approximately 09:27 to 20:35 UTC on October 29, 2026. Cursor estimated that up to 5,000 users were affected. The extension attempted to add an attacker-controlled SSH key, establish a reverse SSH tunnel, persist on hosts, and send host details to the attacker. Coding errors reportedly caused SSH enablement to fail on most macOS and Windows hosts.

Indicators of compromise

Type	Indicator	Context
IPV4	`134[.]209[.]82[.]225`	Attacker-controlled endpoint targeted by the extension for a reverse SSH tunnel.

MITRE ATT&CK

T1098.004 · SSH Authorized KeysThe extension attempts to add an attacker-controlled SSH key to authorized_keys.T1572 · Protocol TunnelingThe extension attempts to establish a reverse SSH tunnel.

Vendors

AnthropicOn October 29, 2026, Cursor reported that a malicious version of Anthropic’s Claude Code extension (2.1.313) was available in the Cursor extension marketplace between approximately 09:27 and 20:35 UTC. Cursor identified CursorOn October 29, 2026, Cursor reported that a malicious version of Anthropic’s Claude Code extension (2.1.313) was available in the Cursor extension marketplace between approximately 09:27 and 20:35 UTC. Cursor identified SophosSophos X-Ops recommends that organizations identify hosts running Cursor and check if version 2.1.313 was installed during the exposure window. Uninstalling the extension leaves the backdoor in place, so organizations

Products

Claude Code extensionOn October 29, 2026, Cursor reported that a malicious version of Anthropic’s Claude Code extension (2.1.313) was available in the Cursor extension marketplace between approximately 09:27 and 20:35 UTC. Cursor identified CursorOn October 29, 2026, Cursor reported that a malicious version of Anthropic’s Claude Code extension (2.1.313) was available in the Cursor extension marketplace between approximately 09:27 and 20:35 UTC. Cursor identified Sophos AI DefenseIn addition, Sophos is searching customer telemetry for reported indicators and using Sophos AI Defense to identify internal devices that have Cursor installed.