STUPID-2026-0157
Tampered Claude Code VS Code extension distributed through Cursor's marketplace plants SSH backdoors on up to 5,000 developer machines
Why 10/10
Distributed through a public, widely-used marketplace for roughly 11 hours with an estimated exposure of up to 5,000 users across Windows and macOS — mass exposure, not a single organisation. Host-identifying data (hostname, username, OS, Git email, public IP) was already exfiltrated to the attacker's server before Cursor could react, which is permanent exposure regardless of recovery effort afterward. This happened to real developer machines in the wild, not in a test. Held at impact 1 rather than higher because Cursor's notice says the SSH-key and persistence steps would usually fail without administrator privileges, so the backdoor itself was likely only partially effective even though the recon payload was not.
- Scope
- 4/4
- Many organisations or the public: a flaw in a widely used product, mass exposure, a large outage
- Recoverability
- 3/3
- Permanently lost or irreversible, including data that was exposed
- Did it happen
- 2/2
- Happened in real use
- Beyond the user
- 1/1
- Production systems, customers or third parties, or credentials and sensitive personal data
The score is the sum of these four factors. How each factor is scored · scored 2026-11-06
Instruction given
None — no developer action triggered this. Installing or auto-updating the official Claude Code extension (extension ID anthropic.claude-code) through Cursor's VS Code Extension Marketplace was sufficient to receive the tampered build.
Expected behavior
A package published under Anthropic's official extension ID on a marketplace should contain only code Anthropic built and signed. Installing or updating the extension through an official channel should not be able to plant SSH keys, open reverse shells, or exfiltrate host information.
Actual behavior
A malicious actor published tampered builds (versions 2.1.312 and 2.1.313, for darwin-arm64 and win32-x64) of the Claude Code VS Code extension under Anthropic's own extension ID to Cursor's VS Code Extension Marketplace. Cursor's notice says the versions were live for roughly 11 hours on October 29, 2026 (about 2:27am-1:35pm PT) before being pulled. On execution, the tampered extension collected and sent the attacker hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP; it then tried to add an attacker-controlled SSH key (labeled svc-telemetry) to authorized_keys, enable the local SSH service, and open a reverse SSH tunnel, attempting to persist via a macOS LaunchAgent or a Windows SYSTEM-level scheduled task with a Startup-folder fallback, retrying roughly every 60 seconds. Anthropic said the tampered builds were "not developed by Anthropic" and that its own official distribution was unaffected; neither company has publicly explained how the attacker obtained marketplace publishing access.
Damage
Cursor estimates up to 5,000 users could have installed or updated to an affected version during the roughly 11-hour window. The notice states the extension "added the attacker's SSH key, installed persistence, and sent host details to the attacker," and recommends remediating regardless of whether the SSH step actually succeeded, since uninstalling the extension alone may leave the planted key and persistence scripts behind. Cursor pulled the version, shut down and rebuilt its marketplace, rotated its own keys, audited for other tampered extensions (finding none), and worked with the attacker's hosting provider to take the attacker's server offline.
Full write-up
A malicious actor got publishing access to Cursor's VS Code Extension Marketplace and used it to push tampered builds of Anthropic's own Claude Code extension — not a lookalike package, but versions published under Anthropic's real extension ID, anthropic.claude-code. For about 11 hours on October 29, 2026, installing or auto-updating the official extension through Cursor's marketplace could silently fetch a build with a 66-line malicious loader inserted ahead of the legitimate code. On launch it harvested host and user details — hostname, username, OS, architecture, home directory, environment variable names, working directories, Git email, public IP — and sent them to an attacker server, then attempted to write an attacker-controlled SSH key into authorized_keys, enable the local SSH daemon, and open a persistent reverse SSH tunnel, with retry logic and OS-specific persistence (a macOS LaunchAgent, a Windows SYSTEM scheduled task) built in. Cursor's own notice says the SSH and persistence steps "would usually fail without administrator privileges," so the backdoor itself was likely blocked on many machines — but the recon payload needed no elevated privileges and had already reported home before anyone could react. Cursor says up to 5,000 users may have been exposed before it pulled the version, shut down its marketplace, rotated its keys, and got the attacker's server taken offline; Anthropic says the tampered builds were not its own work and its official distribution channels were unaffected. Neither company has said how the attacker got marketplace publishing access in the first place, and Cursor's remediation guidance is blunt about the limits of the obvious fix: uninstalling the extension does not remove a key or persistence script it already planted.
Classification
- Agent
- Claude Code
- Failure mode
- Security Vulnerability
- Root cause
- Other
- Domain
- Security
- OWASP Agentic Top 10 (our mapping)
- ASI04 Agentic Supply Chain Vulnerabilities · ASI05 Unexpected Code Execution (RCE) list
- MIT AI Risk Repository (our mapping)
- 2.2 AI system security vulnerabilities and attacks taxonomy
- Source
- Blog Post
Related incidents
Cite this record
StupidLLM. "STUPID-2026-0157: Tampered Claude Code VS Code extension distributed through Cursor's marketplace plants SSH backdoors on up to 5,000 developer machines." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0157/ (accessed 2026-11-06). CC BY 4.0.
← STUPID-2026-0156By ID
Get told when an agent breaks something
We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.
This database is callable over MCP — query it from inside your agent.