A supply chain attack that struck at the heart of AI-assisted development

On the morning of October 29, 2026, between 2:27 AM and 1:35 PM Pacific Time, a developer who updated the Claude Code extension in the Cursor IDE — or any VS Code-compatible IDE consuming from the Cursor marketplace — received a maliciously modified version of the official extension. The package, identified as `Anthropic.claude-code` version 2.1.313, contained a 66-line loader injected at the beginning of the `extension.js` file that executed a persistent SSH backdoor installation script before loading the extension's legitimate code.

The extension, with more than 40 million global installations, is one of the most popular tools for integrating AI assistants into the development workflow. What began as an apparently simple Trojan scheme — a modified version of a plugin — quickly revealed itself as one of the most sophisticated attacks ever aimed at the AI-assisted development ecosystem.

What the malware did

The malicious payload, as detailed by Phorion in its technical advisory and confirmed by Cursor itself in its security notice, executed a carefully orchestrated infection chain. First, it collected system information: hostname, username, operating system, architecture, home directory path, working directory, configured Git email, and public IP address. It then sent this information — along with the names of up to 40 environment variables containing keywords like "key", "token", or "password" — to the attacker's server at IP address 134.209.82.225.

The most concerning stage was the SSH backdoor installation. The code added an attacker-controlled SSH key to the `~/.ssh/authorized_keys` file, tagging it with the comment `svc-telemetry`. It then attempted to enable the local SSH service and open a reverse SSH tunnel to the attacker's server. The malware installed persistence across all three platforms: on macOS, it created a LaunchAgent at `~/Library/LaunchAgents/com.apple.sysmond.plist`; on Linux, it wrote a shell script at `~/.config/.smt` and added an `@reboot` entry to the user's crontab; on Windows, it attempted to create a scheduled task called `SysMon` and fell back to the Startup folder if the first method failed.

Why attackers couldn't access thousands of machines

Despite the sophistication of the attack, an important technical detail prevented attackers from achieving effective remote access on most compromised machines: the malware code contained a critical error when trying to enable the local SSH service. In almost all macOS and Windows installations, enabling the SSH service requires administrator privileges. Because the malicious extension did not have admin rights, this step failed silently — and consequently, the reverse tunnel was never established.

This means that while the malware had installed the SSH key and persistence mechanisms, attackers likely could not effectively connect to the compromised machines. The exception would be Linux environments, where many developers run IDEs with root privileges or have Remote Login enabled by default, but even in that case the privilege-check error may have prevented the connection.

Phorion, which detected the threat through its behavioral detection tools, described the situation as a rare case of malware that "knows" it failed but continues executing all other steps — sending data, installing persistence, but unable to open the access tunnel. The attacker server was taken offline by the hosting provider involved, ending any remote connection possibility.

The real impact: data collected, not machines breached

The true damage of the incident lies in the data collected and the marks left on machines. Even without remote access, attackers obtained information that could be combined with other sources to reconstruct a developer's profile: username, Git email, workspace, environment variables containing API tokens and keys. Cursor itself confirmed that up to 5,000 users were impacted on its platform, but the extension was also available on Open VSX — the open source extension registry used by VS Codium and other forks — potentially widening the scope.

The unanswered question is how long a modified version of Anthropic's official Claude Code extension remained on the Cursor marketplace and what was the exact scope of data collection. Cursor said the malicious package existed for about 11 hours, but the auto-update extension may have been downloaded by users who did not update during the exact compromise window, but weeks later.

The response and unanswered questions

Cursor's response was immediate: remove the malicious version, shut down the marketplace as a precaution, rotate its keys, rebuild the marketplace, and republish. Anthropic published version 2.1.314 on both Open VSX and the Microsoft VS Code Marketplace. However, the response was criticized for two reasons.

First, Cursor stated that the malicious version "was not developed by Anthropic," which, while technically true, may misleadingly vague. The package was uploaded under Anthropic's verified account, with the same extension ID `anthropic.claude-code`, and distributed through the same official channels — meaning that, for the user, the line between "made by Anthropic" and "distributed by Anthropic" is practically nonexistent.

Second, researchers like Kevin Beaumont of DoublePulsar observed that the replacement versions published by Anthropic do not remove the backdoors and persistence mechanisms already installed. This means developers who installed version 2.1.313 during the compromise window need to manually run remediation scripts and check their systems — auto-update does not solve the problem, it only prevents it from spreading to new users.

The unanswered questions are as troubling as the confirmed facts: how did attackers manage to publish a modified version under Anthropic's verified account? Was the Cursor publishing system compromised, or Anthropic's own account? And what does the attack reveal about the fragility of the trust model that underpins the IDE extension ecosystem in the age of AI?

What is certain is that the software supply chain — already vulnerable by nature — has gained a new layer of complexity when AI tools are distributed through the same channels as any other plugin. The next malicious extension may not make the same SSH error. And the next time, it may be worse.

Sources: Wired, Cursor, The Hacker News

✓ Independent sources cross-checked and verified before publishing