Claude Code extension hacked: SSH backdoor puts 5,000 Cursor users potentially at risk
A popular AI coding tool has found itself at the centre of a serious cybersecurity scare. A malicious version of Anthropic’s Claude Code extension reportedly allowed attackers to install a hidden backdoor on developers’ computers. The modified extension, identified as version 2.1.313, contained code capable of opening remote access to affected machines. The worrying part? Developers did not even need to start a conversation with Claude for the malicious code to run.
The incident came to light on October 30, 2026, after security researchers examined a suspicious extension distributed through the Open VSX registry. AI coding company Cursor identified a maliciously modified Claude Code extension on its extension marketplace, potentially affecting up to 5,000 users. Researchers say the malicious code could give attackers lasting access to a developer’s computer.
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the https://t.co/sJRGX5jLXW, Grok Bot, Grok or our other SpaceXSI products.
In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk.
If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314: https://t.co/ESqf7YEtHZ
— Cursor (@cursor_ai) October 30, 2026
What happened to the Claude Code extension?
According to cybersecurity researchers at OpenSourceMalware, attackers inserted 66 lines of malicious JavaScript ahead of the extension’s legitimate code.
Once the extension loaded, the hidden instructions attempted to modify the computer’s SSH settings.
SSH, or Secure Shell, is a technology that allows users to access another computer remotely. Developers commonly use it to manage servers and software projects.
The malicious code reportedly added an attacker-controlled SSH key, attempted to activate remote access and established a connection to an external server.
It could restart itself after a reboot, making the infection harder to remove.
How dangerous was the malicious extension?
| Details | Findings |
|---|---|
| Affected extension | Claude Code |
| Identified version | 2.1.313 |
| Malware type | Persistent SSH backdoor |
| Potentially affected Cursor users | Up to 5,000 |
| Systems targeted by code | Windows, macOS and Linux |
| Confirmed data theft | Not established |
Researchers found that the malware could collect the computer’s username, operating system, public IP address and other system information.
A successful remote connection could potentially expose source code, credentials and sensitive development projects.
What has Cursor said?
Cursor confirmed that the tampered extension was available on its marketplace on October 29, between approximately 2:27 AM and 1:35 PM Pacific Time.
The company told Reuters that the malicious extension was not developed by Anthropic.
Cursor said the attack attempted to gather information about users and establish remote access. A key part of the attack would have failed on most computers since it required administrator permissions.
After detecting the incident, Cursor removed the malicious extension, blocked further distribution and temporarily shut down its marketplace. The company subsequently rebuilt and reopened the service.
Cursor said other marketplace extensions were unaffected.
What has Anthropic said?
As of October 30, Anthropic had not issued a public response to the incident.
Researchers have confirmed malicious code in the Open VSX version they examined. They have not established that Anthropic’s official distribution systems were compromised.
The identity of the attackers and how they managed to distribute the modified extension remain unknown.
What is the impact, and what should developers do?
The incident is particularly concerning for developers working with private company repositories, cloud servers and software credentials.
Someone with access to a developer’s computer could potentially obtain confidential code or use stored credentials to attack other systems.
Users who installed Claude Code extension version 2.1.313 should check their computers for suspicious SSH access and seek a security review. Simply deleting an infected extension may leave behind changes made by the malware.
The incident shows how a compromised coding extension can threaten systems even before someone starts using its AI features.