A fake Claude Code extension planted an SSH backdoor in Cursor

What got in

Cursor says it identified a security incident involving Anthropic.claude-code version 2.1.313, a malicious version of the extension that was not developed by Anthropic. The malicious version was available between 2:27am PT and 1:35pm PT on October 29, 2026, and Cursor says at most 5,000 users were affected. The extension runs malicious code that attempts to install a persistent SSH backdoor, collects host and user information including hostname, username, operating system, architecture, home directory path, environment variable names, working directories, Git email, and public IP, and attempts to add an attacker-controlled SSH key to authorized_keys. m:…0875

Persistence, not just access, is the point of the payload. The extension attempts to make the reverse SSH tunnel persistent via a LaunchAgent on macOS, and background scripts retry the tunnel roughly every 60 seconds. The reverse SSH tunnel attempt fails on most systems unless Cursor was started with administrator privileges, which limits the blast radius, but Cursor warns that uninstalling the extension is insufficient because the payload drops standalone persistence scripts. Anyone who installed the version needs to hunt for those scripts, not just remove the extension. m:…0875

How Cursor responded

Cursor says the attacker server at 134.209.82.225 no longer functions, that it worked with the cloud provider to take the malicious server offline, and that it shut down the VSCode Marketplace temporarily for an audit. The company says it rotated its keys and rebuilt the marketplace. The sequence matters: the fix was not only removing the bad extension but rebuilding the distribution channel it came through, because a marketplace that can serve one malicious version can serve another. m:…0875

Why AI services widen the attack surface

The incident lands in a week when the tooling for watching AI services in production is itself expanding. Dynatrace says AI services are becoming a fast-growing attack surface in production environments, and it has introduced a dashboard that surfaces AI service vulnerabilities detected at runtime, integrating findings from Runtime Vulnerability Analytics with AI Observability and focusing on GenAI entities identified from GenAI Smartscape. The dashboard includes a coverage section to identify which AI processes are being scanned, and its summary tiles cover vulnerability findings, unique vulnerabilities, affected processes, and affected packages. Runtime analysis matters here because it reflects vulnerabilities in code that is genuinely loaded and executing, not code that is merely present. m:…4577

Dynatrace is also expanding AI Observability ingestion across coding agents, Python-based LLM applications, and OpenInference-instrumented frameworks. OneAgent now instruments Python-based LLM applications directly, capturing logs, traces, and LLM-specific telemetry without code changes, and the OpenInference specification auto-instruments over 33 frameworks, including LangChain, LlamaIndex, CrewAI, AutoGen, OpenAI, and Anthropic. From February 1, 2027, Dynatrace AI Observability will support three ingest paths: OpenTelemetry-based instrumentation, OpenInference-instrumented applications, and OneAgent, while support for OpenLLMetry ends January 31, 2027. m:…5552

For engineering teams, the practical lesson is narrow and actionable. Treat editor extensions and agent marketplaces as supply chain: pin versions, audit what was installed during the exposure window, and check for persistence mechanisms beyond the extension itself. Runtime vulnerability coverage for AI services, not just static dependency lists, is what would have shown whether the malicious code actually ran. m:…0875