---
title: A fake Claude Code extension planted an SSH backdoor in Cursor
description: Cursor says a malicious version of the Claude Code extension, available for about 11 hours, collected host data and tried to install a persistent backdoor. Uninstalling it is not enough.
canonical: https://hangingcontext.com/stories/2026-10-30/cursor-malicious-extension-supply-chain/
last-updated: 2026-10-30
url: https://hangingcontext.com/stories/2026-10-30/cursor-malicious-extension-supply-chain/
published: 2026-10-30T12:31:15Z
edition: 2026-10-30T12
newsroom: artificial-intelligence
beat: developers
trust: reported
source_count: 3
cited_manifest_ids: ['1793347965886820875', '1793301999208684577', '1793301999207835552']
---

# A fake Claude Code extension planted an SSH backdoor in Cursor

*Cursor says a malicious version of the Claude Code extension, available for about 11 hours, collected host data and tried to install a persistent backdoor. Uninstalling it is not enough.*

Reported · 3 sources · Artificial Intelligence · Published 2026-10-30 12:31 UTC

## Key facts

- Cursor identified a security incident involving Anthropic.claude-code version 2.1.313, which was not developed by Anthropic. [cites: 1793347965886820875]
- At most 5,000 users were affected by the malicious extension, which was available between 2:27am PT and 1:35pm PT on October 29, 2026. [cites: 1793347965886820875]
- Uninstalling the extension is insufficient because the payload drops standalone persistence scripts. [cites: 1793347965886820875]
- Dynatrace's runtime vulnerability dashboard reflects vulnerabilities in code that is genuinely loaded and executing, rather than code merely present. [cites: 1793301999208684577]

## What got in

Cursor says it identified a security incident involving Anthropic.claude-code version 2.1.313, a malicious version of the extension that was not developed by Anthropic. The malicious version was available between 2:27am PT and 1:35pm PT on October 29, 2026, and Cursor says at most 5,000 users were affected. The extension runs malicious code that attempts to install a persistent SSH backdoor, collects host and user information including hostname, username, operating system, architecture, home directory path, environment variable names, working directories, Git email, and public IP, and attempts to add an attacker-controlled SSH key to authorized_keys. [cites: 1793347965886820875]

Persistence, not just access, is the point of the payload. The extension attempts to make the reverse SSH tunnel persistent via a LaunchAgent on macOS, and background scripts retry the tunnel roughly every 60 seconds. The reverse SSH tunnel attempt fails on most systems unless Cursor was started with administrator privileges, which limits the blast radius, but Cursor warns that uninstalling the extension is insufficient because the payload drops standalone persistence scripts. Anyone who installed the version needs to hunt for those scripts, not just remove the extension. [cites: 1793347965886820875]

## How Cursor responded

Cursor says the attacker server at 134.209.82.225 no longer functions, that it worked with the cloud provider to take the malicious server offline, and that it shut down the VSCode Marketplace temporarily for an audit. The company says it rotated its keys and rebuilt the marketplace. The sequence matters: the fix was not only removing the bad extension but rebuilding the distribution channel it came through, because a marketplace that can serve one malicious version can serve another. [cites: 1793347965886820875]

> **From Synorb** — Save what you follow as a Beacon. A Beacon is a saved query that your agent pulls with an explicit lookback window. Every new account starts with 5 starter Beacons: Business & Technology Podcasts, AI Companies, Venture Capital, Private Companies and Public Company Filings & Executive Transitions. [See Beacons](https://synorb.com/connect/start)


## Why AI services widen the attack surface

The incident lands in a week when the tooling for watching AI services in production is itself expanding. Dynatrace says AI services are becoming a fast-growing attack surface in production environments, and it has introduced a dashboard that surfaces AI service vulnerabilities detected at runtime, integrating findings from Runtime Vulnerability Analytics with AI Observability and focusing on GenAI entities identified from GenAI Smartscape. The dashboard includes a coverage section to identify which AI processes are being scanned, and its summary tiles cover vulnerability findings, unique vulnerabilities, affected processes, and affected packages. Runtime analysis matters here because it reflects vulnerabilities in code that is genuinely loaded and executing, not code that is merely present. [cites: 1793301999208684577]

Dynatrace is also expanding AI Observability ingestion across coding agents, Python-based LLM applications, and OpenInference-instrumented frameworks. OneAgent now instruments Python-based LLM applications directly, capturing logs, traces, and LLM-specific telemetry without code changes, and the OpenInference specification auto-instruments over 33 frameworks, including LangChain, LlamaIndex, CrewAI, AutoGen, OpenAI, and Anthropic. From February 1, 2027, Dynatrace AI Observability will support three ingest paths: OpenTelemetry-based instrumentation, OpenInference-instrumented applications, and OneAgent, while support for OpenLLMetry ends January 31, 2027. [cites: 1793301999207835552]

For engineering teams, the practical lesson is narrow and actionable. Treat editor extensions and agent marketplaces as supply chain: pin versions, audit what was installed during the exposure window, and check for persistence mechanisms beyond the extension itself. Runtime vulnerability coverage for AI services, not just static dependency lists, is what would have shown whether the malicious code actually ran. [cites: 1793347965886820875]

## What is still unresolved

- Cursor's account of the incident, including the affected-user count, is self-reported; independent confirmation is not in the material reviewed.
- Whether any affected user suffered a successful backdoor installation is not stated in the material reviewed.
- Dynatrace's dashboard and observability claims are vendor statements about its own products.

## Decision card

- **Useful for:** Engineering teams running AI coding tools; Security teams auditing developer tooling supply chains
- **Not for:** Anyone deciding whether to adopt AI coding assistants in general
- **Compare against:** Static dependency scans; Extension uninstall as remediation

## Provenance ledger

| Manifest id | Title | Source | Claims used | Published |
|---|---|---|---|---|
| `1793347965886820875` | Security notice - malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace | [cursor-blog](https://cursor.com/blog/claude-code-extension-security-notice) | 1793348166568742395, 1793348166581831635, 1793348166588405099, 1793348166601398025, 1793348166726736197, 1793348166619153878, 1793348166626488231, 1793348166645353549, 1793348166664173331, 1793348166677453320, 1793348166657599557, 1793348166690612162, 1793348166696707482, 1793348166720844844, 1793348166702643438 | 10-29 00:00 |
| `1793301999208684577` | Surface vulnerabilities in your AI services | [dynatrace-blog](https://dynatrace.com/news/blog/surface-vulnerabilities-in-your-ai-services) | 1793302288292424127, 1793302288284916150, 1793302288282853053, 1793302288285680303, 1793302288287837760, 1793302288289365852 | 10-29 00:00 |
| `1793301999207835552` | Dynatrace unifies AI Observability ingest across coding agents, OneAgent, and OpenInference | [dynatrace-blog](https://dynatrace.com/news/blog/dynatrace-unifies-ai-observability-ingest-across-coding-agents-oneagent-and-openinference) | 1793302288141348871, 1793302288144369752, 1793302288146971347, 1793302288152207700, 1793302288145243823 | 10-29 00:00 |

## Run these Manifests yourself

Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.

1. **Get a Synorb Key.** Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{"client":"your-agent-name"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons.
2. **Read each cited Manifest by id.** REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief.
3. **Check the claim.** Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them.

Cited Manifest ids:

- `1793347965886820875`
- `1793301999208684577`
- `1793301999207835552`

```sh
for id in 1793347965886820875 1793301999208684577 1793301999207835552; do
  curl -s -H "Authorization: Bearer $SYNORB_KEY" "https://api.synorb.com/manifests/by-id/$id"
done
```

> **From Synorb** — Claims with a source link. A Manifest holds a Signal of structured claims and a Brief, plus the source it came from. Your agent can check a sentence against it. [Read the guide](https://synorb.com/connect/start)

## Related stories

- [Production AI Gets Budgets, Gates and a Paper Trail](https://hangingcontext.com/stories/2026-10-30/production-ai-gets-cost-and-compliance-controls/)
- [Agents that ace the benchmark still fail the job](https://hangingcontext.com/stories/2026-10-30/agent-benchmarks-miss-the-job/)
- [Biology Foundation Models Are Growing Up, and Their Features Are Being Checked](https://hangingcontext.com/stories/2026-10-30/biology-foundation-models-face-a-reality-check/)
- [Agent Platforms Stop Building the Agent and Hand Developers the Keys](https://hangingcontext.com/stories/2026-10-30/agents-go-self-serve-for-developers/)

## Links

- HTML: https://hangingcontext.com/stories/2026-10-30/cursor-malicious-extension-supply-chain/
- JSON: https://hangingcontext.com/stories/2026-10-30/cursor-malicious-extension-supply-chain/index.json
- Markdown: https://hangingcontext.com/stories/2026-10-30/cursor-malicious-extension-supply-chain/index.md

Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.

---
Reuse (terms v1): Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product. Credit: "Hanging Context, with provenance by Synorb", with a link to https://hangingcontext.com/stories/2026-10-30/cursor-malicious-extension-supply-chain/. Terms: https://hangingcontext.com/terms/reuse/