Claude Code VS Code extension with backdoor released on Cursor market...

I’ll research this story first to get the actual technical details right before writing.## Claude Code VS Code Extension With Backdoor Released on Cursor Marketplace

A developer who installed Anthropic.claude-code version 2.1.313 from Cursor’s marketplace during an 11-hour window may have granted an attacker persistent SSH access to their workstation. The malicious package was downloaded by as many as 5,000 systems before Cursor removed it, turning an ordinary “Install extension” action into a potential full-machine compromise.

The incident matters far beyond the affected versions. It exposed a dangerous assumption in AI-assisted development: once a developer trusts an extension with repository access, shell commands, credentials, and context, a modified build inherits all of that trust—even if the underlying language model is entirely legitimate.

What happened

Cursor disclosed that malicious versions of the Claude Code VS Code extension appeared in its marketplace on October 29, between approximately 2:27 a.m. and 1:35 p.m. Pacific Time. The affected releases were 2.1.312 and 2.1.313, with malicious packages distributed for Windows and macOS.

The packages were not built by Anthropic. Cursor characterized them as tampered or malicious versions designed to execute harmful code, attempt to install a persistent SSH backdoor, and collect data. Anthropic denied that its own systems had been compromised.

That distinction is important. This was not a flaw in the Claude model, Claude Code’s normal prompting behavior, or Anthropic’s API authentication. It was a software supply-chain attack against a distribution channel used by multiple VS Code-compatible editors.

In practice, the useful distinction looks like this:

Claude model       → receives prompts and tool calls
Claude Code       → invokes tools and operates on a developer's machine
VS Code extension → runs locally with editor privileges
Marketplace       → distributes executable code to that machine

Compromise any reasonable point in that chain and the attacker can borrow capabilities intended for legitimate development. In this case, the compromised layer was the extension package.

The approximately 5,000 affected installations should also be treated as an upper-bound estimate, not a precise victim count. A download does not necessarily prove execution, while persistence attempts may have succeeded even where the user later removed the extension.

Why the SSH backdoor is particularly dangerous

An SSH backdoor is more consequential than a one-off malicious script. Its objective is persistence: the attacker tries to regain access after the extension is removed, the terminal is closed, or the incident appears over.

Developers are attractive targets because their machines often contain:

• GitHub, GitLab, or cloud-provider credentials;
• Private source code and unreleased product designs;
• API keys for AI, infrastructure, and deployment platforms;
• Production database configuration;
• SSH keys and deployment scripts;
• Local .env files containing service credentials.

An AI coding extension makes this worse. The user may explicitly authorize filesystem access, shell execution, and MCP-connected tools. Those permissions are reasonable for legitimate work, but an attacker can use the same mechanisms for reconnaissance and exfiltration.

This is also why “remove the extension and continue coding” is insufficient. Once malicious code has run, remediation must cover the persistence mechanisms, credentials, and anything the extension may already have accessed.

The response developers should run now

Start by checking installed extension versions. The exact CLI availability varies by editor and platform, but these commands cover the common cases:

# VS Code
code --list-extensions --show-versions | grep -i anthropic.claude-code

# Cursor, where the Cursor CLI is installed
cursor --list-extensions --show-versions | grep -i anthropic.claude-code

# Also inspect common extension directories
find "$HOME/.cursor/extensions" "$HOME/.vscode/extensions" \
  -maxdepth 2 -type d -iname '*anthropic.claude-code*' 2>/dev/null

The result is concerning if it shows 2.1.312 or 2.1.313 and the package was obtained from Cursor’s marketplace during the disclosure window. Do not rely only on whether the extension still appears in the editor UI; removed marketplace listings do not uninstall packages already downloaded locally.

Next, inspect SSH persistence:

sed -n '1,240p' "$HOME/.ssh/authorized_keys" 2>/dev/null
sed -n '1,240p' "$HOME/.ssh/config" 2>/dev/null
ls -la "$HOME/.ssh"

Check for unfamiliar keys, unexpected IdentityFile entries, altered known_hosts, and permissive forwarding or remote-command settings. Also review scheduled tasks and startup mechanisms:

# macOS
ls -la "$HOME/Library/LaunchAgents" 2>/dev/null
launchctl list 2>/dev/null

# Linux
ls -la "$HOME/.config/autostart" 2>/dev/null
crontab -l 2>/dev/null

# Windows PowerShell
Get-ScheduledTask

These commands do not prove that a machine was clean or compromised; they identify obvious persistence artifacts. Organizations should preserve extension files, logs, SSH metadata, and process information before removal where incident-response procedures require it.

Finally, rotate secrets. Prioritize:

1. SSH keys used from the affected machine;
2. Git-host credentials and personal access tokens;
3. Cloud IAM credentials;
4. AI-provider API keys;
5. Database credentials and deployment tokens.

Rotation is more defensible than simply changing a password because an attacker may have copied credentials, generated replacement tokens, or modified automation that recreates access.

Why the model comparison does not change the risk

The malicious extension was a distribution and execution problem. Choosing a different model inside the extension would not have neutralized a trojanized package, and the latest Claude, GPT, or Gemini release does not make an editor extension safe to install automatically.

The important comparison is operational, not a leaderboard. All these models can influence code, and all can drive tools when an agent is permitted to use them. The quality of the generated code does not determine whether an extension has planted an SSH key.

For API-driven development, the same reasoning applies to multi-model access. Routing requests through AI Prime Tech can make Claude, GPT, and Gemini usage more affordable while supporting model selection across different workloads. It also adds another component that must be trusted with API keys and request data. In practice, that means scoped credentials, explicit logging, no unrestricted shell access, and verification that the selected backend is the one intended.

Where the trust boundary should move

The incident points toward a simple architectural rule: treat coding-agent extensions like CI/CD runners and IDE launchers, not like decorative plugins. A useful extension should be treated as a privileged remote-code-execution component.

That means teams should establish controls before the next incident:

• Pin versions. Automatically approve one known-good version rather than accepting every marketplace update.
• Use publisher allowlists. Restrict installation to trusted extension IDs and approved publishers.
• Verify provenance. Check whether an editor’s own marketplace mirrors the extension, and compare publisher metadata, release notes, and signing details.
• Review extension binaries. For critical environments, compare package hashes or inspect source builds before rollout.
• Separate credentials. Give agents scoped tokens that can be revoked quickly instead of unrestricted personal credentials.
• Apply host isolation. Run sensitive development in containers or disposable virtual machines with limited network access.
• Monitor telemetry. Alert on new authorized_keys entries, unexpected SSH connections, changes to shell profiles, and extension-directory modifications.

The most important improvement is reducing the blast radius. Even a perfectly detected malicious package should not possess credentials capable of deploying code, changing cloud IAM policy, or publishing a release.

Practical takeaways

• The affected packages were Anthropic.claude-code 2.1.312 and 2.1.313, distributed through Cursor’s VS Code extension marketplace for roughly 11 hours.
• Up to 5,000 systems may have downloaded the malicious build, but installs and successful persistence must be verified separately.
• Removing the extension does not remove an SSH backdoor or copied secrets. Rotate credentials and inspect persistence locations.
• Model choice is not a malware defense. Claude, GPT, and Gemini all operate inside the same potentially compromised local client.
• Pin extensions, control publishers, isolate agent workloads, and use least-privilege API credentials.
• Lower-cost multi-model access through AI Prime Tech can reduce inference costs, but secure routing and key isolation remain non-negotiable.

The broader lesson is straightforward: AI coding tools now possess enough local authority to make extension distribution a high-value security boundary. The winning development workflow will not be the one that installs everything automatically. It will be the one that can update aggressively without giving a compromised package the keys to the kingdom.