AIDEFEND in Action AIA-0117 Incident Published: Oct 30, 2026

Cursor Marketplace: A Trojanized Claude Code Extension Plants an SSH Backdoor

AI code editor Cursor confirmed malicious Windows/macOS copies of the Claude Code coding-assistant extension, versions 2.1.312 and 2.1.313, in its marketplace on October 29, 2026. Injected code ran at module load, planted an SSH key, attempted a persistent reverse tunnel and reported host information. Attacker login still required working local SSH and an accepted key; compromise of Anthropic’s official distribution infrastructure is not established.

Supply Chain CompromiseSupply Chain DefenseRuntime IsolationAI Coding IDEAI Supply Chain
4 applicable AIDEFEND defenses
Source: Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace 
Author: Cursor Team
Original article: Oct 29, 2026

Threat Analysis

  • An AI development tool carried native malware: Cursor’s October 30 update identifies malicious Windows/macOS copies of 2.1.312 and 2.1.313, distributed on October 29 at approximately 02:27 to 13:35 PT. The inserted extension.js prefix runs when the IDE loads the module, before normal activation. The attacker does not need to persuade a model or wait for a tool-approval prompt.
  • Separate installation from successful access: the code adds an SSH authorized key, tries to enable SSH and starts an outbound reverse tunnel. Phorion found service-setup bugs; an already-running SSH service can still accept the planted key. A tunnel connection is not proof of an attacker login. macOS LaunchAgent persistence and Windows SYSTEM-task/Startup fallback are separate platform routes; successful SYSTEM access is not established.
  • Host reporting can occur while login fails: the initial HTTP beacon carries host/account details and matching environment-variable names, not their secret values. The injected stage generates its scripts and keys from embedded content rather than downloading a second executable. Subsequent interactive credential theft is a risk, not a confirmed outcome for every host.
  • Keep the attribution bounded: the confirmed distribution channel is Cursor’s marketplace. Socket’s registry investigation does not establish the same malicious release on npm, Open VSX or Microsoft’s marketplace. Neither the initial intrusion nor an Anthropic publisher/build compromise is established. Linux logic in the artifact does not prove malicious Linux builds were distributed.

Applicable AIDEFEND Defenses (4)

AID-H-003.001
Software Dependency & Package Security
High
In managed AI-development tooling, admit only independently approved extension bytes, binding the distribution source, exact version and SHA-256 in a deployment lock. Enforce the lock before the IDE can import extension.js and block implicit upgrades or alternate install routes. Extend the package-admission adapter to VSIX artifacts; a version label, publisher name or hash obtained solely from the same suspect mirror is insufficient. This prevents unapproved replacement bytes, not malicious code already approved as trusted.
AID-I-001.002
MicroVM & Low-Level Sandboxing
High
For managed high-risk AI coding, isolate the entire IDE extension host and its children inside a verified VM/VDI boundary. Use a separate home, exclude host SSH files and credential stores, and deny host startup writes. Test runtime integration and rejected host operations. Sandboxing only model-issued shell tools misses this earlier native JavaScript; enclosing isolation contains host impact without establishing that the extension is benign.
AID-I-001.004
Sandbox Network Egress Restrictions
High
When a managed sandbox governs the entire IDE and extension runtime, bind a default-deny egress policy enforced outside it. Allow required model/update services narrowly; deny arbitrary raw-IP SSH/HTTP, including C2 ports 22 and 8099. Test sockets, helper processes, DNS and onward paths through permitted proxies; reconcile external flow logs. Tool URL filtering or one IP block does not establish this boundary. Local persistence still needs removal.
AID-E-003.003
Confirmed Malicious Code & Persistence Eviction
High
After preserving evidence, enumerate confirmed malicious extension and startup artifacts by exact path, version and digest in a signed incident manifest. Remove or replace the extension, macOS LaunchAgent and Windows Startup script from installation sources and affected runtimes. Independently verify the complete installed population and normal startup in a disposable replica. This is post-incident eviction; SSH keys, active tunnels and application task registrations require separate response.

What Defenders Should Do Now

  • Identify installations by marketplace source, time, platform and exact bytes. Check both 2.1.312 and 2.1.313 against Cursor’s updated platform-specific VSIX hashes and extension.js hash; version labels alone cannot distinguish clean from modified copies. Preserve install records and endpoint/network evidence before remediation.
  • Isolate hosts with payload-execution or backdoor evidence. Inspect the svc-telemetry key and fingerprint, tunnel processes, macOS LaunchAgent and Windows task/Startup artifacts using Cursor’s current advisory. A missing key comment alone is insufficient to declare a host clean. Remove standalone persistence and assess a rebuild; uninstalling or updating the extension does not remove every host change.
  • From a trusted machine, revoke affected sessions and revoke or rotate credentials accessible from the affected host. The initial beacon did not contain environment-variable values; credential response addresses possible subsequent access. Cursor reports the C2 server was taken offline; local persistence still requires verification and removal.
  • For future rollout, lock independently approved extension bytes before loading them. Where stronger containment is needed, govern the entire IDE extension host with a verified VM/VDI boundary and externally enforced network policy. Verify denied host-file writes and unauthorized SSH/HTTP callbacks with harmless fixtures before relying on those controls.

Conclusion

AIDEFEND  connects this incident to exact-package admission at the extension loader, whole-runtime isolation and externally enforced sandbox egress. After confirmed execution, its artifact-eviction guidance also covers malicious extension and startup files, with independent checks across installation sources and runtimes. Model prompts and tool approvals cannot protect a boundary the native extension has already crossed.

Last updated: