Opening SecureFlowCursor Marketplace: A Trojanized Claude Code Extension Plants an SSH Backdoor
Case summary & sources

AIDEFEND SecureFlow / SecureFlow Case Index

Cursor aidefend-sf0076

Cursor Marketplace: A Trojanized Claude Code Extension Plants an SSH Backdoor

  • AI Infrastructure
  • System Compromise & RCE
  • Data Exfiltration

AI code editor Cursor confirmed malicious Windows/macOS copies of the Claude Code coding-assistant extension, versions 2.1.312 and 2.1.313, in its marketplace on October 29, 2026. Injected code ran at module load, planted an SSH key, attempted a persistent reverse tunnel and reported host information. Attacker login still required working local SSH and an accepted key; compromise of Anthropic’s official distribution infrastructure is not established.

Mapped threat techniques

  • AML.T0010.001 AI Software
  • AML.T0011.001 Malicious Package

Source

Updated