# Cursor: malicious Claude Code extensions attempt persistent SSH access Canonical: https://www.oktsec.com/radar/cursor-claude-code-malicious-extension-october-2026 Publisher: Oktsec Language: en Published: 2026-10-31T18:51:00Z Updated: 2026-10-31T18:51:00Z Record reviewed: 2026-10-31T18:51:00Z Latest evidence check: 2026-10-31T18:51:00Z Disclosed: 2026-10-29 Claude Code extension versions 2.1.312 and 2.1.313 distributed through Cursor on Windows and macOS contain an SSH backdoor payload. Check installation and execution records; removal alone does not clear persistence. ## Evidence and response priority - Category: Supply chain - Oktsec priority: Act now - Rationale: Cursor confirms two malicious packages; Microsoft describes attempted SSH persistence. Act now for affected installations, while distinguishing payload execution from successful remote access. - Evidence: Attack attempts observed - Verification: Multiple sources - Fix status: No fix available - Exposure requirement: Affected package must execute - Vendor: Cursor - Products: Anthropic.claude-code extension in Cursor Marketplace ## Technical overview Cursor identifies Anthropic.claude-code 2.1.312 and 2.1.313 for Windows and macOS as malicious. They were available through its marketplace on October 29, approximately 09:27–20:35 UTC. Microsoft reports that these packages were not distributed through Visual Studio Marketplace or the official Claude Code npm distribution. Anthropic did not develop the malicious packages. Microsoft found injected JavaScript that runs when the extension module loads. It attempts to append an attacker-controlled SSH key, enable SSH, create reverse forwarding and establish startup persistence. Host-detail collection includes environment-variable names, not their values. Successful remote access depends on privileges and configuration; keys or persistence can remain even when the tunnel fails. Cursor removed the packages and reports the attacker server offline. Those actions do not remove artifacts already written to endpoints. Investigate the affected installation before declaring recovery. Oktsec recommends correlating installation, process, authentication and network evidence. Preserve records before cleanup, assess credentials reachable from affected processes and document the decision to remediate or rebuild. Do not infer a clean host from a single missing indicator. ## Recommended response Preserve extension and endpoint evidence, investigate SSH persistence and isolate hosts with execution indicators; assess reachable credentials. Relevant to: Teams running Cursor on Windows or macOS that installed or automatically updated the affected extension. ## Affected systems and fixes ### Anthropic.claude-code from Cursor Marketplace (Windows/macOS) Affected: Exactly 2.1.312 and 2.1.313; available October 29, approximately 09:27–20:35 UTC Fixed release / action: Malicious packages removed. No replacement version is established by these sources; host remediation is required where affected. Confirm the running version against the vendor advisory, including any distribution backports. ## Response checklist 1. **Find affected installations and automatic updates** — Preserve extension IDs, versions, package files and installation timestamps. Correlate the affected versions and marketplace with endpoint execution records; do not run a suspect package to test it. 2. **Investigate SSH access and persistence** — Review authorized_keys, SSH service changes, outbound tunnels, macOS LaunchAgents and Windows scheduled tasks or Startup scripts. Isolate hosts showing payload execution or backdoor artifacts. Absence of one indicator does not establish a clean host. 3. **Assess credentials accessible from affected hosts** — Inventory repository tokens, cloud sessions and signing material available to the process. Investigate their use; revoke sessions and rotate exposed credentials from a trusted system. Environment-variable names in the beacon do not rule out later credential access. 4. **Verify cleanup before restoring workflows** — Remove confirmed keys, persistence and tunnel processes; determine whether rebuilding is required. Neither uninstalling the extension nor an offline attacker server proves the host is clean. Recheck authorized access before reuse. ## Relevance to AI environments Developer and agent workstations may hold repository tokens, cloud sessions and signing keys. Inventory what the affected process could access before restoring these workflows. ## Sources - [Cursor security notice: malicious Anthropic.claude-code versions](https://cursor.com/blog/claude-code-extension-security-notice) — Cursor; Vendor notice; checked 2026-10-31T18:51:00Z - [Microsoft analysis: persistent SSH backdoor in the Cursor extension](https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/) — Microsoft Security Research; Research report; checked 2026-10-31T18:51:00Z ## Editorial record - 2026-10-31T18:51:00Z: Added the two malicious Cursor Marketplace extension versions, distribution window and host investigation steps; kept remote-access success conditional. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/cursor-claude-code-malicious-extension-october-2026) · [Build a response plan](https://www.oktsec.com/radar/cursor-claude-code-malicious-extension-october-2026#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=cursor-claude-code-malicious-extension-october-2026&service=exposure_check) - [AI agent review consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=cursor-claude-code-malicious-extension-october-2026&service=agent_review) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.