Claude Code VS Code Extension Compromised, Exposing SSH Backdoor Risk

Cybersecurity researchers have revealed a significant security breach involving the official Anthropic Claude Code extension for Visual Studio Code (VS Code). A compromised version of the extension, distributed via the Cursor Marketplace, was found to install a persistent SSH backdoor on user machines, posing a substantial risk to developers and their projects. The AI coding platform Cursor has since temporarily suspended its service to remove the malware.

Cursor stated that the malicious version was not developed by Anthropic and exclusively impacted installations from its own IDE marketplace. It is estimated that approximately 5,000 users downloaded this compromised version. The incident highlights the critical security implications of vulnerabilities within widely used developer tools.

Why it matters

This incident underscores the significant risks associated with security flaws in software development tools. While AI-powered coding assistants like Claude Code enhance developer productivity, they also gain access to sensitive code and systems. If not managed securely, these tools can become targets for malicious actors. The compromised extension, upon VS Code startup and webview activation, was designed to allow attackers to gain remote access by adding unauthorized SSH keys to the user's ~/.ssh/authorized_keys file.

Attackers attempted to conceal their actions by adding an SSH key labeled "svc-telemetry." The established reverse tunnel enabled them to execute commands, transfer files, and gather system information from Windows, Linux, and macOS hosts. This reconnaissance data was transmitted to a server located at 134.209.82.225:8099/beacon via unencrypted HTTP requests. Furthermore, the extension aimed to maintain its presence by installing platform-specific persistence mechanisms, such as scheduled tasks, cron jobs, or LaunchAgents, ensuring it remained active even after system reboots.

What it means for you

For users globally, this incident serves as a stark reminder to exercise caution with VS Code extensions, especially those integrated with AI platforms. If you have installed the Claude Code extension, particularly from the Cursor Marketplace between October 29, 2026, it is crucial to take immediate security measures. Users are advised to isolate affected hosts, remove any unauthorized SSH keys and persistence mechanisms, and rotate all credentials and active sessions.

Cursor has announced that it will be directly contacting affected users. Anthropic has since released a clean version (2.1.314) of the extension. Developers should verify the integrity of their installed extensions and consider disabling auto-updates for critical tools until their security is confirmed. Proactive security practices are essential for protecting developer assets in the face of evolving cyber threats.

The vulnerability disclosure follows closely on the heels of another supply chain attack where the release binaries of OVHcloud's CLI were replaced with credential-stealing malware, emphasizing the widespread nature of such threats.

Next Steps

Cursor is actively working to identify and notify all impacted users. Anthropic has responded swiftly by removing the malicious version and publishing a secure update. Developers are encouraged to stay informed about security advisories from extension providers and to manually verify updates for critical tools rather than relying solely on automatic updates. This event highlights the growing need for enhanced security audits and transparency within the software development ecosystem.