- Cursor removed backdoored Claude Code extension versions 2.1.312 and 2.1.313 from its marketplace.
- The extension executes malicious code immediately when loaded without requiring user interaction.
- The payload appends an SSH key with comment svc-telemetry to authorized_keys.
- Implementation bugs on macOS and Windows disrupt SSH service setup under standard permissions.
In this guide
What is the Claude Code Cursor backdoor?
The official Claude Code for VS Code extension distributed on the Cursor Marketplace was compromised in versions 2.1.312 and 2.1.313. Security firm Phorion reported that the affected extension bundle contains an injected payload designed to establish a persistent SSH backdoor.
- Discovered by
- Phorion
- Advisory update
- 31 October 2026
- Affected versions
- 2.1.312 and 2.1.313
- Distribution platform
- Cursor Marketplace
- Target operating systems
- macOS, Linux, Windows
Cursor has since removed both affected versions from the Cursor Marketplace. Organizations running these versions must inspect their developer environments for unauthorized access keys and background persistence.
How to audit systems for the backdoored extension
Completing this audit identifies whether developer devices are running compromised extension builds and reveals if unauthorized SSH keys or directory permissions were applied.
- Check installed extension builds in Cursor to confirm if version 2.1.312 or 2.1.313 of the Claude Code for VS Code extension is present.
- Inspect ~/.ssh/authorized_keys for entries containing the comment svc-telemetry or matching the attacker Ed25519 public key fingerprint.
- Verify directory permissions on ~/.ssh to check if they were changed to 0700 and check authorized_keys permissions for 0600.
- Audit system process telemetry for background execution attempts involving systemctl, service, systemsetup, or PowerShell SSH setup commands.
- Engage incident response teams immediately if compromised extension versions or backdoor artifacts are detected on any host.
When searching authorized_keys, inspect the public key fingerprint directly rather than relying solely on the svc-telemetry comment string.
How the Claude Code extension payload executes
The malicious code lives in the extension.js file as an injected function expression prepended to the minified code bundle. Node.js executes this code immediately when loading the file, before the extension standard activate callback runs.
Because execution occurs automatically during module loading, the user does not need to interact with the extension for the payload to launch. The script imports child_process, fs, os, path, http, and crypto modules to prepare persistence and host reconnaissance.
Implementation errors in the backdoor payload
According to Phorion, implementation bugs in the payload prevent SSH service enablement on unprivileged systems. On macOS, running systemsetup -getremotelogin without root privileges returns an administrator error message and exits with status code 0.
Because the script expects an Off response before triggering sudo -n systemsetup -setremotelogin on, it skips enabling SSH entirely on macOS. On Windows, the payload passes PowerShell service commands into a helper function that hardcodes /bin/sh.
Do not rely on payload bugs for protection: if SSH Remote Login was already enabled on macOS, the attacker Ed25519 key provides immediate access.
Frequently asked questions
What versions of the Claude Code Cursor extension are affected?
Does the backdoor require user interaction to activate?
What SSH key comment does the payload leave in authorized_keys?
Why does SSH service enablement fail on standard macOS accounts?
Sources: Phorion
Want your brand to be the answer AI gives?
See how ready your website is for ChatGPT, Gemini and Perplexity, free, in about ten seconds.