For about 11 hours on October 29, developers who installed Anthropic's Claude Code extension inside the Cursor code editor may have received a backdoored copy instead. Cursor reported that a malicious version, 2.1.313, was available in the Cursor extension marketplace between approximately 09:27 and 20:35 UTC, and estimates that up to 5,000 users were affected across macOS and Windows, according to an advisory from Sophos X-Ops.
Developer machines are a prized target because they tend to hold source code, cloud keys and access to build systems. An extension that runs inside the editor inherits all of it.
A backdoor that tries to phone home over SSH
Analysis by the security firm Phorion found that the malicious extension adds an attacker-controlled SSH key to the machine's authorized_keys file, which would let the attacker log in remotely without a password. It then attempts to open a reverse SSH tunnel to an attacker server at 134[.]209[.]82[.]225, sets up persistence so it survives restarts, and sends details about the host back to the attacker.
There is one piece of luck. Because of coding errors in the malware, enabling SSH fails on most macOS and Windows hosts, Phorion found. That does not make an affected machine safe: the authorized key, persistence and the host reporting are separate steps, and Sophos still treats every machine that installed the build as needing cleanup.
Neither Cursor nor Sophos has said publicly how the malicious version got into the marketplace or who was behind it. The original Claude Code extension itself was not described as compromised; the issue was the copy distributed through Cursor's marketplace during the exposure window.
Uninstalling is not enough: remove the key and rotate credentials
Sophos X-Ops recommends that organizations identify every host running Cursor and check whether version 2.1.313 of the extension was installed during the exposure window. On any affected machine:
- Remove the attacker's SSH key from authorized_keys. Uninstalling the extension leaves the backdoor in place.
- Find and remove the persistence mechanisms and kill any SSH tunnel processes.
- Rotate credentials the machine could reach, including SSH keys, cloud tokens and repository access.
- Block and hunt for connections to 134[.]209[.]82[.]225.
Sophos says it is searching customer telemetry for the reported indicators and will ship detections as they become available.
AI coding tools have quickly become one of the most attractive places to plant malware, from the stealer that raids Claude, ChatGPT and Cursor credentials to fake ChatGPT and Claude apps abusing signed installers. This one did not need a fake app at all. It rode in through the marketplace developers already trust.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.