Contact Us

 

2 minutes estimated reading time.

Reported SSH Backdoor in Claude Code Extension Served Through Cursor

Phorion reports a tampered Claude Code extension, version 2.1.313, served via the Cursor marketplace planted an SSH key. Here is how to check if you were hit.

By — Published 10/30/2026

Phorion, an endpoint detection and response (EDR) firm, is reporting Official Claude Code Extension Compromise: Security Advisory in an announcement authored by Calum Hall.

There is an active discussion on Kevin Beaumont’s @GossiTheDog Mastodon account as well as in the comments of the related Hacker News discussion, Backdoors in official Claude Code extensions.

According to Phorion, a tampered build of the Claude Code extension for Visual Studio Code was served through the Cursor marketplace. The compromised version was 2.1.313, and Cursor has since pulled it. Per comments on Hacker News from someone identifying as an Anthropic employee, this was not a compromise of Anthropic’s own systems. The statement said that someone with access to Cursor’s marketplace published a tampered copy that Anthropic did not build or publish, and that only Cursor users are affected. I have not seen a full post-mortem from either company yet, so treat the details as developing.

To determine if you were impacted, first check whether you are or were recently running 2.1.313 of the extension, particularly if you use Cursor. Reports on the exact timing vary, so to be safe consider the window of exposure to be October 28 through October 30, 2026. If you had the extension installed or updated during that window, you should look for indicators of compromise and plan accordingly:

  • a new key in your ~/.ssh/authorized_keys file (Phorion reports the key comment is svc-telemetry), or
  • new .smt, .smtk, or smt.cmd files written to your ~/.config/ folder.

There may be additional indicators to consider, see the Phorion writeup for the full list.

On the systems we checked, we have not seen such evidence at this time.

This is a software supply chain attack, where the code you trust arrives through a legitimate distribution channel already tampered with. I covered the same class of problem in RubyGems Open Source Supply Chain Security and OpenAI and, back in 2019, in Ruby Gems Supply Chain Vulnerability.

It is also a good reminder of the importance of practicing good sandboxing procedures when working with a coding agent. These are powerful engines that have access to code and secrets and by their very nature execute remotely supplied code with minimal human review, which is the same habit that makes vibe coding risky.

My immediate recommendation for anyone is to create isolated virtual machines for use by your coding agents and only supplying the files necessary for their specific work. This is putting the principle of least privilege into action.