# Malicious Claude Code extension on Cursor's marketplace planted an attacker SSH key on developer machines

Source: https://startwithidentity.com/blog/2026-10-29-malicious-claude-code-extension-on-cursor-marketplace-planted-an-attacker-ssh-key/
Last updated: 2026-10-29
License: content by Start with Identity. Cite the source URL.

---

Cursor published a security notice on October 29 saying maliciously modified versions 2.1.312 and 2.1.313 of the Anthropic Claude Code extension were available in its VS Code extension marketplace for Windows and macOS from about 2:27 a.m. to 1:35 p.m. Pacific time that day. Cursor says Anthropic did not develop these versions; neither company has said how they were published. The extension collected the hostname, username, Git email, public IP and the names of environment variables, then tried to add an attacker SSH key with the comment `svc-telemetry`, enable the local SSH service and open a reverse SSH tunnel, with a LaunchAgent or scheduled task retrying every minute. Cursor says the setup would likely fail without admin rights. It removed the versions, shut the marketplace down, rotated keys and rebuilt it, and found no other extensions tampered with. BleepingComputer put potential exposure at up to 5,000 developers.

## Why it matters

The payload did not steal passwords. It tried to add a new identity: an SSH key in `authorized_keys` is a standing credential that survives password resets, MFA changes and uninstalling the extension. On a developer laptop that also holds cloud sessions, Git tokens and AI provider keys, that is a quiet way back in, the same exposure behind [OpenCode](https://startwithidentity.com/blog/2026-10-17-opencode-console-breach-may-have-exposed-users-ai-provider-keys/) and the [LiteLLM release](https://startwithidentity.com/blog/2026-10-23-litellm-traces-poisoned-release-to-an-admin-key-leaked-in-may-and-never-revoked/).

Search `authorized_keys` on every Cursor user's machine for `svc-telemetry`, and use Cursor's IOCs and remediation scripts. If you find it, isolate and consider rebuilding the host, then rotate every credential and session it could reach from a clean device. Longer term, inventory authorized SSH keys as [non-human identities](https://startwithidentity.com/guides/fundamentals/what-is-non-human-identity/) with owners, and keep [secrets](https://startwithidentity.com/techniques/secrets-in-repositories-and-ci/) out of developer environment variables.

Source: [Cursor](https://cursor.com/blog/claude-code-extension-security-notice)