Malicious Claude Code extension on Cursor's marketplace planted an attacker SSH key on developer machines
Cursor said on October 29 that tampered versions 2.1.312 and 2.1.313 of the Anthropic Claude Code extension were on its marketplace for about 11 hours. They tried to add an attacker SSH key named svc-telemetry, enable SSH and open a reverse tunnel.
Cursor published a security notice on October 29 saying maliciously modified versions 2.1.312 and 2.1.313 of the Anthropic Claude Code extension were available in its VS Code extension marketplace for Windows and macOS from about 2:27 a.m. to 1:35 p.m. Pacific time that day. Cursor says Anthropic did not develop these versions; neither company has said how they were published. The extension collected the hostname, username, Git email, public IP and the names of environment variables, then tried to add an attacker SSH key with the comment svc-telemetry, enable the local SSH service and open a reverse SSH tunnel, with a LaunchAgent or scheduled task retrying every minute. Cursor says the setup would likely fail without admin rights. It removed the versions, shut the marketplace down, rotated keys and rebuilt it, and found no other extensions tampered with. BleepingComputer put potential exposure at up to 5,000 developers.
Why it matters
The payload did not steal passwords. It tried to add a new identity: an SSH key in authorized_keys is a standing credential that survives password resets, MFA changes and uninstalling the extension. On a developer laptop that also holds cloud sessions, Git tokens and AI provider keys, that is a quiet way back in, the same exposure behind OpenCode and the LiteLLM release.
Search authorized_keys on every Cursor user's machine for svc-telemetry, and use Cursor's IOCs and remediation scripts. If you find it, isolate and consider rebuilding the host, then rotate every credential and session it could reach from a clean device. Longer term, inventory authorized SSH keys as non-human identities with owners, and keep secrets out of developer environment variables.
Source: Cursor
Related on Start with Identity
- BlogGitLab's incoming email address is a non-expiring token that commits code and runs CI as you
Aikido Security showed that the personal address GitLab issues for creating issues by email can also open merge requests that GitLab commits in your name and ca
- BlogA hijacked AI coding assistant session spread Shai-Hulud to about 100 internal repositories
Mandiant describes an intrusion at an unnamed SaaS provider where a poisoned package, recommended through a developer's AI coding assistant session, led to stol
- BlogBank of America tells customers not to give AI agents their banking password
Bank of America emailed customers urging them never to share their username and password with an outside service, including an AI tool or agent that offers to a
- GlossaryAPI Key
A static secret string used to authenticate an application or caller to an API. Simple but weak: it does not expire on its own, is easy to leak, and should be v
- GuideAPI Key Rotation Automation Guide
A practical guide to automating API key rotation with zero downtime, covering rotation strategies, secrets management integration, dual-key patterns, monitoring
- TechniqueAttacker-in-the-middle phishing proxy
A reverse proxy sits between the user and the real login page, relays every step of authentication including MFA, and keeps the session cookie the successful lo