Phorion says Claude Code extension on Cursor Marketplace carried SSH backdoor
In the wild
Manipulation
Severity 3 significant
Corroborated 82%
Added by the register agent
Phorion reports that versions 2.1.312 and 2.1.313 of the official Claude Code for VS Code extension on the Cursor Marketplace contained an injected payload. The payload reportedly added an attacker SSH key, opened an outbound reverse tunnel and sent a host reconnaissance beacon. Cursor has removed the affected versions from its marketplace.
What would have stopped it
Verify extension bundle integrity against the publisher's known hashes before installing or loading marketplace updates.
Guardrails
- G1 Least privilege Failed Extension runs with the IDE's and user's permissions, giving immediate access to local files.
- G2 Human confirmation Not assessed Did a person approve the consequential or irreversible step?
- G3 Isolation Failed The backdoored extension ran inside the developer's IDE on the local machine.
- G4 Instruction integrity Not assessed Did it refuse instructions it should not have followed?
- G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
- G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
- G7 Oversight Not assessed Could a responsible human see what it was doing and stop it in time?
- G8 Recovery Not assessed Could the damage be undone?
Sources
-
“Phorion has discovered a compromise of the official Claude Code for VS Code extension on the Cursor Marketplace, where the backdoored extension bundle contains a persistent Secure Shell (SSH) backdoor.”
-
“Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems.”
Confidence 82% comes from these sources alone. How we score
History
- 31 Oct 2026Drafted by the register agent from Phorion (register agent)
- 31 Oct 2026Source added: The Hacker News (same incident). Confidence 70% → 82%. (register agent)