Backdoor in the Claude Code extension: what really happened and what to do
On 29 October 2026 a tampered build of the Claude Code extension sat in the Cursor marketplace for about 11 hours and installed a persistent SSH backdoor on up to 5,000 machines. What is confirmed, what is not, and the checks to run now.
The news: a trusted extension with a backdoor inside
On 29 October 2026 a tampered build of the Claude Code extension, version 2.1.313, sat in Cursor's extension marketplace for about 11 hours and installed a persistent SSH backdoor on up to 5,000 developer machines, according to Cursor (Cursor).
The most shared headline, "Anthropic was hacked and pushed a trojan to millions of endpoints", is not supported by the evidence so far: only one channel is confirmed, Cursor's marketplace. Two serious facts remain. The package shipped under the official Anthropic.claude-code identifier, and anyone who installed it has to clean the machine by hand, because updating is not enough.
What happened
The only confirmed distribution channel is the extension marketplace that Cursor runs itself. Early reports naming Open VSX, npm and the Visual Studio Marketplace have been disproved or withdrawn. Times in UTC.
| When | Who | What |
|---|---|---|
| 30 Oct, 09:26 | Socket | No trace of 2.1.313 in the Open VSX change feed or in npm's history; suspects the screenshot in the first report was edited |
| 30 Oct, morning | Kevin Beaumont | "Anthropic got compromised" thread, then an article claiming millions of endpoints |
| 30 Oct | OpenSourceMalware | Analysis of the macOS sample; the post, which first named Open VSX, was revised and states the sample's provenance is not established |
| 30 Oct | Phorion | Advisory attributing the backdoor to the Open VSX release; attribution later superseded by Cursor's notice |
| 30 Oct, 01:17 | Anthropic | 2.1.314 released on the Visual Studio Marketplace (on npm at 00:12) |
| 29 Oct, evening | Cursor | Security notice: version removed, marketplace rebuilt with rotated keys, attacker's server taken down |
| 29 Oct, 09:27-20:35 | Cursor marketplace | The malicious 2.1.313 (macOS Apple Silicon and Windows x64 builds) is available for about 11 hours |
Cursor says the malicious build was not developed by Anthropic and that it has no evidence other versions or the official distribution are affected (Help Net Security). The Hacker News reports that the issue was traced to a compromise of the Cursor marketplace itself (The Hacker News). The central question is still open: how a package that was not Anthropic's appeared under Anthropic's identifier. Neither party has explained it in detail yet.
How the backdoor works
The editor only had to load the extension: no chat with Claude, no install script. The rest of the extension worked normally, so users noticed nothing.
- 01
Loader
66 lines of JavaScript were prepended to
extension.jsand run before the legitimate code, when the editor starts or the webview opens (ThreatLandscape). - 02
SSH key
The loader adds the attacker's key to the user's
authorized_keysfile, labelledsvc-telemetry, and tries to enable the SSH service where permissions allow. - 03
Reverse tunnel
It opens an outbound SSH connection to
134.209.82.225, which lets the operator get back into the machine. The tunnel survives closing the editor and reconnects about every 60 seconds. - 04
Persistence
It installs start-up mechanisms for each system: a LaunchAgent on macOS, crontab on Linux, a scheduled task on Windows. Uninstalling the extension or updating to 2.1.314 does not remove them.
- 05
Reconnaissance
It sends host data over unencrypted HTTP on port 8099: hostname, user, operating system, architecture, home folder, environment variable names, working folders and the email configured in Git.
The last point explains the talk of "pick and choose" access: the reconnaissance gave the attacker a list of victims to choose from for hands-on access. According to Cursor the attacker's server is now offline.
Anthropic's silence
As of the afternoon of 30 October Anthropic had published no statement: none appeared on its website, its status page or the security advisories of the Claude Code repository (Rescana, CellCog).
In practice Anthropic acted without explaining. Version 2.1.314 went out on npm, Open VSX and the Visual Studio Marketplace overnight between 29 and 30 October, and the official numbering skips 2.1.313. The 2.1.314 changelog does not mention the incident (Socket).
On this point the criticism stands even if the rest is scaled down. The package carried Anthropic's name and auto-update installed it without anyone doing anything: users of the extension need to hear from Anthropic which channels are safe, not piece it together from third-party blogs. A skipped version number alone proves nothing: Socket notes other gaps in the same series.
Binance: coincidence or cause?
No source has linked the theft of about 6.3 billion dollars from Binance to the extension: for now the link is a hypothesis circulating on social media. Three clues feed it.
- Binance names a DevOps engineer's compromised laptop as the likely entry point, from which the attacker reached a service container and submitted unauthorised withdrawals (The Hacker News).
- The transaction that took control of the Binance 14 hot wallet was sent at 20:20 UTC on 29 October, within the window when 2.1.313 was online (crypto.news).
- Kevin Beaumont says he has confirmed that Binance uses Claude Code in Cursor with this extension.
The evidence against weighs just as much. According to TRM Labs, preparation for the attack was under way at least 36 hours before the theft, so before 2.1.313 appeared. Binance describes a complex attack with several points of breach and has not yet published a root cause (Euronews).
What to do now
Anyone who used Claude Code inside Cursor on 29 October is at risk. Anyone using only VS Code with Microsoft's marketplace, or Claude Code from the terminal, does not appear to be affected. If in doubt, check anyway: it takes a few minutes.
- 01
Look for the version
In Cursor's extensions folder (
~/.cursor/extensions) look for ananthropic.claude-code-2.1.313-*directory, or check the version in the install history. - 02
Look for the key
grep svc-telemetry ~/.ssh/authorized_keys, and check the file for any other keys you do not recognise. - 03
Update
Move the extension to 2.1.314 or later, bearing in mind that this alone removes nothing.
- 04
Block the address
On the firewall, block
134.209.82.225on ports 22 and 8099 and search the logs for past connections to it. - 05
Clean up
On affected machines, use the macOS and Windows scripts published by Cursor, which remove the extension, key, persistence and running tunnels.
- 06
Rotate credentials
From a clean machine: SSH keys, Git tokens, API and cloud keys, secrets in environment variables and open sessions.
- 07
When in doubt, rebuild
If interactive access was even possible, reinstall the system rather than cleaning it (ThreatLandscape).
The lesson for anyone running developer machines
The weak point was not Claude Code but the chain that delivers it: a third-party marketplace, a trusted name and auto-update. Nobody had to fall for a fake extension: installing the right one and letting it update was enough.
- VS Code-based editors do not use Microsoft's store. Cursor, Windsurf and similar editors pull from Open VSX or their own marketplaces, with different controls. You need to know which source each machine uses.
- Extension auto-update is a distribution channel. Where possible, pin versions and delay updates by a few days, at least on machines with production access.
- Developer laptops are infrastructure. They hold SSH keys, tokens and cloud access: they need monitoring and separation from privileged access, as the Binance case shows whatever its cause.
Right now the most shared version of the story is also the most serious and the least verified. Deciding what to do takes confirmed facts, and today those point to a single marketplace, a single version and an 11-hour window.
How we work
At Cloudfactory we manage servers, workstations and access for companies and professional firms. When an incident like this breaks, we check straight away whether it affects the systems we look after, review the published indicators and, where needed, rotate credentials and rebuild.
If someone on your team uses Cursor or other editors with AI extensions and you are not sure what is installed, get in touch: we will run the checks and tell you what to do.
How we wrote this article
At Cloudfactory we also use artificial intelligence in our editorial work: it helps us find and cross-check sources, compare data, set up the structure and polish the language. The system we use is configured by us, with instructions, examples and procedures built around the way we write. Our team checked every source, corrected the text and approved the published version. The assessments and choices are Cloudfactory's, and we are accountable for them.
For transparency: the model we use is Claude, made by Anthropic, the company this article is about. That is why every claim rests on the third-party sources cited below.
Frequently asked questions
Was Anthropic hacked?
There is no evidence of it. The confirmed channel is Cursor's extension marketplace, and Cursor says the malicious build was not developed by Anthropic. As of 30 October Anthropic had published no statement.
I use Claude Code from the terminal: am I at risk?
According to published analyses, no: the npm package never had a 2.1.313 version. The risk concerns the extension installed in Cursor.
I use the extension in VS Code: am I at risk?
There is no sign that the malicious build was ever on Microsoft's Visual Studio Marketplace. Checking for the svc-telemetry key still only takes a few seconds.
Is updating to 2.1.314 enough?
No. The backdoor installs scripts and start-up mechanisms that are independent of the extension: they have to be removed by hand or with Cursor's scripts, and credentials have to be rotated.
Sources
- Cursor, security notice on Anthropic.claude-code 2.1.313
- Socket, Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace
- The Hacker News, Official Claude Code Extension on Cursor Marketplace Trojanized
- Phorion, Official Claude Code Extension Compromise
- OpenSourceMalware, Trojanized Claude Code Extension Plants an SSH Backdoor
- Kevin Beaumont on cyberplace.social
- Help Net Security, Claude Code extension poisoned with persistent SSH backdoor
- ThreatLandscape, technical analysis and clean-up
- Rescana, Trojanized Claude Code Extension 2.1.313
- CellCog, Claude Code Extension Backdoored
- The Hacker News, Binance Suffers Security Breach
- Euronews, How the Binance hack happened
- crypto.news, Binance hack and EIP-7702