Trojanized Claude Code Extension Plants Persistent SSH Backdoor

TL/DR;

A maliciously modified version of Anthropic’s Claude Code extension, anthropic.claude-code version 2.1.313, was distributed through the Cursor Extension Marketplace on October 29, 2026. Cursor states that the malicious version was not developed by Anthropic, was available for approximately 11 hours, and potentially affected at most 5,000 users. The extension collected host information, planted an attacker controlled SSH key, established persistence, attempted to enable SSH and create a reverse SSH tunnel, and beaconed host information to attacker infrastructure.

Lineaje Research assesses this incident primarily as an AI software supply chain compromise. The attacker did not need to inject prompts, manipulate model reasoning, or convince an AI agent to misuse a tool. Instead, malicious code was inserted into a component trusted by the AI development environment. Installation or update of that component provided the execution path.

This changes where security controls must begin. Runtime AI guardrails alone cannot protect an organization when the AI component itself has already been compromised. Lineaje treats the AI assets, including extensions, skills, MCP servers, models, packages, and their dependencies, as executable supply chain artifacts whose provenance, integrity, reputation, behavior, and changes undergo continuous verification.

What Happened

On October 29, a maliciously modified build of the Claude Code extension, version 2.1.313, became available through Cursor’s VS Code Extension Marketplace. Cursor reported an exposure window from approximately 2:27 a.m. to 1:35 p.m. PT and stated that at most 5,000 users were potentially affected. Cursor explicitly confirmed that the malicious version was not developed by Anthropic.

Once executed, the malicious code collected system information including hostname, username, operating system, architecture, home directory, working directories, configured Git email, public IP address, and selected environment variable names. It added an attacker controlled SSH public key labeled svc-telemetry to authorized_keys. It also attempted to enable the local SSH service and establish a reverse SSH tunnel to attacker infrastructure at 134[.]209[.]82[.]225.

The payload established persistence independently of the extension. On macOS it created a LaunchAgent; on Windows it attempted to create a scheduled task with a startup script fallback. Background scripts were designed to retry the tunnel approximately every 60 seconds. The malware also attempted to report host information and backdoor status through an HTTP POST to port 8099.

The attempted activation of the local SSH service generally failed because it required administrator privileges that the extension normally did not possess. Cursor states that, except under unusual circumstances where Cursor itself was launched with administrator privileges, the attacker could not log in through this mechanism. This limitation did not ****prevent the malicious extension from planting the SSH key, creating persistence, and sending host information.

Cursor removed the malicious version, shut down and rebuilt its marketplace, rotated keys, audited access, and worked with the infrastructure provider to take the attacker controlled server offline. Cursor reported no evidence that other extensions were tampered with.

Lineaje Research Assessment

The AI Component Became the Attack Vector

The significant characteristic of this incident is not Claude's behavior. Claude did not need to be manipulated at all. The trusted AI development component itself became the delivery mechanism.

From the developer's perspective, installing or updating an apparently legitimate AI coding extension was sufficient to introduce malicious code onto the workstation. No adversarial prompt or unsafe model response was required. Cursor's investigation confirms that the malicious package attempted its actions directly after installation.

Trust Was Inherited From Component Identity

The package retained the recognizable anthropic.claude-code identity while containing malicious modification. OX Security describes the incident as a modified build distributed under the real extension name. This exposes a critical AI ecosystem assumption that known identity does not guarantee known behavior.

AI development environments increasingly compose models, extensions, skills, MCP servers, open source packages, APIs, and tools. Trusting a component because its name, publisher relationship, or previous version was legitimate creates an opportunity when the distribution path or artifact changes.

For Lineaje, therefore, AI component trust should incorporate artifact level verification and continuous classification, not simply component identity.

The Compromise Occurred Before the AI Runtime Security Boundary

Another important finding is where the attack occurred. Prompt filtering, reasoning integrity checks, tool authorization policies, and agent guardrails operate primarily once an AI interaction is underway. Here, malicious JavaScript executed as part of the extension itself.

This incident reinforces the need for two complementary control planes:

AI Supply Chain Security

Discover, inventory, classify, verify and continuously monitor AI related software components before they execute.

AI Runtime Security

Control what legitimate AI agents, models and tools are allowed to access and perform after execution begins.

UnifAI controls are directly relevant where AI component discovery, reputation/classification, network destinations, or governed agent interactions are observable. Endpoint controls remain necessary for actions occurring directly from malicious extension code outside the AI gateway.

Lineaje AI Kill Chain Analysis

The attack bypassed several AI native stages because malicious software execution replaced the need to manipulate the model.

Stage	Tactic	Technique	Procedure	Mitigation
1. Reconnaissance	Environment Discovery	Execution Environment Mapping	The malicious extension collected hostname, username, OS, architecture, directories, Git identity, public IP, and selected environment-variable names.	EDR detects host enumeration. UnifAI AI Component Reputation can break the chain upstream by blocking the malicious extension before execution.
2. Trust Establishment & Manipulation	Implicit Trust Abuse	Trusted ecosystem impersonation	A maliciously modified extension was distributed under the recognizable `anthropic.claude-code` identity through Cursor's marketplace.	UnifAI AI Component Reputation and Classification can identify malicious or suspicious components before trust and deployment.
3. Input & Instruction Weaponization	Supply Chain Weaponization	Package Artifact Poisoning	Malicious executable code was embedded in the extension package, converting installation or update into the payload-delivery mechanism.	UnifAI component scanning and classification can directly identify malicious or suspicious artifacts before they enter the developer environment.
4. Reasoning-Time Execution	Not Needed	Not Needed	No evidence indicates that Claude reasoning was manipulated or required for execution of the malicious payload.	No direct mitigation required for the observed attack path. Reasoning integrity policies would protect against separate model manipulation techniques.
5. Tool Invocation & Environment Interaction	Capability Execution Abuse	Unauthorized Tool Invocation	The extension directly executed host operations, including SSH configuration and persistence related commands.	Endpoint controls detect direct command execution. UnifAI Tool Allowlist ensures that tool invocation passes through the governed AI runtime.
6. Privilege Escalation	Unauthorized Access Expansion	Privilege Boundary Traversal	The payload attempted to enable SSH and create privileged persistence mechanisms; some operations failed without administrator privileges.	Least privilege and endpoint controls directly constrain escalation.
7. Lateral Movement	Not Observed	Not Observed	Published evidence does not establish movement from the compromised developer workstation to another system.	Network segmentation and credential isolation reduce lateral movement. UnifAI's URL and Tool Allowlist policies can help constrain lateral movement.
8. Persistence	Access Retention	Durable State Modification	The payload added an SSH authorized key and created LaunchAgent, scheduled-task, or Startup-based persistence.	EDR and host integrity controls can detect persistence.
9. AI-Native Command & Control	External Control Channel	Tool-Mediated C2	The malware attempted a reverse SSH tunnel and HTTP beacon to attacker-controlled infrastructure.	Network egress controls directly block C2. UnifAI Destination Allowlist ensure that outbound traffic traverses the governed AI runtime.
10. Actions on Objectives	Data Theft	Data Exfiltration	Host information was transmitted externally while SSH-based remote-access capability and persistent tunneling were attempted.	UnifAI's egress controls via URL allowlist block unauthorized transfer. UnifAI Data policies mask or redact PII.

‍

Lessons and Conclusion

The Claude Code extension incident demonstrates that securing AI applications cannot begin at the prompt. The attack did not need to defeat Claude's safety mechanisms, hijack reasoning, poison a tool call, or persuade an agent to perform an unsafe action. Instead, the attacker placed malicious functionality inside software trusted by the AI development environment. Once that component executed, conventional malware techniques like system discovery, SSH key modification, persistence, beaconing and reverse tunneling became available.

From Lineaje Research's perspective, this represents the convergence of AI ecosystem risk and traditional software supply chain compromise. As AI development environments become increasingly composable, every model, package, extension, skill, MCP server and tool expands the executable trust boundary. A previously trusted name or previous clean version cannot establish the integrity of the artifact executing today.

The security model therefore needs to shift from "Is this a trusted AI component?" ****to "Is this specific version of this component, from this provenance, with this behavior, safe to execute?"

That is where software supply chain intelligence and AI runtime protection must converge. Lineaje's approach of discovering, scanning, classifying and establishing reputation for AI ecosystem components provides a control point before execution, while UnifAI runtime policies govern what legitimate AI systems can access and do after execution.

This incident also establishes an important boundary for AI security architecture: runtime guardrails cannot always compensate for an already compromised runtime component. Supply chain verification must establish trust before execution, least privilege and endpoint controls must constrain the component during execution, and runtime AI policies must govern legitimate agent interactions.

The broader lesson is simple - In an agentic ecosystem, in addition to securing what the AI can do, we must also continuously verify the software we trust to give the AI those capabilities.

Trust the version, not the name. Verify it before it runs.

When a malicious build can ship under a trusted AI extension’s name, a routine install or update becomes the attack.