Claude Code Extension Backdoor: Fix, Impact, Interview Qs

TL;DR

What happened: A tampered Claude Code extension, version 2.1.313, shipped an SSH backdoor on October 29, 2026.
Who is affected: Users of VS Code forks such as Cursor; at most 5,000 Cursor users received it.
What to do now: Grep authorized_keys for svc-telemetry, remove persistence, rotate credentials.
Interview angle: Software supply chain trust, plugin privilege and why “uninstall” is not incident response.

The Claude Code extension backdoor was a malicious build, 2.1.313, of the Anthropic.claude-code extension. It planted an attacker SSH key, opened a reverse SSH tunnel and installed persistence. Cursor says it was not developed by Anthropic. If you installed it, check for the svc-telemetry key and follow the full cleanup, not just an uninstall.

— Ashutosh Tiwari, NexGismo

A software supply chain attack compromises something you trust, such as a package, extension or build pipeline, instead of attacking you directly. The malicious code arrives through a normal update channel, signed or published under a familiar name. Your own tooling installs it for you.

The Claude Code extension backdoor is the most practical security story for developers this week. It hit an AI coding tool many of us run daily. It also climbed to 570 points on Hacker News within hours. Below is what is confirmed, what to check, and the interview questions it prepares you for.

What changed and who is affected?

The facts come from three primary write-ups: Cursor’s security notice, Phorion’s analysis and StepSecurity’s registry analysis. They broadly agree on the payload. They differ slightly on distribution channels, so we flag that below.

Claude Code extension versions around the incident (sources linked)
Version	Status	Date (UTC)	Source
2.1.312	Clean	October 27, 2026	StepSecurity
2.1.313	Malicious loader in `extension.js`	Live from about 09:27 to 20:35 on October 29	StepSecurity, Cursor
2.1.314	Clean replacement	October 30, 2026, 01:07	StepSecurity

Cursor says the build sat in its marketplace between about 2:27am and 1:35pm PT. Phorion and StepSecurity report it was also listed on Open VSX, which Cursor mirrors. Help Net Security reports that Microsoft’s Visual Studio Marketplace never carried it. Phorion adds that Anthropic pulled the 2.1.313 release from Open VSX, npm and VS Code registries.

StepSecurity notes that how the build entered the registry has not been publicly established. Treat any claim about the root cause as unconfirmed until Anthropic or the Eclipse Foundation publish one.

How does it work?

This is a classic trojanized update. Per Phorion, the attacker prepended an immediately invoked function to the minified bundle. Everything else looked like the real extension.

The attack flow at advisory level

The editor auto-updates to 2.1.313 from its extension registry.
Node loads extension.js. The injected code runs before the extension’s activate callback. No click is needed.
It appends an attacker public key to ~/.ssh/authorized_keys.
It opens an outbound reverse SSH tunnel, so the attacker can reach the local SSH port.
It installs persistence: a LaunchAgent on macOS, cron on Linux, a scheduled task or Startup script on Windows.
It sends host details and up to 40 environment variable names matching key or token patterns. Names only, not values.

There was one saving grace. Turning on the SSH service needs admin rights the extension lacks on most macOS and Windows hosts. Phorion traced a faulty Remote Login check on macOS that usually skips that step. Cursor also says the attacker server was taken offline. Neither fact removes the planted key or persistence.

Safe check: are you affected?

This is Cursor’s own published check. It only reads a file.

# macOS / Linux: look for the planted key
grep -qs svc-telemetry ~/.ssh/authorized_keys \
  && echo "svc-telemetry key found" \
  || echo "No key found"

# Look for the persistence artifacts Phorion lists
ls -la ~/.config/.smt ~/.config/.smtk \
  ~/Library/LaunchAgents/com.apple.sysmond.plist 2>/dev/null

What should developers do right now?

Detect. Find every machine that installed 2.1.313. Grep installed extension bundles for the indicator strings StepSecurity lists.
Isolate. Cursor advises you to isolate hosts showing evidence of payload execution before cleanup.
Remove persistence. Delete the key, the .smt scripts, the LaunchAgent, cron entry or SysMon task. Cursor provides remediation scripts for macOS and Windows.
Kill tunnels. Stop any ssh or autossh process using remote port forwarding to the listed IP.
Rotate credentials. Do it from a clean machine. Prioritise the token types the beacon inventoried: Git, CI, cloud and registry tokens.
Verify. Check SSH logs for logins from localhost using the svc-telemetry key, as Phorion recommends.
Upgrade. Reinstall 2.1.314 or later. Consider rebuilding any host where the tunnel connected.

If you run local AI agents, revisit your setup too. Our guide to a local AI coding agent setup on macOS covers isolation habits that limit blast radius.

Interview questions this update prepares you for

1. What is a software supply chain attack, and why is it hard to stop?

It is an attack that rides a trusted delivery path: a package registry, extension marketplace, CI pipeline or update server. The victim’s own tooling installs the payload, often under a legitimate name. Perimeter controls rarely help, because the traffic and the publisher look normal. Defences sit at several layers. Pin versions and verify integrity hashes. Use provenance or signing where available. Delay auto-updates for critical tools. Monitor behaviour after install, not just at download time. A strong answer names both prevention and detection.

Follow-up they may ask: How do lockfiles and integrity hashes help, and where do they fall short?

2. Why is “uninstall the package” not a complete remediation?

Once code executes, it can create state outside the package directory. Common examples are scheduled tasks, launch agents, cron jobs, new SSH keys and stolen tokens. Removing the original package deletes the entry point, not the footholds. Real incident response follows a sequence: contain, collect evidence, eradicate every artifact, rotate secrets and verify. When you cannot prove the host is clean, rebuild it. Interviewers want to hear that you think in terms of persistence and credentials, not files.

Follow-up they may ask: Which secrets would you rotate first, and why?

3. Why are IDE extensions a high-value target?

Extensions usually run with the same OS permissions as the editor and the user. Developer machines hold source code, SSH keys, cloud credentials and CI tokens. That makes one compromised extension a bridge into production systems. The principle at stake is least privilege. Plugin systems that grant broad file, network and process access by default turn every plugin into a trusted insider. Good answers mention capability-based permissions, workspace trust and separating credentials from the development host.

Follow-up they may ask: How would you design a permission model for a plugin system?

4. What is a reverse tunnel, and why does it bypass inbound firewall rules?

A reverse tunnel is a connection the victim machine opens outward to a remote server. The remote side then forwards traffic back through that established connection. Most firewalls block unsolicited inbound traffic but allow outbound connections. So the session looks like a normal outbound client. Defenders counter it with egress filtering, alerts on unusual outbound SSH, and process-level telemetry that ties a network connection to its parent process.

Follow-up they may ask: What is the difference between ingress and egress filtering?

5. Signature-based or behavioural detection: which catches this kind of attack?

Signature detection matches known hashes or strings. It works once indicators are published but misses new variants. Behavioural detection flags suspicious actions regardless of hash. Examples include an editor helper process writing to the SSH key file, or a non-Apple process creating a launch agent with an Apple-style name. Mature teams use both. Signatures give fast fleet sweeps after disclosure. Behavioural rules catch the next variant before anyone has published a hash.

Follow-up they may ask: Give an example of a high-signal behavioural rule for developer laptops.

The NexGismo verdict: My recommendation is to treat your editor’s extension list like a dependency manifest. Pin the tools that touch credentials, review updates for AI agents and keep long-lived tokens off developer laptops. This incident was limited by a lucky bug, and I would not plan around luck.

Claude Code extension version 2.1.313 contained a malicious loader; Cursor says Anthropic did not develop it.
Cursor reports at most 5,000 of its users received the build during an 11-hour window on October 29, 2026.
The payload planted an SSH key, opened a reverse tunnel, installed persistence and beaconed host details.
Uninstalling the extension does not remove the standalone persistence scripts or the planted key.
Clean builds are 2.1.312 and 2.1.314, according to StepSecurity’s registry analysis.

Frequently Asked Questions

Was the official Claude Code extension hacked?

A tampered build, version 2.1.313, was published under the Anthropic.claude-code name on October 29, 2026. Cursor says this version was not developed by Anthropic. How it reached the registry has not been publicly established. Clean builds 2.1.312 and 2.1.314 do not contain the indicators, according to StepSecurity’s analysis.

How do I know if my machine is affected by the Claude Code extension backdoor?

Check your SSH authorized_keys file for a key labelled svc-telemetry. On macOS or Linux, grep ~/.ssh/authorized_keys for that string. If it is present, treat the machine as compromised. Also look for ~/.config/.smt and a LaunchAgent named com.apple.sysmond.plist on macOS.

Does uninstalling the Claude Code extension remove the backdoor?

No. Phorion and Cursor both warn that the payload drops standalone persistence: a startup script, a LaunchAgent, scheduled task or cron entry, plus a planted SSH key. You must remove each artifact, kill tunnel processes and rotate credentials. Cursor publishes remediation scripts for macOS and Windows.

Are VS Code extensions sandboxed?

Not in a way that stops this attack. Phorion notes that extensions run with the permissions of the IDE and the user running it. That gives a malicious extension access to local files, source code and developer tooling as soon as its module loads, without any user interaction.

The Claude Code extension backdoor shows that AI tooling is now part of your attack surface. The fix is boring and effective: check for the key, remove persistence, rotate secrets, then tighten how extensions update. For more on agent-era risks, read our breakdown of AI browser agent security and the Node.js permission model gotchas. Subscribe to NexGismo if you want these updates with interview prep built in.