Trusted Tool, Malicious Build: What the Trojanized Claude Code Extension Means for Developer Endpoints

On October 29, 2026, a malicious build of the Claude Code extension, version 2.1.313, was distributed to developers through the Open VSX registry and the Cursor extension marketplace. For roughly 11 hours, anyone who installed or auto updated the extension in Cursor could have received code designed to give an attacker persistent remote access to their workstation.

Cursor has confirmed the incident and says at most 5,000 users were affected. Per Cursor, the malicious version “was not developed by Anthropic.” It appeared under the extension’s legitimate publisher identity rather than a look-alike name, and how it entered the registry has not been publicly established. Security researcher Kevin Beaumont and researchers at Phorion were among the first to raise the alarm.

This is the kind of incident that bypasses the usual instincts. The tool was real. The publisher’s name was real. The install came from an official marketplace. The only thing wrong was what the code did once it ran.

What the malicious build did

The tampered extension targeted Windows and macOS developer environments. According to Cursor’s advisory, it:

• Collected host and user details and sent them to an attacker-controlled server.
• Added an attacker-controlled public key, labeled svc-telemetry, to the user’s SSH authorized_keys file.
• Tried to enable the local SSH server and open a reverse SSH tunnel back to the attacker.
• Installed persistence (a macOS LaunchAgent or a Windows scheduled task) that retried the tunnel about every 60 seconds.

Enabling the SSH server requires admin rights, which the extension usually lacked, so that step generally failed. The attacker key and persistence were still installed. Cursor has since worked with the hosting provider to take the attacker server offline. Even so, any machine that ran the build should be treated as potentially exposed.

Check your environment now

Prioritize developer machines running Cursor, or any editor that pulls extensions from Open VSX.

Cursor’s advisory lists file hashes, key fingerprints and platform remediation scripts. Use it as the authoritative IOC list.

If you find a match

1. Isolate the host before anything else.
2. Remove the key and persistence. Uninstalling or updating the extension does not remove the backdoor. Cursor provides remediation scripts for macOS and Windows; consider rebuilding the host.
3. Rotate credentials and sessions reachable from that machine, from a trusted system: SSH keys, cloud and API tokens, Git credentials, and anything stored in the developer’s environment.
4. Hunt across the fleet for the indicators above in endpoint, network and extension-install logs.

The bigger lesson: approved is not the same as safe

Developer workstations are high-value targets. They hold source code, signing keys, cloud credentials and trusted access to production. AI coding tools make them more valuable still, because these tools are designed to read files, run commands and act with the developer’s own permissions.

Most organizations govern AI tools at the approval stage: is this tool allowed? This incident shows why that isn’t enough. The extension was approved, official and widely trusted. A single malicious build turned it into a delivery mechanism.

The better question is: what is this application allowed to do once it runs? An AI coding assistant has no legitimate reason to write a new key into authorized_keys, register a scheduled task named after a system monitor, or open a reverse SSH tunnel to an unknown server.

How Morphisec helps

Morphisec takes a preemptive, prevention-first approach to endpoint security. Rather than trusting an AI application because it is approved, Morphisec focuses on controlling what that application can do.

Morphisec’s AI Usage Control and preemptive endpoint protection are designed to prevent and disrupt this class of compromise at the execution layer, including:

• Restricting unauthorized access to sensitive system locations and credential-related files, such as SSH configuration.
• Blocking dangerous process execution and persistence attempts launched by AI tools and their extensions.
• Enforcing policy on AI applications based on behavior, not reputation.

We still encourage every customer to review the published indicators and validate their developer environments, even where endpoint controls are deployed. Defense in depth means verifying, not assuming.

About the author

Michael Gorelik

Chief Technology Officer

Morphisec CTO Michael Gorelik leads the malware research operation and sets technology strategy. He has extensive experience in the software industry and leading diverse cybersecurity software development projects. Prior to Morphisec, Michael was VP of R&D at MotionLogic GmbH, and previously served in senior leadership positions at Deutsche Telekom Labs. Michael has extensive experience as a red teamer, reverse engineer, and contributor to the MITRE CVE database. He has worked extensively with the FBI and US Department of Homeland Security on countering global cybercrime. Michael is a noted speaker, having presented at multiple industry conferences, such as SANS, BSides, and RSA. Michael holds Bsc and Msc degrees from the Computer Science department at Ben-Gurion University, focusing on synchronization in different OS architectures. He also jointly holds seven patents in the IT space.