Flawed Supply Chain Attack Leaves SSH Backdoors on 5,000 Developer Machines

Key points

• The malicious extension, versions 2.1.312 and 2.1.313, was live on Cursor's marketplace from 2:27 a.m. to 1:35 p.m. Pacific Time on October 29.
• The malware collected host information, including Git email and public IP address, and attempted to add an attacker-controlled SSH key labeled 'svc-telemetry'.
• It established persistence via macOS LaunchAgents, Windows scheduled tasks, and Linux cron jobs, while attempting to create reverse SSH tunnels to an attacker server at 134.209.82.225.
• Coding errors in the malware prevented SSH activation on most Windows and macOS systems, as it failed to run commands with elevated privileges or used incompatible shell commands.
• Cursor removed the extension, shut down its marketplace temporarily, and worked with hosting providers to take down the attacker's server.
• Anthropic confirmed the malicious package was not developed by them and that their official distribution channels were not affected.

Background

This incident follows earlier reports in late October 2026 regarding AI coding agents being vulnerable to malicious instruction files, such as AGENTS.md, which could trick tools like OpenAI Codex and Claude Code into executing rogue code or leaking credentials. The current attack represents a more direct supply chain compromise, targeting the extension marketplace of the Cursor IDE, which is built on Microsoft's Visual Studio Code. Previous archive articles from October 30 and 31, 2026, already detailed the initial discovery, the 5,000 affected users, and the remediation steps, confirming that the backdoor largely failed to execute due to technical flaws.

How outlets are covering it

BleepingComputer and Wired both emphasize the 'lucky break' caused by coding errors in the malware, which prevented full remote access on most systems. Wired highlights the uncertainty surrounding how the attacker gained access to Cursor's marketplace, noting that Anthropic staff confirmed their systems were not compromised. Microsoft's technical analysis provides a detailed breakdown of the attack chain, including the specific persistence mechanisms and the reconnaissance data collected, while also offering advanced hunting queries for Microsoft Defender XDR customers. All sources agree that the incident was limited to Cursor's marketplace and that npm and Open VSX were not affected, contrary to initial reports.

Why it matters

This incident highlights the risks of supply chain attacks in the AI-powered development ecosystem, where extensions can be used to deploy malware at scale. Even though the backdoor failed to execute fully, the exposure of reconnaissance data, including environment variable names associated with sensitive credentials, poses a significant risk. Developers and organizations using Cursor should review their systems for the presence of the 'svc-telemetry' SSH key and follow remediation steps to ensure security. The incident underscores the need for robust extension vetting and security hardening in AI coding tools.

What to watch

Developers who installed the malicious extension during the exposure window should check for the 'svc-telemetry' SSH key and follow Cursor's remediation instructions. Organizations should review endpoint and network telemetry, rotate credentials, and rebuild affected environments from safe backups. Cursor has published platform-specific checks and remediation scripts, and Microsoft has provided advanced hunting queries for its customers. Further investigation is ongoing to determine how the attacker gained access to Cursor's marketplace and whether any other extensions were affected.