{"data":{"id":"87c1c92f-1803-4df9-97ee-9397658bcc15","title":"Cursor removes malicious Claude Code extension after SSH backdoor attempt","summary":"A malicious version of Anthropic's Claude Code extension, distributed through the Cursor VS Code Extension Marketplace, attempted to install a persistent SSH backdoor on developers' Windows and macOS machines. Cursor removed the compromised versions 2.1.312 and 2.1.313 after they had been available for about 11 hours on October 29. Anthropic said its own systems and official channels were not affected.","solution":"Cursor warned that uninstalling the extension alone might not remove the malware's components, because it placed scripts outside the extension's installation directory. Exabeam's Steve Povolny recommended checking authorised SSH keys on machines accessible to affected developers.","labels":["security","industry"],"sourceUrl":"https://www.csoonline.com/article/4243210/cursor-removes-malicious-claude-code-extension-after-ssh-backdoor-attempt.html","publishedAt":"2026-11-02T11:33:58.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["supply_chain"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Claude Code","Cursor"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-11-02T11:33:58.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010"]}}