TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Phorion reported a backdoor in Claude Code for VS Code extension versions 2.1.312 and 2.1.313 distributed through the Cursor Marketplace. The payload attempts to add an SSH key and establish persistence across operating systems; Cursor has removed the affected versions, but the macOS setup may fail to enable SSH on some machines.
Security firm Phorion reported a backdoor in Claude Code for VS Code extension versions 2.1.312 and 2.1.313 distributed through the Cursor Marketplace. Cursor has removed the versions, which the company’s updated notice identifies as affected on macOS and Windows; Phorion says the extension payload attempts to install a persistent SSH access mechanism across macOS, Linux and Windows.
Phorion says the compromised extension bundle contains an injected script at the start of its extension.js file. The code runs when the extension module loads, before the extension’s normal activation callback, and does not require the user to interact with its interface. Because editor extensions can operate with the permissions of the user running the IDE, a malicious extension may be able to access local files, source code and developer tools—a risk explored in the security risks of coding agents.
According to Phorion’s analysis, the payload creates or uses the user’s .ssh directory and appends an attacker-controlled Ed25519 public key to authorized_keys. It then attempts to turn on an SSH service: using system services on Linux, Remote Login on macOS, and OpenSSH Server on Windows. The report says the code includes no privilege-escalation exploit, so service activation may fail when the user lacks the required permissions.
Phorion’s October 31 update says Cursor’s security notice now lists both 2.1.312 and 2.1.313 as affected, broadening the report’s earlier version guidance. Cursor has removed those versions from its marketplace, amid reports that Alibaba plans to ban Claude Code at work over alleged backdoor risks. Phorion recommends that organisations check whether the extensions were used and involve incident-response teams if they find them, following guidance on what Cursor users should check.
Risk to Developer Workstations
The reported payload targets the systems developers use to access private code, credentials and build tools. If the SSH key is added and the machine’s SSH service is reachable, someone with the matching private key may be able to authenticate as the affected user. That could create a route into a developer workstation and, depending on that user’s access, connected systems or repositories.
Removal from the marketplace limits new downloads there, but does not by itself remove an already installed extension or undo changes made on a device. Phorion says the payload also includes persistence and host-reconnaissance reporting. The extent of any access or data exposure is not established in the supplied material, so organisations should treat discovery as a reason to investigate rather than assume either that access succeeded or that it was prevented.
Products Worth Considering
Ledger Flex + Folio Crypto Hardware Wallet
Apple MacBook Pro 16-inch (2021) with M1 Max, 64 GB RAM, 2 TB SSD – Space Grey
Apple MacBook Pro 16.2-inch with M5 Pro Chip (18-Core CPU, 20-Core GPU), 48GB RAM, 1TB SSD, Nano-Texture Display, Space Black
As an affiliate, we earn on qualifying purchases.
How the Extension Payload Runs
The affected product is an extension for Claude Code in VS Code distributed through the Cursor Marketplace, which supplies extensions for the Cursor editor. Phorion describes the malicious code as an injected prefix placed ahead of an otherwise ordinary-looking extension bundle, including familiar Claude Code and VS Code components. That placement allows the payload to run as the module loads, rather than waiting for a user to click a control.
Phorion’s technical account focuses mainly on macOS and flags platform-specific problems in the persistence logic. On macOS, the script checks whether Remote Login is off before trying to enable it. But, Phorion reports, systemsetup -getremotelogin can return an administrator-access error when run without elevation; the script then may not see the word “Off” and may skip its enablement attempt. The report says the key and persistence changes can still be made even if that inbound SSH step fails.
The report also identifies implementation limitations on other platforms: service activation may require privileges the extension does not have, and Phorion says the Windows setup command is passed through a helper that uses /bin/sh. These observations describe possible failures in particular setup paths; they do not establish that every infected system is protected from access.
“The goal of this payload is long-term interactive access.”
— Phorion
Exposure and Access Still Unverified
The supplied report does not state how many users downloaded or ran the affected versions, how long they were available, or whether an attacker used the embedded key to access any device. It also does not provide a confirmed account of data theft, follow-on activity or affected organisations. Cursor’s removal of the versions does not establish whether previously installed copies were disabled or cleaned up.
Phorion notes that the macOS Remote Login check may fail under a standard-user account, but that limitation is not proof that all macOS installations are safe. The outcome may depend on existing SSH settings and user permissions. The source material also does not provide the public-key fingerprint, so the report’s suggested check should not rely only on the svc-telemetry comment found in the key entry.
Check Devices and Investigate Findings
Organisations should identify systems where Claude Code for VS Code version 2.1.312 or 2.1.313 was installed or used, including copies obtained through the Cursor Marketplace. Phorion advises engaging incident response if use is found. Investigators can review SSH configuration and authorized keys, verify suspicious keys by fingerprint rather than comment alone, and assess relevant system and extension activity.
The next public milestones would be any further updates to Cursor’s security notice and additional findings from Phorion or affected organisations. The supplied material does not give a timeline for those updates or describe a remediation process from Cursor beyond removing the affected versions. Until more details are published, the number of affected installations and the extent of any successful access remain open questions.
Key Questions
Which Claude Code extension versions are identified as affected?
Phorion’s October 31, 2026 update says Cursor’s security notice identifies versions 2.1.312 and 2.1.313 distributed through its marketplace as affected. The notice, as described by Phorion, covers macOS and Windows.
What does the reported backdoor attempt to do?
Phorion says the payload adds an attacker-controlled SSH public key to the user’s authorized keys and attempts to enable an SSH service, with setup paths for macOS, Linux and Windows. It also reports persistence and host-reconnaissance activity.
Does the macOS bug mean affected computers are safe?
No. Phorion says an unprivileged macOS check may fail to detect that Remote Login is off, preventing one attempt to enable SSH. The report says the key and persistence changes may still be made, and the flaw does not establish that every affected system is protected.
What should an organisation do if it finds an affected version?
Phorion recommends reviewing systems for use of versions 2.1.312 and 2.1.313 and engaging incident response where use is discovered. Its report also advises checking SSH key entries by fingerprint rather than relying only on the key comment.
Is there evidence that the backdoor was used to access systems?
The supplied report does not confirm that an attacker successfully accessed devices or stole data. The number of affected users, actual access and any resulting exposure remain unclear.
Source: phorion.io
