On 29 October 2026, a tampered version of the official Claude Code extension for VS Code was distributed through the Cursor marketplace. Anyone who installed it or received it via auto-update got a remote access trojan on their machine: an SSH backdoor that makes itself persistent and phones home. We summarise what happened, then focus on what matters to our customers: Goldoak Spectacles detected and blocked the trojan within hours of disclosure, before most companies even knew there was a problem.
The Backdoor in the Claude Code Extension in Brief
Anthropic's Claude Code extension is used by developers worldwide to work with the AI assistant directly in VS Code, Cursor and similar editors. On 29 October 2026, version 2.1.313 sat on the Cursor marketplace (Open VSX) for around eleven hours with injected malicious code. As far as is currently known, the Microsoft Visual Studio Marketplace was not affected. According to Cursor, up to 5,000 systems received this version, many of them automatically through the editor's auto-update.
The malicious code runs as soon as the extension is loaded, before its actual functionality starts. It essentially does four things:
- Reconnaissance: It collects the hostname, username, operating system, home directory, the names of environment variables, working directories, the e-mail address configured in Git and the public IP.
- Planting the backdoor: It appends an attacker-controlled SSH key with the comment
svc-telemetryto theauthorized_keysfile, tries to enable the local SSH service and opens a reverse SSH tunnel to a server run by the attacker. - Staying persistent: On macOS it creates a LaunchAgent with the innocuous name
com.apple.sysmond, on Windows a scheduled task namedSysMonwith a fallback via the Startup folder, on Linux a cron entry. All of them retry the tunnel roughly every minute. - Reporting: It sends the collected data and the backdoor status via HTTP POST to a beacon endpoint on port 8099.
Because of bugs in the malicious code, enabling the SSH service fails on most machines, as it requires admin rights. The reconnaissance data, the foreign SSH key and the persistence mechanisms still land on the system.
Anthropic has since replaced version 2.1.313 with 2.1.314. That removes the malicious code from the extension, but not what it left behind on machines that were already affected. Anyone who had that version needs to clean the machine and rotate every credential reachable from it.
Sources:
- Kevin Beaumont, DoublePulsar: Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide
- Cursor: Security notice on the malicious version 2.1.313
- Help Net Security: Claude Code extension poisoned with persistent SSH backdoor
This is a textbook supply chain attack: nobody clicked anything wrong. The update came from the official publisher, through the official marketplace, and was installed automatically. That is exactly what makes it so dangerous.
How Goldoak Spectacles Protected Our Customers Against the Trojan
Goldoak Spectacles monitors our customers' endpoints around the clock with an agent that sees every process start, every file change and every network connection. When the first analyses of the tampered extension became public, we rolled out targeted detection rules to all customer systems within a few hours. They trigger on exactly the traces this trojan leaves behind:
- An editor process such as Cursor or VS Code writes to
authorized_keysor drops SSH keys. - A new LaunchAgent, scheduled task or cron entry is created from an editor process.
sshorautosshstarts with a reverse tunnel parameter.- A process connects to the known attacker infrastructure or sends to the beacon endpoint on port 8099.
Detection alone is not enough. On a hit, Spectacles automatically isolates the affected device from the network. The machine stays on and stays connected to our platform, but the attacker gets no further: no tunnel to the outside, no access to code, credentials or internal systems, no lateral movement. Minutes pass between detection and isolation, with no human intervention required.
For our customers, this meant that developer machines with the affected version did not become the entry point into the company. Cleanup could happen calmly, not in a race against someone who is already in via SSH. And all of this without an in-house security department, because the rules, the monitoring and the response come from us.
In short: Goldoak Spectacles protects against the backdoor in the Claude Code extension by recognising the trojan's behaviour on the endpoint and automatically isolating the device before an extension update turns into a security incident.
How We Determined Whether Our Customers Were Affected
Updating to 2.1.314 closes the door. It says nothing about whether someone was inside before and what they took with them. That is exactly what our customers wanted to know.
Because Spectacles continuously stores all process, file and network events, we retroactively checked every monitored device:
- Was version 2.1.313 of the extension installed?
- Was the
authorized_keysfile modified, and does it contain thesvc-telemetrykey? - Were the
com.apple.sysmondLaunchAgent, theSysMontask or a corresponding cron entry created? - Were there connection attempts to the attacker infrastructure or the beacon endpoint?
The result is a clear statement per device: not affected, or affected with the complete chain from extension update to file change to network connection. For affected devices, this provides the basis for cleanup and for deciding which credentials, tokens and SSH keys need to be rotated. For unaffected devices, our customers have solid evidence to show management, auditors and their own customers.
Without such a record, all that is left is guesswork. The extension version might still be traceable, but not what the malicious code did on the machine afterwards or whether the tunnel ever came up.
In short: with Goldoak Spectacles, every developer machine can be checked for whether the tampered Claude Code extension was active and what it left behind.
Frequently Asked Questions About the Claude Code Extension Backdoor
Am I affected? Only if version 2.1.313 of the Anthropic.claude-code extension was installed or auto-updated via the Cursor marketplace or Open VSX on 29 October 2026. The quickest check: search ~/.ssh/authorized_keys for the entry svc-telemetry.
Is updating to 2.1.314 enough? No. The update only removes the malicious code from the extension. The foreign SSH key, the persistence mechanisms and the exfiltrated data remain. Affected machines need to be cleaned up, and Cursor provides scripts for this. Afterwards, rotate every credential reachable from that machine: SSH keys, cloud tokens, API keys, Git credentials.
What was stolen? At minimum the hostname, username, operating system, Git e-mail, public IP and the names of environment variables. Whether an attacker actually accessed the machine via SSH can only be determined with a record of process and network events.
Would antivirus have prevented this? Classic signatures did not know the code on day one. What helps is behavioural detection: an editor that writes SSH keys and creates autostart entries is suspicious, no matter which file triggers it.
What is the lesson? Auto-updates are the right choice, but they make every publisher part of your own attack surface. Developer machines with access to code, cloud and production therefore need the same monitoring as servers.
Conclusion
This case shows what matters in a supply chain attack: patching only helps against the next infection, not the one that is already there. What counts is that a single infected machine does not endanger the whole company, and that it is possible to establish afterwards what happened. Goldoak Spectacles delivered both for our customers, within hours of the backdoor becoming known.
Does your team use Cursor or VS Code with the Claude Code extension, and you are not sure whether version 2.1.313 was in use? Contact us and we will check your devices for traces of the backdoor. In an acute incident, our incident response team is available around the clock.