A poisoned build of a popular AI coding assistant slipped past official marketplaces and tried to plant SSH backdoors on thousands of developer machines — a stark reminder that approved software can still be dangerous.
An AI tool has no legitimate reason to write to SSH keys or open a reverse tunnel. Organizations need controls that govern what these applications can do.”— Ron Reinfeld, CEO MorphisecBOSTON, MA, UNITED STATES, October 30, 2026 /EINPresswire.com/ — Morphisec, a frontrunner in preemptive cyber defense, has issued a critical security advisory in the wake of a disclosed software supply-chain attack involving the Claude Code extension for AI-assisted development. The incident came to light on October 29, when a malicious iteration of the extension — specifically version 2.1.313 — was pushed through the Open VSX registry and the Cursor extension marketplace for roughly 11 hours. Cursor has acknowledged the breach and estimates that up to 5,000 users may have been impacted.
Cursor has clarified that the rogue version was not authored by Anthropic. Rather than using a deceptive look-alike name, the malicious build was published under the extension’s legitimate publisher identity, and the method of its entry into the registry remains publicly unexplained. The discovery was brought to light by security researcher Kevin Beaumont and researchers at Phorion.
The compromised build specifically targeted Windows and macOS developer environments. Its malicious capabilities included:
• Gathering data about developer workstations and transmitting it to a server under attacker control.
• Inserting an attacker-controlled key into the user’s SSH authorized_keys file.
• Attempting to activate SSH and create reverse SSH tunnels for covert remote access.
• Deploying persistence mechanisms, such as macOS LaunchAgents and Windows scheduled tasks, to retain access.
According to Cursor, enabling the SSH server typically failed without administrator privileges, yet the unauthorized key and persistence mechanisms were still successfully installed. The attacker’s server has since been taken offline. Since simply removing or updating the extension does not eliminate the installed backdoor, affected hosts demand thorough investigation and remediation.
“This incident shows that approved is not the same as safe,” said Ron Reinfeld, CEO of Morphisec. “The tool was real, the publisher’s name was real, and the marketplace was official. A single malicious build turned a trusted AI coding assistant into a delivery mechanism for a backdoor. An AI tool has no legitimate reason to write to SSH keys or open a reverse tunnel. Organizations need controls that govern what these applications can do once they run, not just whether they are allowed to run.”
Recommended Actions
Morphisec strongly advises all organizations to scrutinize developer environments, particularly those using Cursor or extensions sourced from Open VSX. Key indicators of compromise include:
• Compromised extension: Anthropic.claude-code version 2.1.313
• Unauthorized SSH key: svc-telemetry in authorized_keys
• Attacker infrastructure: 134[.]209[.]82[.]225
• Persistence: suspicious SSH tunnels, the macOS LaunchAgent com.apple.sysmond, or the Windows scheduled task SysMon
If compromise is detected, affected systems should be isolated, persistence mechanisms removed, and any credentials accessible from the host rotated from a trusted system. Cursor’s advisory contains complete indicators and remediation scripts.
Morphisec’s AI Usage Control and preemptive endpoint protection are engineered to prevent and disrupt this class of attack by enforcing security controls at the execution layer, including restricting unauthorized access to sensitive system locations and credential-related files and blocking dangerous process execution. Rather than trusting an AI application simply because it is approved, Morphisec governs what that application is permitted to do.
Morphisec urges customers to review the published indicators and validate their developer environments, even where endpoint security controls are already in place.
About Morphisec
Morphisec is a global leader in prevention-first security for the AI era. Founded in 2014 and headquartered in New York, Morphisec stops ransomware, zero-day exploits, fileless attacks and rogue AI agents in memory; the one layer every attack must pass through to execute. Morphisec protects more than nine million endpoints across finance, healthcare, manufacturing and technology, and backs its protection with a Ransomware-Free Guarantee. Learn more at www.morphisec.com.
Jeff Anderson
Morphisec
3322259884 ext.
Visit us on social media:
LinkedIn
X
—
**Why it matters:** This attack demonstrates that even official, trusted distribution channels can be weaponized against developers, and that AI tools introduce a new attack surface that traditional approval-based security models cannot cover. The persistence of the backdoor even after the extension is removed highlights a critical gap in endpoint response, making proactive behavioral controls essential.
Also worth a look: APILayer warns AI-coded currency tools ignore rate freshness checks and Bigly Sales gives websites a voice with Talk Kit, an AI agent that talks back.
