Cybersecurity Researchers Uncover Persistent SSH Backdoors Planted via Malicious Claude Code Extensions on Cursor

Recent discoveries by threat intelligence firms Phorion and OpenSourceMalware have brought to light a sophisticated supply-chain attack targeting software developers. Security analysts identified a malicious JavaScript loader injected into a popular Claude Code extension used within the Cursor integrated development environment (IDE). This covert operation was designed to establish persistent Secure Shell (SSH) backdoors on compromised Windows and macOS systems, highlighting the growing vector of using developer tools and artificial intelligence assistants as conduits for malware distribution.

The incident underscores an escalating trend where threat actors attempt to bypass traditional endpoint protection by weaponizing legitimate extensions and plugins. As software development environments increasingly integrate AI-assisted coding extensions, the attack surface expands, offering malicious entities new avenues to execute arbitrary code, establish reverse tunnels, and compromise enterprise-grade infrastructures from the inside out.

Anatomy of the Attack and Code Injection

According to technical findings released by Phorion and OpenSourceMalware, the compromise began when attackers managed to insert a malicious JavaScript loader at the very beginning of the extension’s primary extension.js file. Remarkably, the remainder of the legitimate extension code was left entirely unchanged. This deliberate surgical insertion allowed the tool to function normally from a user’s perspective, effectively masking the malicious activity running in the background.

The primary objective of the inserted script was to orchestrate the configuration and activation of an SSH reverse tunnel. By establishing this persistent backdoor, the threat actors intended to gain remote, unauthorized access to the underlying developer workstations. Given the high-privilege environment of software engineers—who frequently possess credentials, API keys, and internal network access—a successful compromise of this nature could serve as a vital stepping stone into broader corporate networks.

Despite the malicious design, coding errors within the malware’s initialization routines significantly mitigated the severity of the campaign. Phorion researchers noted that critical configuration mistakes prevented the payload from successfully enabling the SSH service on machines where it was not already running. As a result, the reverse tunnel frequently failed to establish a stable connection back to the command-and-control (C2) infrastructure, leaving many affected Windows and macOS endpoints inaccessible to the attackers.

Chronology and Discovery Timeline

The discovery of the malicious Claude Code extension is part of a broader, ongoing wave of supply-chain security incidents that have plagued developer ecosystems throughout late 2026.

• Mid-October 2026: Threat actors likely stage the modified extension, distributing it through unofficial or compromised channels associated with the Cursor IDE ecosystem.
• Late October 2026: Security telemetry at Phorion and OpenSourceMalware flags anomalous outbound network connections and structural modifications within the extension.js file of the specific Claude Code extension.
• October 30, 2026: Public disclosures begin to circulate within cybersecurity communities, notably highlighted on expert analysis platforms, detailing the mechanics of the JavaScript loader and the persistent SSH backdoor attempt.
• Early November 2026: Independent analysts confirm that while the injection was executed with high technical precision, procedural bugs in the SSH setup script neutralized the majority of the remote access attempts across Windows and macOS targets.

Broader Implications for AI-Assisted Development Environments

The exploitation of extensions within AI-driven coding environments like Cursor represents a paradigm shift in software supply-chain security. Developers routinely grant extensive file-system permissions, terminal execution rights, and network access to their IDE extensions to streamline coding workflows. When a trusted assistant extension is subverted, the traditional boundaries of endpoint defense are severely compromised.

Security experts note that this incident is indicative of a wider systemic vulnerability across modern digital infrastructure. As organizations race to adopt artificial intelligence and automated agentic workflows, software supply-chain controls have frequently failed to keep pace. Similar concerns have been raised regarding insecure data handling by third-party contractors, lax access controls in cloud-connected AI agents, and the proliferation of unpatched zero-day vulnerabilities across major operating systems, including recent privilege escalation flaws in Linux and Android environments.

Furthermore, the incident aligns with a broader pattern of state-sponsored and financially motivated threat actors targeting high-value technology targets. From sophisticated supply-chain injections to covert espionage operations targeting semiconductor executives, the digital supply chain has become a primary battlefield for intellectual property theft and persistent unauthorized access.

Industry and Official Responses

As news of the malicious extension spread across security forums and analysis platforms, affected software repositories and platform maintainers initiated emergency reviews of third-party plugins. Developers utilizing the Cursor IDE and Claude-related extensions were advised to immediately audit their installed extensions, inspect their local authorized_keys files, and review system logs for unauthorized SSH configurations.

Neither the primary AI platform developers nor the associated software vendors have reported widespread data exfiltration resulting directly from this specific campaign, largely due to the aforementioned coding errors in the malware’s deployment script. However, cybersecurity agencies and private researchers continue to monitor the threat landscape closely, warning that future iterations of similar attacks are likely to feature refined payloads capable of bypassing current detection mechanisms.

Fact-Based Analysis of Ongoing Risks

The attempted deployment of SSH backdoors via AI code extensions illustrates several critical takeaways for enterprise security teams:

1. Implicit Trust Deficit: Developers and organizations must move away from implicitly trusting extensions, plugins, and AI tools downloaded from public registries or third-party marketplaces. Code-signing and integrity verification must become mandatory.
2. Privilege Minimization: IDE extensions should operate under the principle of least privilege, restricting their ability to modify system-level services such as SSH without explicit, out-of-band administrative authorization.
3. Continuous Monitoring: Endpoint detection and response (EDR) solutions must actively monitor for unexpected modifications to core system configuration files, unauthorized background service activations, and anomalous outbound tunneling attempts.

The incident serves as a stark reminder that as artificial intelligence tools become more deeply embedded in the software development lifecycle, they will continue to attract sophisticated adversaries seeking to exploit the human and technical trust inherent in modern engineering workflows.