Monday 2 November 2026
Backdoored Claude Code extension on Cursor Marketplace plants SSH keys
Five bullets
The one thing
Phorion found a backdoor in the official Claude Code for VS Code extension on the Cursor Marketplace. Versions 2.1.312 and 2.1.313 drop a persistent SSH backdoor on macOS, Linux and Windows. Cursor has removed both versions. The report topped Hacker News over the weekend with 1,002 points.
The injected code runs as soon as Node loads the extension file. You do not need to open or use the extension. It appends an attacker's key to ~/.ssh/authorized_keys with the comment svc-telemetry. It then tries to start SSH so that key works.
On macOS, a bug often stops the script from turning on Remote Login. The key, the persistence and the reconnaissance beacon still land. If Remote Login is already on, or you enable it later, the backdoor is ready. Phorion warns against relying on that bug.
Extensions run with the permissions of your editor and your user. An agent extension can reach your files, source code and developer tools the moment it loads. The skill that grows is auditing what runs inside your editor.
Check your agent extension versions today, and treat any SSH key you did not add as an incident.
Try this · 15 minutes
See whether the backdoored extension reached your machine
- In Cursor, find Claude Code for VS Code in your extensions and note its version.
- If it is 2.1.312 or 2.1.313, engage incident response and rotate credentials the editor could reach.
- Open ~/.ssh/authorized_keys and flag every key you did not add, not just svc-telemetry.
- On a Mac, check whether Remote Login is on, since that keeps the backdoor reachable.
Stories
- TRYClaude Code v2.1.316 lets subagents run at their own effort levelClaude Code shipped v2.1.316 with CLAUDE_CODE_SUBAGENT_EFFORT. The setting picks the effort level subagents run at when nothing else names one, instead of inheriting the session's. A second variable, CLAUDE_CODE_DISABLE_ULTRATHINK, turns the ultrathink keyword off. It matters to anyone fanning work out to subagents on a cost or latency budget.
- WATCHAgent GPU-to-TPU migrations reported success while changing how models trainedFrom GPU to TPU with Coding Agents used Claude Code to migrate ten PyTorch projects from NVIDIA GPUs to Google Cloud TPUs. Of 70 execution attempts, 53 failed, with 26 raising no error. In one run, the agent reported success after a gradient clipping change cut accuracy from 86.53% to 84.89%. It matters to anyone handing migrations to an agent, who should verify against an independent reference run.
- WATCHSelf-written lessons did no better than raw transcripts for agent retriesA BugsInPy repair study retried 181 failed gpt-5.4-mini attempts on 75 real Python bugs under five conditions. Every memory condition beat a plain retry's 29.8% by 5.5 to 9.9 points, though none significantly. A self-written lesson did no better than the raw transcript, despite costing an extra model call. It matters to anyone wiring agent retry loops, since the transcript is the cheaper record.
- WATCHChatGPT and Codex usage limits are merging into one poolHeavy chat use will draw on the same quota as Codex agent runs. The exact terms are still settling.
- WATCHAnthropic is blocking accounts over model-training and game reverse-engineering workOne researcher reports killed sessions and Opus 5.5 downgrades to Opus 5 for work touching RFT or SFT. Keep a fallback provider ready.
- TRYopencode 2.2.5 sets its compaction buffer as a share of contextSet "compaction": { "buffer": "20%" } in opencode.json to keep that share free. Version 2.2.4 adds experimental agent-published HTML artifacts.
- WATCHSame tools behind MCP or CLI changed how agents behavedMICA found divergent trajectories in 94.3% of 2,004 episodes. Its DART fix cut MCP cost by up to 27.1k tokens per task.
- WATCHA math library let attackers escape ChatGPT's HTML-preview sandboxMathLive's message handler used innerHTML, so a sandboxed frame could inject an unsandboxed iframe. OpenAI closed it. Relevant if your agents render HTML artifacts.
Safe to ignore
53 sources read. 130 items. 14 shortlisted. 5 bullets.