Fake Claude Code Add-on Opened Back Doors: Check Your Editor

A tampered AI coding add-on was briefly offered to editor users. Here is how it worked, who is at risk, and what to do now.

A fake copy of the Claude Code add-on was listed in the Cursor marketplace for about 11 hours on October 29, 2026. It could plant a hidden way into your computer. If you write code with AI tools, check your add-ons today. Also be careful about opening coding projects you did not make yourself.

What happened

Claude Code is an AI helper made by Anthropic. Many people add it to code editors such as VS Code, Cursor and Windsurf. An add-on, also called an extension, is a small program that gives an app new features.

Researchers at the Mac security firm Phorion found a changed copy of the add-on, version 2.1.313, according to Help Net Security. It was on Open VSX. This is an open marketplace for these add-ons, run by the Eclipse Foundation. Cursor and Windsurf get their add-ons from Open VSX. No bad version has been reported in Microsoft's own Visual Studio Marketplace.

Cursor said the bad version was in its marketplace for about 11 hours on October 29, 2026. It said at most 5,000 users were affected. It plans to contact them directly. Cursor also said the bad version was not made by Anthropic. It has no evidence that other versions or the official distribution were affected.

How the trick works

The fake add-on looked normal. Hidden code sat at the very top of its main file. That code ran as soon as the editor loaded the add-on. You did not need to click anything.

Here is what it tried to do:

• Add the attacker's key to your computer for SSH. SSH is a tool that lets someone log in to a computer from far away.
• Open a hidden tunnel to the attacker's server. It kept running after the editor closed. It tried to reconnect about every 60 seconds.
• Start itself again after a restart. On a Mac it used a startup file with an Apple-style name. On Linux it added a cron entry, which is a timed task. On Windows it tried to make a scheduled task called SysMon. If that failed, it used the Startup folder.
• Send details about your computer. These include your username, operating system, Git email, and public IP address, which is your internet address.
• Send the names of up to 40 settings that look like passwords, keys or tokens. A token is like a digital pass that lets a program into an account. The values stayed on the machine. But the list shows the attacker which computers hold cloud logins.

There is one limit. The planted key only works if the computer's SSH service is on. On Macs, the step that turns it on often failed. Cursor said turning on SSH needs admin rights that the add-on lacks on most Mac and Windows computers. Phorion's CEO, Calum Hall, said this is no defense. If Remote Login is already on, or you turn it on later, the back door is ready.

Who is at risk

The main risk is for anyone who installed Claude Code from Open VSX or from the Cursor marketplace around October 29. This includes people using Cursor, Windsurf and other editors built on VS Code.

A second report adds to the same concern. Researchers at Forever Security tested the small built-in browsers inside five AI coding tools, as reported by Help Net Security. In all five, a web page or a local file reached the computer behind the browser. In one test, a project was dressed up as a dull financial report. The user clicked one link. Then files were quietly read and sent out, including SSH keys and tokens.

Cursor fixed its problem on October 1. As of October 29, Codex and VS Code had no fix for the file-reading problem. Researcher Gal Weizman said most people simply click "Trust" when a tool asks whether to trust a project folder.

How to stay safe

1. Open your editor's add-on list. Look for Claude Code version 2.1.313. If you see it, remove it.
2. Install add-ons only when you need them. Check the publisher name first.
3. Do not open coding projects from strangers. Treat them like an email attachment from someone you do not know.
4. Read the "trust this folder" prompt. Say yes only for projects you know.
5. Be careful with "Start setup" buttons or links an AI helper offers inside a project you did not make.
6. Keep your editor and AI tools updated, so fixes reach you when they are ready.

What to do if you installed it

If you installed version 2.1.313, act as if someone may have a way in. Watch for a message from Cursor, since it plans to contact affected users.

• Remove the add-on. Then install the current official version if you still want it.
• Open your SSH authorized keys file. Delete any key you do not recognize.
• Look for strange startup items. On Windows, check for a task named SysMon and check the Startup folder. On a Mac, check your startup files. On Linux, check cron entries that run at reboot.
• Turn off Remote Login on your Mac if you do not use it.
• Change the passwords, keys and tokens stored on that computer. Start with cloud accounts.
• If it is a work computer, tell the person who handles security right away.

Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.

Sources

• Claude Code extension poisoned with persistent SSH backdoor, Help Net Security, 2026-10-30
• Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop, Help Net Security, 2026-10-29