Executive Summary
A tampered Claude Code extension in Cursor's marketplace attempted reconnaissance and persistent reverse-SSH access on developer systems. Engineering, security, and platform teams using AI coding tools should review extension integrity and endpoint telemetry.
What Happened
The extension performed host reconnaissance and attempted to create a reverse SSH tunnel. The post Malicious Claude Code Extension Served in Cursor Supply Chain Attack appeared first on SecurityWeek .
Affected Products
- anthropic.claude-code extension
- Cursor VS Code Extension Marketplace
Vulnerability / Attack Technique
Trojanized extension supply-chain attack with reverse SSH persistence
Technical Mechanism
The malicious JavaScript executed when the extension module loaded and collected host information, modified files, and ran operating-system commands. It attempted to add an attacker-controlled SSH key, enable the local SSH service, create a reverse SSH tunnel, and establish persistence; the reported SSH-enablement step generally required administrator rights and often failed.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
AI coding extensions can become privileged execution paths into developer environments even when the underlying model is not compromised. Teams running AI agents or LLM-enabled development workflows need component inventory, provenance checks, permission controls, and monitoring for unexpected file changes, command execution, credential access, and persistence.
Recommended Controls
- Maintain an inventory and SBOM of AI extensions, agent components, versions, publishers, and marketplace sources.
- Allowlist approved extension versions and verify package signatures, hashes, provenance, and release integrity before deployment.
- Run AI coding extensions with least privilege in isolated workspaces or sandboxes without unnecessary SSH, filesystem, or network access.
- Monitor for unauthorized SSH keys, reverse tunnels, startup tasks, LaunchAgents, scheduled tasks, and unexpected child-process execution.
- Revoke and rotate potentially exposed credentials, remove persistence artifacts, and rebuild affected developer hosts when compromise cannot be ruled out.
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
securityweek.com: https://www.securityweek.com/malicious-claude-code-extension-served-in-cursor-supply-chain-attack/
Summary and analysis written by RealGround from the source above; last updated 2026-11-03.