Version 2.1.313 of the Claude Code extension was altered to add an attacker's SSH key, open a persistent outbound tunnel and send back host details and credential-like environment variable names. Cursor says up to 5,000 users were affected, that Anthropic did not build the version, and that it has rebuilt its marketplace. Phorion, the firm that found it, says removing the extension does not remove the backdoor, so teams should check authorized_keys for the svc-telemetry entry, isolate affected machines and rotate credentials.
