Trojanized Claude Code extension on Cursor planted an SSH backdoor
Up to 5,000 Cursor users pulled tampered 2.1.312/2.1.313 builds on Oct 29 — and uninstalling won’t undo it. Plus OpenAI’s new computer-use model.
Copy markdown
Uninstalling won’t remove the backdoor
The tampered builds add an attacker-controlled Ed25519 key (comment svc-telemetry) to your authorized_keys, switch SSH on, and open a reverse tunnel to 134.209.82.225 every 60 seconds. Deleting the extension leaves all of it in place — you have to pull the key and the persistence yourself: a cron @reboot entry on Linux, a com.apple.sysmond LaunchAgent on macOS, or a SysMon scheduled task on Windows.
The exposure window was 11 hours on Oct 29
Poisoned copies of anthropic.claude-code went live on Cursor’s marketplace at 09:27 UTC and were pulled at 20:35 UTC on Oct 29; up to 5,000 users who installed or updated on macOS or Windows in that window are exposed. Anthropic says its own systems and official channels weren’t touched, skipped the tainted version numbers, and shipped 2.1.314 as the clean build.
Rotate anything named like a secret
The loader runs the instant the extension loads — no Claude conversation required — and fingerprints your hostname, git email, and the names of up to 40 credential-looking environment variables, beaconing to the C2 on port 8099. It never read the values, but rotate any secret whose name sat in your environment on an affected host, and block 134.209.82.225 while you’re at it.
OpenAI’s GPT-6.1 Terra lands for computer use
Not every headline this week is a warning: OpenAI shipped GPT-6.1 Terra to the API (v1/responses and chat/completions), a fast, cheap model tuned for visual reasoning, precise computer use, and natural writing — the tier to point browser- and spreadsheet-driving agents at when the full GPT-6 models are overkill.