# Cursor Supply-Chain Compromise: Leaked Fireworks AI Key Leads to Backdoored Anthropic.claude-code Extension (2.1.312/2.1.313) in Cursor Marketplace Cache

> Cursor attributes its October 2026 breach to an access key that Fireworks AI exposed. The attacker used it to read coding agent traces and harvest credentials. On October 29 the attacker placed modified Anthropic.claude-code 2.1.312 and 2.1.313 packages (Windows and macOS) in the cache serving Cursor's VS Code extension marketplace. The builds were available for about 11 hours and reached at most 5,000 users. They added an SSH key labeled svc-telemetry, attempted a reverse SSH tunnel to 134.209.82.225 and installed persistence.

- **Published:** 2026-11-14T09:19:26Z
- **Last reviewed:** 2026-11-14T09:19:26Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-6061
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-6061.png
- **ID:** TL-2026-6061
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (3 shown free below)

## Description

Cursor's incident update of 2026-11-13 states that the attacker obtained an access key Cursor had issued to Fireworks AI, which Fireworks had exposed. The key gave read-only access to a storage bucket that Cursor used to share data with Fireworks. The bucket held limited coding agent traces, mostly from 2025, from sessions outside Privacy Mode. Some traces contained unredacted credentials. Cursor says fewer than 0.05% of non-Privacy Mode users had traces exposed and fewer than 0.01% of customers had API credentials exposed. Using credentials found in the data, the attacker reached select internal services. These held archived non-production source repositories, limited support records and emails, usage metrics and contact details, summaries of some coding agent conversations, and credentials some users had sent to support. Cursor says Privacy Mode prompts, customer code repositories and official Cursor updates were not affected.

On 2026-10-29 the attacker used a stolen credential to place unauthorized copies of the Anthropic.claude-code extension, versions 2.1.312 and 2.1.313 (darwin-arm64 and win32-x64), in the cache that serves the Cursor VS Code extension marketplace. The packages were available from about 2:27 AM to 1:35 PM PT, roughly 11 hours. At most 5,000 users who requested those cached versions could have received them. That is a potential count, not a confirmed number of infections. Cursor and OX Security state that Anthropic did not publish the packages, that this was not a vulnerability in Anthropic's product, and that Open VSX never hosted the malware. Cursor has not published how the modified build was uploaded beyond the stolen credential.

Per OX Security's analysis, the only modified file is extension.js, which runs a loader when the extension activates. No Claude conversation is needed to trigger it. Stage 1 collects hostname, username, OS, architecture, home directory, environment variable names (not values), working directories, git email and public IP. The public IP lookup uses ifconfig.me and api.ipify.org, which are legitimate services. Stage 2 appends an attacker ssh-ed25519 key labeled svc-telemetry to authorized_keys and tries to enable the SSH service (systemsetup -setremotelogin on on macOS, Add-WindowsCapability OpenSSH.Server on Windows). This usually fails because the extension lacks admin rights, but the key and persistence are still installed. It then attempts a reverse tunnel to tunnel@134.209.82.225 on TCP 22 using ssh -N -R '*:0:localhost:22' or autossh -M 0, with StrictHostKeyChecking=no, ServerAliveInterval=30 and ExitOnForwardFailure=yes. Stage 3 installs persistence and retries about every 60 seconds. On macOS this is the LaunchAgent com.apple.sysmond. On Windows it is a scheduled task named SysMon (attempted as SYSTEM) with a Startup-folder fallback sysmon.cmd. The IOC table also lists a Linux cron @reboot entry. The beacon is an HTTP POST to http://134.209.82.225:8099/beacon with host and backdoor status, and a loopback attempt to 127.0.0.1:8099/beacon is also recorded. Cursor says coding errors and missing administrator rights blocked remote login on most hosts. It did not rule out other malicious changes or host data collection.

Uninstalling the extension alone does not remove the standalone persistence scripts or the SSH key. Cursor's 2026-10-30 notice provides remediate-macos.sh and remediate-windows.ps1. Cursor's response included deactivating the Fireworks key, moving inference off Fireworks, rotating credentials, rebuilding the marketplace store and expanding secret scanning. Last observed attacker activity was 2026-11-01 and was blocked.

Attribution caveat: no source names a threat actor for the Cursor intrusion. Fireworks' own bulletin (2026-11-09) describes a separate October 23-24 incident reached through a third-party cloud provider hosting its R&D machines. It links that activity to a financially motivated 'LLMJacking' group. That bulletin does not mention Cursor or the Cursor key, and no source ties that group to the extension tampering. BeaconBeagle was queried for 134.209.82.225 but returned HTTP 502 on both attempts, so no C2 correlation is recorded. Severity HIGH is an analyst assessment, not a source-stated value.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1078 Valid Accounts
- T1552 Unsecured Credentials
- T1530 Data from Cloud Storage
- T1059.007 JavaScript
- T1082 System Information Discovery
- T1098.004 SSH Authorized Keys
- T1053.005 Scheduled Task
- T1543.001 Launch Agent
- T1547.001 Registry Run Keys / Startup Folder
- T1053.003 Cron
- T1036.004 Masquerade Task or Service
- T1572 Protocol Tunneling
- T1071.001 Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Cursor/VS Code Extension Host Spawns SSH Backdoor Setup or Host Recon (Trojanized Anthropic.claude-code)** (`TL-2026-6061-SPL-001`)

Detects the Stage 1/2 behaviour of the trojanized Anthropic.claude-code 2.1.312/2.1.313 extension (TL-2026-6061): the IDE or its Node extension host spawning child commands that reference the svc-telemetry SSH key label, authorized_keys, OpenSSH.Server installation, scheduled task SysMon creation, public-IP lookups (ifconfig.me / api.ipify.org) or the attacker server 134.209.82.225. The modified extension.js loader runs on extension activation with no user interaction, so parent-child process lineage from the IDE is the earliest reliable behavioural signal.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1059.007, T1082
- **Data sources:** sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (ParentImage="*Cursor.exe" OR ParentImage="*Code.exe" OR ParentImage="*node.exe")
 (CommandLine="*svc-telemetry*" OR CommandLine="*authorized_keys*" OR CommandLine="*OpenSSH.Server*" OR CommandLine="*134.209.82.225*" OR CommandLine="*ifconfig.me*" OR CommandLine="*api.ipify.org*" OR (CommandLine="*schtasks*" CommandLine="*SysMon*") OR CommandLine="*.config*smt*")
| eval ioc_hit=case(like(CommandLine,"%svc-telemetry%"),"ssh_key_label", like(CommandLine,"%134.209.82.225%"),"c2_ip", like(CommandLine,"%OpenSSH.Server%"),"openssh_install", like(CommandLine,"%SysMon%"),"sysmon_task", like(CommandLine,"%authorized_keys%"),"authorized_keys", true(),"recon_or_backdoor_script")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(Image) as child_images values(ioc_hit) as ioc_hits by host User ParentImage
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("Cursor.exe", "Code.exe", "node.exe", "Cursor", "Code", "node", "Cursor Helper (Plugin)")
| where ProcessCommandLine has_any ("svc-telemetry", "authorized_keys", "134.209.82.225", "OpenSSH.Server", "setremotelogin", "ifconfig.me", "api.ipify.org", ".config/.smt", "smt.cmd")
    or (ProcessCommandLine has "schtasks" and ProcessCommandLine has "SysMon")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
```

### Sigma

```yaml
title: IDE Extension Host Spawns SSH Backdoor Setup or Host Recon - TL-2026-6061
id: 6f1c0b52-3a7e-4d1e-9a52-7d2c8e41b6a1
status: experimental
description: Detects Cursor or VS Code spawning commands tied to the trojanized Anthropic.claude-code 2.1.312/2.1.313 loader - svc-telemetry key label, authorized_keys edits, OpenSSH.Server install, SysMon scheduled task, public-IP lookups or the 134.209.82.225 server.
references:
    - https://cursor.com/blog/claude-code-extension-security-notice
    - https://www.ox.security/blog/malicious-claude-code-extension-cursor-ssh-backdoor/
author: Threadlinqs Team
date: 2026-11-14
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.execution
    - attack.t1059.007
    - attack.discovery
    - attack.t1082
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\Cursor.exe'
            - '\Code.exe'
    selection_cli:
        CommandLine|contains:
            - 'svc-telemetry'
            - 'authorized_keys'
            - 'OpenSSH.Server'
            - '134.209.82.225'
            - 'ifconfig.me'
            - 'api.ipify.org'
    selection_task:
        CommandLine|contains|all:
            - 'schtasks'
            - 'SysMon'
    condition: selection_parent and (selection_cli or selection_task)
falsepositives:
    - Developers legitimately editing authorized_keys or querying their public IP from an IDE terminal
level: high
```

**Known false positives:**

- Developers running ssh-keygen/authorized_keys edits or curl ifconfig.me from the Cursor/VS Code integrated terminal
- Legitimate extensions that look up the public IP via ifconfig.me or api.ipify.org (the IP lookup alone is low fidelity)

**Tuning notes:** Treat svc-telemetry, 134.209.82.225, OpenSSH.Server and the SysMon task as high-fidelity hits; require ifconfig.me/api.ipify.org matches to co-occur with another indicator or the extension.js write (see KQL-001). Add macOS/Linux EDR parent names (Cursor Helper (Plugin), Electron) if not already covered by your sensor.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Trojanized Anthropic.claude-code 2.1.312/2.1.313 Extension Artifacts on Disk (locked: unlock with TL Creds)
- macOS/Linux Backdoor Persistence: com.apple.sysmond LaunchAgent, .smt Scripts, cron @reboot (locked: unlock with TL Creds)
- Reverse SSH Tunnel via ssh/autossh to tunnel@[indicator] with Backdoor Options (locked: unlock with TL Creds)
- IDE Process Resolves Public-IP Lookup Services (Stage 1 Host Recon) (locked: unlock with TL Creds)
- IDE Process Writes SSH authorized_keys (svc-telemetry Key Persistence) (locked: unlock with TL Creds)
- HTTP POST Beacon to [indicator]:8099/beacon via Proxy Logs (locked: unlock with TL Creds)
- Windows SysMon Scheduled Task and Startup sysmon.cmd Persistence (Trojanized claude-code Extension) (locked: unlock with TL Creds)
- Endpoint Connection to Attacker Server [indicator] (Reverse SSH Tunnel and HTTP Beacon) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 20)

Defanged, TLP:CLEAR.

- IP address: `134.209.82[.]225`
- File hash: `fcbb327e38e61c4fec795e0d0591f52cd1014b813d20a5912104953c3a17c364`
- File hash: `3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Cursor Reveals How a Leaked Fireworks AI Key Led to a Backdoored Claude Code Extension](https://cybersecuritynews.com/cursor-data-breach/)
- [Cursor security incident update](https://cursor.com/blog/security-incident-update)
- [Cursor Claude Code extension security notice (IOCs and cleanup)](https://cursor.com/blog/claude-code-extension-security-notice)
- [OX Security: Malicious Claude Code extension in Cursor - SSH backdoor analysis](https://www.ox.security/blog/malicious-claude-code-extension-cursor-ssh-backdoor/)
- [Fireworks AI security bulletin: October 2026 security incident update](https://fireworks.ai/security/bulletins/october-2026-security-incident-update)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-6061