Why the Claude Code extension became a risk entry point
The Claude Code extension is at the center of this incident. Phorion reported that versions 2.1.312 and 2.1.313 of the official Claude Code for VS Code extension distributed through the Cursor Marketplace contained a backdoor, and Cursor later removed them. Because editor extensions generally run with the permissions of the user and IDE, malicious code can access local files, source code, and developer tooling as soon as it loads.
How the backdoor establishes persistent access
Injected JavaScript runs before the extension's normal activation. It attempts to add an attacker-controlled Ed25519 public key to the user's SSH authorization file, then uses an embedded private key to create a reverse SSH tunnel that forwards the victim's local port 22 to an external server. It also seeks persistence through a macOS LaunchAgent, a Linux user cron entry, or Windows startup mechanisms, while sending basic host details such as the hostname, username, platform, architecture, and Git email.
A macOS bug does not make the system safe
The report says the macOS path may receive a permission error rather than an “Off” value when a standard user checks Remote Login, causing the SSH-enablement step to be skipped. The Windows path also contains an implementation problem in command execution. These flaws may reduce the chance of successful access in some environments, but they do not remove the risks from dropped keys, persistence, or reconnaissance. Investigators should check the public-key fingerprint rather than relying only on the svc-telemetry comment, and review affected versions, SSH configuration, LaunchAgents, cron entries, and startup items. Organizations that used the extensions should review their environments immediately and consider incident response.