# SSH setup bugs limited access from malicious Cursor extension

_Published Friday, October 30, 2026 at 11:18 AM EDT · Security · Latest · Tier 2 — Notable_

![SSH setup bugs limited access from malicious Cursor extension — Primary](https://www.bleepstatic.com/content/hl-images/2026/10/30/claude-code-attack.jpg)

Coding errors likely prevented attackers from gaining remote access to many Windows and macOS systems exposed to the malicious Claude Code extension in Cursor's marketplace, BleepingComputer reports, citing Phorion's analysis. The malware could still plant SSH keys, install persistence and transmit host reconnaissance data.

On macOS, an unprivileged status check caused the malware to skip enabling SSH. On Windows, it tried to run setup through a Unix shell unavailable on standard installations. Those failures blocked access when an SSH server was not already running; the reconnaissance payload sent credential-related environment variable names, rather than their values.

## Sources

- [Bleeping Computer](https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/)

---
Canonical: https://techandbusiness.org/newswire/kbN80RkOnqYDIKYEg1GJ6Q
Published: 2026-10-30T15:18:51.302Z
Story chronology: 2026-10-30T14:36:54.000Z
Retrieved: 2026-10-30T17:52:19.638Z
Publisher: Tech & Business (techandbusiness.org)