Claude Code extension 2.1.313 reported with reverse SSH backdoor

Oct 30, 2026 · 20:18 UTC

The point

Security researcher Kevin Beaumont reports that Claude Code extension version 2.1.313 contained malware creating a reverse SSH backdoor to desktops. He says that version was removed, 2.1.314 is the fixed version, and auto updates widened impact.

Why it matters

Builders should check installed versions and remediate impacted VS Code and Cursor systems manually.

Key details

• C2 collected hostname, username, OS, architecture, home directory, environment variable names, and Git email
• Reverse SSH let the attacker choose victims for hands on keyboard access
• Beaumont says updating alone does not remove prior backdoors or recon activity

Original ~3 min → 25 sec here Source: Kevin Beaumont on Cyberplace, Oct 30, 2026