BORIS for Autodesk Inventor - Secure Your CAD Designs

Trojanized Claude Code Extension on Cursor's Marketplace: What Inventor Automation Teams and CAD Managers Should Check | Autodesk Inventor | Register and Certify Ownership of CAD design

2026-11-01 15:30 News
On 29 October 2026 Cursor, the AI code editor, disclosed that a maliciously modified version of Anthropic's Claude Code extension had been available in the Cursor VS Code Extension Marketplace for about 11 hours that day, between roughly 2:27 a.m. and 1:35 p.m. Pacific time. The tampered builds for Windows and macOS tried to plant a hidden SSH backdoor on every computer that installed or updated them. Cursor says the versions, 2.1.312 and 2.1.313, were not developed by Anthropic.
Reports put the number of developers who may have received the build at up to 5,000. The extension did not ask for anything or show any warning: the malicious code ran as soon as the editor loaded it. Cursor pulled the version, shut its whole extension marketplace down for an audit, rebuilt it and had the attacker's server taken offline. It has not said how the attacker was able to publish a build under the Claude Code name.
This is not an Autodesk problem, and nothing suggests that Inventor users were targeted. It matters to Inventor teams for a simpler reason. The people who write iLogic rules, Inventor add-ins, Vault scripts, post processors and Autodesk Platform Services (APS) apps increasingly do it in VS Code-style editors with AI assistants, on the same Windows workstations that hold Vault credentials, licence access and local copies of your designs. An editor extension runs with that engineer's rights.
TL;DR: if anyone in your team uses Cursor, check for the svc-telemetry SSH key today, and treat editor extensions as software you install, not as harmless add-ons

Versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension in Cursor's marketplace collected host details, added an attacker-controlled SSH key, set up persistence and tried to open a reverse SSH tunnel. Cursor says the tunnel step generally failed without administrator rights, but the key, the persistence and the report to the attacker still happened, and uninstalling the extension does not remove them. Run Cursor's check on every machine that had Cursor open on 29 October, clean or rebuild affected machines, rotate credentials reachable from them, and set rules for which editors, extensions and AI tools may touch your Inventor and Vault environment.

What exactly happened on 29 October?

According to Cursor's security notice, a maliciously modified version of the Anthropic.claude-code extension appeared in its VS Code Extension Marketplace and ran code that "attempts to install a persistent SSH backdoor". The first reports named version 2.1.313; Cursor's update of 30 October lists 2.1.312 and 2.1.313 for Windows and macOS. Anthropic said its official channels, including Microsoft's VS Code marketplace and Open VSX, were not affected and that only Cursor users were. Early claims that other marketplaces carried the build were not confirmed.
Researchers at Phorion and OpenSourceMalware, cited by BleepingComputer, found a malicious loader added to the start of the extension's main JavaScript file, with the rest of the legitimate code left unchanged. That is what makes this kind of attack hard to spot: the extension had the right name, the right publisher and worked normally. As one researcher told Help Net Security, there was no impersonation to spot.
Cursor removed the version and blocked further distribution, temporarily took its entire extension marketplace offline, audited access, found no other tampered extensions, rotated its own keys and rebuilt the marketplace. It also worked with the hosting provider to take the attacker's server offline, so the reverse tunnel and the reports to the attacker no longer work.

What did the malicious code do on a workstation?

Based on Cursor's notice and the researchers' analysis, the payload worked in four steps. First, it collected and sent host details: computer name, user name, operating system, home and working folders, the Git email address, the public IP address and the names of environment variables. It sent the names, not the values, but Help Net Security reports that it looked specifically for up to 40 variables that resemble keys, tokens, passwords and cloud credentials.
Second, it added an attacker-controlled SSH key labelled svc-telemetry to the user's authorized keys. Third, it tried to switch on the local SSH service and open a reverse SSH tunnel to the attacker's server, which would let the attacker connect back into the machine. Fourth, it made itself persistent: a LaunchAgent on macOS and, on Windows, a scheduled task named SysMon that tries to run as SYSTEM, with a Startup-folder script as fallback. Background scripts retried the tunnel about every 60 seconds.
The good news is that the tunnel step usually failed. Enabling the SSH server needs administrator rights, and Cursor says the attacker likely could not log in on most Windows and macOS hosts. Researchers found that the Windows routine also called a Unix shell that standard Windows installations do not have. The bad news is in Cursor's own words: "Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running." Phorion's chief executive Calum Hall put the intent plainly: "The goal of this payload is long-term interactive access."

Why should Inventor teams care about a code editor extension?

Because Inventor automation lives in code. Most Inventor shops of any size have iLogic rules, VBA or VB.NET macros, a few in-house add-ins, Vault job processor scripts, Inventor CAM post processors and, increasingly, small APS apps. Our guides to Inventor automation with iLogic, add-ins, the API and Autodesk Assistant and Inventor macros and scripts describe how far this goes in a normal engineering department. The people who write that code are often engineers or CAD managers, not a separate IT team, and they write it on their CAD workstation.
That workstation is rich. It typically has the Vault client signed in, a local workspace with the latest parts, assemblies and drawings, mapped drives with older projects, network licence access and, for anyone building APS integrations, client IDs and secrets in configuration files or environment variables. Engineering workstations also often run with local administrator rights, because CAD installs, drivers and add-ins tend to require them. Cursor says the tunnel step could work where the editor ran with administrator privileges.
AI assistants make this layer bigger, not smaller. At AU 2026 Autodesk said Autodesk Assistant in Inventor works through Inventor's APIs and iLogic, which our article on Inventor AI after AU 2026 explains. Outside Autodesk, engineers use general AI coding tools to write rules and add-ins faster. Every one of those tools, and every extension inside them, is software running with the engineer's access to your design data.
It is also the second editor extension story for CAD teams this week. On 27 October Autodesk published an advisory for its Fusion Post Processor Utility extension for VS Code, which also works with Inventor CAM; our article on Autodesk's Fusion security advisories of 27 October covers it. That was a vulnerability in a genuine tool; this one was a genuine tool replaced by a tampered build. Both land on the same machines.
Proof of your designs that does not depend on any one workstation.

BORIS for Autodesk Inventor registers your CAD files from inside Inventor and gives each registered version a blockchain timestamp and a certificate of ownership. If design data ever leaves through a compromised machine, you can still show what you had, and when.

👉 See how BORIS for Autodesk Inventor works

How do you check whether a machine is affected?

Start with a simple question to your team: who had Cursor open on 29 October 2026 between about 2:27 a.m. and 1:35 p.m. Pacific time, which is about 10:30 to 21:35 Central European Time? Only machines that installed or updated the Claude Code extension in Cursor in that window are in scope. VS Code with the extension from Microsoft's marketplace is not affected, according to Anthropic.
What to look forWhereWhat it means
SSH key labelled svc-telemetryThe user's authorized_keys file; on Windows also C:\ProgramData\ssh\administrators_authorized_keysThe backdoor key was planted; follow Cursor's remediation
Scheduled task SysMonWindows Task SchedulerWindows persistence; a Startup script named sysmon.cmd is the fallback
LaunchAgent with an Apple-style namemacOS user LaunchAgents (OX Security lists com.apple.sysmond)macOS persistence
ssh -N -R processes or retries every 60 secondsProcess list, endpoint security logsThe reverse tunnel was being attempted
Connections to 134.209.82.225Firewall, proxy and endpoint network logsHost details were reported to the attacker
Anthropic.claude-code 2.1.312 or 2.1.313Cursor's extension list and install logsThe machine received a malicious build
Cursor's notice includes ready-made check commands and two cleanup scripts, one for macOS to run as the affected user and one for Windows to run from an administrator PowerShell session. They remove the extension, persistence, tunnel processes and the attacker's key. Cursor also recommends isolating any host that shows signs of execution, considering a full rebuild, and rotating credentials and sessions that the machine could reach, working from a trusted computer.
For Inventor teams, credentials the machine could reach include more than email: Vault accounts, Autodesk accounts, APS client secrets, Git and package registry tokens, VPN profiles, cloud storage sessions and any service accounts used by job processors or scripts. Our guide on tracking who accesses your CAD files helps you check whether anything unusual touched Vault afterwards.

What should Inventor teams do now?

  1. Ask who uses Cursor. Find every machine that had Cursor and the Claude Code extension on 29 October, including personal laptops used for work and contractors' machines.
  2. Run Cursor's check. Look for the svc-telemetry key, the SysMon task and the other indicators in the table above. Search firewall and endpoint logs for 134.209.82.225.
  3. Clean or rebuild. Use Cursor's remediation scripts, then decide whether to rebuild. Uninstalling the extension alone is not enough.
  4. Rotate what the machine could reach. Vault and Autodesk passwords, APS client secrets, Git tokens, VPN credentials and cloud sessions, changed from a clean computer.
  5. Drop local admin for daily work. Give engineers a separate admin account for installs. The SSH step needed admin rights; most machines were saved by not having them.
  6. Allow-list editors and extensions. Decide which code editors, extensions and AI tools may be used on machines with Vault access, and where they may come from. Pin versions and disable automatic updates for critical tools.
  7. Keep secrets out of workstations. Store APS and service credentials in a secrets manager, not in environment variables, scripts or iLogic rules. Our article on plugin security architecture for Inventor covers the design side.
  8. Keep proof outside the machines. Register key design versions with BORIS so their existence and date can be shown even if a workstation is compromised and files are copied.
For more background, read how the Siemens Software Center ClickFix attacks used a signed CAD vendor tool, how backup tools became an attack path and Autodesk's ADP Desktop SDK advisory. If your workstations still run Windows 10, our guide to Windows 10 after ESU Year 1 applies too. For the people side, see common mistakes engineers make with CAD security and how to train engineers on CAD data protection.

Does this mean Inventor teams should stop using AI coding tools?

No. The lesson is about where software comes from and what it can reach, not about AI itself. The tampered build was a normal, working extension with extra code added to the start of one file, published in a trusted place under a trusted name. The same could happen to any plugin channel, including the ones CAD teams use every day. What helps is treating editors, extensions, AI agents and add-ins like any other software that touches design data: approved sources, known versions, minimal rights and logs.
It also helps to separate roles. A workstation used to try new tools, scripts and AI agents does not need a signed-in Vault client with access to every project. A build or test machine for add-ins can use a test Vault and sample data. Contractors who write automation for you can work in a remote setup with limited access rather than on a copy of your full design library.

The bigger picture

This week's news on our sister sites shows the same pressure on design data from different directions.
  • Insiders and IP work. On CADChain, Samsung's former IP chief jailed on appeal explains how the Seoul High Court treated an internal patent analysis as a trade secret, even though the patents themselves were public, and why a renamed file with its Confidential mark removed mattered.
  • Reverse engineering with AI. BORIS for SOLIDWORKS covers AI mesh-to-CAD tools such as MIT's CADFit, which rebuild editable CAD from meshes, and why an STL is no longer a safe file to share.
  • Marketplaces and AI rules. Blended BORIS explains Etsy's AI policy update of 22 October 2026, which requires a real photo of the actual item for most products and bans listings generated by bots.
CADChain explains how its CAD data protection technology works across CAD systems, and our article on the .NET 10 update for Inventor and Vault covers another workstation and server deadline for CAD managers in November.

Conclusion

The trojanized Claude Code extension on Cursor's marketplace was live for about 11 hours and, thanks to a missing administrator right on most machines, probably gave its author fewer open doors than intended. It still reached up to 5,000 developers, and on every machine that ran it the key and persistence stay in place until someone removes them. For Inventor teams the point is wider than one editor. The machines where engineers write iLogic, add-ins and APS code hold your design data and the keys to Vault. Check them now, rotate what they could reach, take away everyday admin rights, decide which tools and extensions are allowed, and keep proof of your designs that does not depend on any single workstation.
Your designs, your proof.

BORIS for Autodesk Inventor gives every registered file a blockchain timestamp and a certificate of ownership, without sending your models to a cloud service.

👉 See how BORIS for Autodesk Inventor works

FAQ: the trojanized Claude Code extension and Inventor teams

What happened to the Claude Code extension on Cursor?

On 29 October 2026, for about 11 hours, Cursor's VS Code Extension Marketplace offered maliciously modified versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension. Cursor says they were not developed by Anthropic. The code tried to install a persistent SSH backdoor on Windows and macOS machines.

Was the official Claude Code extension affected?

According to Anthropic, no. The versions on its official channels, including Microsoft's VS Code marketplace and Open VSX, were not affected; only Cursor users who installed or updated the extension in that window were.

How many people were affected?

Reports citing Cursor put the maximum at 5,000 users. Cursor says the SSH tunnel step generally failed without administrator rights, so the attacker likely could not log in on most machines, but the key, persistence and host report were still installed.

Does this affect Autodesk Inventor or Vault software?

No. It is not an Autodesk vulnerability and there is no report of Inventor users being targeted. It matters because engineers who write iLogic rules, add-ins and APS apps often do so on CAD workstations with Vault access and local copies of designs.

How do I check a machine?

Look for an SSH key labelled svc-telemetry in the authorized keys files, a Windows scheduled task named SysMon or a Startup script named sysmon.cmd, and network connections to 134.209.82.225. Cursor's security notice has check commands and cleanup scripts for Windows and macOS.

Is uninstalling the extension enough?

No. Cursor says the payload drops standalone persistence scripts that keep running. Use the remediation scripts, consider rebuilding the machine and rotate credentials it could reach from a clean computer.

How does BORIS help?

BORIS for Autodesk Inventor registers CAD files with a blockchain timestamp from inside Inventor, so you can show which version of a design existed and when, even if a workstation is compromised. It does not replace endpoint security, patching or access control.