AI Daily Grind // AI news, freshly ground daily

← All lessons

🛡️ Security · ⏱️ 2 min Cappuccino

What is SSH Backdoor?

Illustration: SSH Backdoor
Simply put, like I'm 5 years oldImagine a stranger secretly makes a copy of your house key and hides it under your doormat. Even if you change the locks on the front door, that hidden key still lets them walk in whenever they want.

📖 The slightly longer version

SSH (Secure Shell) is a normal, useful tool. It lets a person control a computer from far away by typing commands, safely, over the internet. Many developers use it every day. To get in, you usually need a "key", a small secret file that proves who you are.

An SSH backdoor is when an attacker quietly turns on SSH and adds their own key to your computer. Now they have a hidden door they can use anytime, without tricking you again. A normal hack is often one break-in. A backdoor is "persistent": it stays after you restart, and sometimes even after you remove the bad program that planted it.

How an SSH backdoor gets planted

  1. Trusted tool arrivesA poisoned update installs itself, often automatically.
  2. SSH gets turned onThe malware tries to switch on remote access to your computer.
  3. Attacker key addedIt adds the attacker's key to the list of keys your computer trusts.
  4. Door stays openThe key survives restarts, and may survive uninstalling the tool.
  5. Remote entry anytimeThe attacker can log in later, without you seeing anything.
Why it matters

On October 29, a fake Claude Code update sat on Cursor's marketplace for about 11 hours, and Cursor says up to 5,000 users were affected. The malware tried to plant exactly this kind of SSH backdoor, and TheNextWeb reports the attacker's key may stay even after you uninstall the extension. So if you were affected, deleting the tool is not enough: you need to check which SSH keys your computer trusts.

⚠️ What to watch out for

Cursor says turning on SSH needs admin rights the extension did not have on most Mac and Windows machines, so many users may not have been touched. But we do not know how many backdoors really worked, and how the attackers reached a verified, official listing is still not explained. The lesson is uncomfortable: the danger came through an auto-update people trusted, not through a strange download.

📰 Where it showed up

This notion came up in The Brakes on AI Are Optional. This Week Proved It. More lessons: Learn.

🎯 Keep learning

New 🛡️ Security · 2 min Latte What is Privilege Escalation? Imagine a hotel guest whose room key, because of a small mistake, also opens the manager's office and every other room. Privilege escalation is when a computer user finds a mistake like that and gets keys they were never supposed to have. Learn it → New 🛡️ Security · 2 min Latte What is Technical debt? Technical debt is like leaving dirty dishes in the sink because washing them later feels easier. The pile grows, and one day you have no clean plate and the kitchen smells bad. Learn it → New 🛡️ Security · 2 min Cappuccino What is Zero-knowledge proof? It is like proving you know the secret recipe by cooking the dish in front of your neighbour, without ever showing them the recipe card. Learn it →

Sources

Written on 2026-11-05. This explanation was accurate on that day. AI changes fast, so check the sources and the date before you rely on it.

Get The AI Daily Grind by email, every morning, in simple words.