A backdoored Claude Code extension reached up to 5,000 Cursor users

Developers have learned to be careful with random packages from unknown authors. What makes this week's incident different is that the dangerous package carried one of the most trusted names in AI coding. For about 11 hours on Thursday, October 29, 2026, anyone using the Claude Code extension inside the Cursor editor could have received a tampered build with a hidden SSH backdoor, simply because Cursor updates extensions automatically.

Cursor disclosed the incident in a security notice on its blog. The affected package is Anthropic.claude-code, versions 2.1.312 and 2.1.313, for macOS and Windows, served through the Cursor VS Code Extension Marketplace between about 2:27am and 1:35pm Pacific time. According to Ars Technica and Sophos, Cursor estimates that at most 5,000 users were affected.

Below is what happened, what the malicious code actually did, what it failed to do, and what you should check if you use Cursor with Claude Code.

What happened on October 29

Cursor is built on VS Code and runs its own marketplace for VS Code compatible extensions, separate from Microsoft's Visual Studio Marketplace. Popular extensions, including Anthropic's Claude Code extension, are distributed to Cursor users through it. That is the channel the attacker used.

On the morning of October 29, Pacific time, a modified build appeared under the Claude Code listing. Security researcher Kevin Beaumont and Luke Roberts, CTO and co-founder of the endpoint security firm Phorion, both told Ars Technica that version 2.1.313 was distributed through Anthropic's official account on Cursor's marketplace. "It was a supply-chain compromise where the attacker gained access to the official distribution channel," Roberts said. "The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312. Extensions auto-update in Cursor by default."

That last sentence is the key to the scale. Nobody had to click a suspicious link or install something unfamiliar. A developer who already trusted the extension only had to have Cursor open while the poisoned version was live.

Phorion was the first to spot the problem, according to The Register. Cursor then pulled the malicious version, blocked further distribution and, as an extra precaution, shut down its whole extension marketplace. It audited access, confirmed that no other extensions had been tampered with, rotated its keys, rebuilt the marketplace and brought it back online. It also worked with the cloud provider hosting the attacker's server to take that server offline. On October 30 at 11:30am Pacific time, Cursor updated its notice with corrected indicators and the final list of affected versions.

Anthropic: not our systems

Within a day, prominent voices in the security community speculated that Anthropic itself must have been breached. Anthropic pushed back. Felix Rieseberg, a member of Anthropic's technical staff, wrote on X that the company was working with Cursor but that "it wasn't a compromise of Anthropic's systems or employee laptops." In his words, "a malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish. The versions on our official channels are not affected, and this only impacts Cursor users."

Microsoft Threat Intelligence, which published a detailed analysis of the injected code, says it confirmed that the malicious packages were never published on the Microsoft Visual Studio Marketplace or through Anthropic's npm package. Anthropic also confirmed to Microsoft that its systems were not compromised. All evidence so far points to the incident being limited to Cursor's marketplace.

What is still missing is the most important detail: how the attacker got publishing access. Neither Cursor nor Anthropic has explained that yet, and Ars Technica reports that neither company answered its questions on the point. Anthropic shipped a clean version 2.1.314 several hours after the bad one went live, according to Beaumont, which also makes sure that anyone still on the bad build gets moved to a new version.

What the malicious code did

The tampered extension still worked normally, which was the point. Microsoft found a JavaScript loader that runs when the extension module loads, before the real extension code. It suppresses output and silently swallows errors, so the user sees nothing unusual. From there, the loader follows five steps.

1. Reconnaissance. The loader collects the hostname, username, operating system, architecture, home directory, working directories, the configured Git email address and the public IP address. It also looks for environment variables whose names contain words like KEY, TOKEN, SECRET, PASS, AWS or GCP and keeps up to 40 matches. Microsoft stresses that only the names are sent, not the values. That still matters: Phorion told Ars that the list of names lets an operator quickly see which machines hold cloud credentials and API tokens, and pick the most valuable targets for a follow-up.

2. Planting a key. The loader checks the user's SSH authorized_keys file for a marker called svc-telemetry. If it is missing, it appends an attacker controlled Ed25519 public key. Anyone holding the matching private key could then log in to that account over SSH, if an SSH server is running. The loader also tries to switch on the local SSH service.

3. Opening a tunnel. Most developer laptops are not reachable from the internet, so the malware turns the connection around. It starts a reverse SSH tunnel from the victim's machine to an attacker server and asks that server to forward connections back to port 22 on the victim. On Unix like systems it prefers autossh and falls back to ssh. On Windows it uses a hidden PowerShell loop. The retry scripts wait about 60 seconds after each disconnect and try again.

4. Persistence. The loader writes scripts and startup entries outside the extension folder: a LaunchAgent called com.apple.sysmond on macOS, a cron entry that runs at reboot on Linux, and a scheduled task named SysMon on Windows, with a sysmon.cmd file in the Startup folder as a fallback. The names were chosen to look like harmless monitoring components.

5. Reporting. After a delay, the loader sends the collected details and the status of the backdoor to a beacon endpoint on port 8099 of the attacker server.

Why many infections probably failed

There is some good news, and it comes from the attacker's own mistakes. Switching on the local SSH server requires administrator rights on most macOS and Windows machines, and the extension normally runs with the rights of the user who started Cursor. Cursor says that because of errors in the malicious code, the tunnel step would fail "outside of highly unusual circumstances where Cursor was started with administrator privileges."

On top of that, the attacker server no longer works, because Cursor and the hosting provider took it offline. That means the reverse tunnel and the reporting call can no longer reach their destination.

But "the tunnel failed" does not mean "nothing happened." Cursor states clearly that on affected machines the extension still added the attacker's SSH key, installed persistence and sent host details. Phorion put it this way: the malware is "still a significant threat that installs persistence and beacons host reconnaissance back to the operator." And because the persistence scripts live outside the extension folder, simply updating to 2.1.314 or uninstalling the extension does not remove them.

What to do if you might be affected

You are in scope if you installed or updated Anthropic.claude-code to 2.1.312 or 2.1.313 from the Cursor marketplace on macOS or Windows between 2:27am and 1:35pm Pacific time on October 29, 2026. That is 09:27 to 20:35 UTC. If you had the extension installed and Cursor was open with auto update on during that window, assume you received it.

The fastest check is the SSH key. On macOS and Linux, look for the string svc-telemetry in ~/.ssh/authorized_keys. On Windows, check both your user's .ssh\authorized_keys file and C:\ProgramData\ssh\administrators_authorized_keys. Cursor's notice includes one line commands for both systems. If the key is there, your machine is affected.

If it is, Cursor recommends five steps: confirm with its check script, search endpoint, network and extension install logs for the published indicators, isolate the affected machine, remove the key, the persistence and any running tunnel processes, and rotate every credential and session that was reachable from that machine, from a trusted system. Cursor provides remediation scripts for macOS and Windows, and Microsoft advises preserving evidence before cleanup and reviewing the scripts before running them.

The main indicators published by Cursor and Microsoft:

• Attacker server 134.209.82[.]225, reverse SSH on TCP port 22 and an HTTP beacon on port 8099
• SSH key comment svc-telemetry, fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk
• Files ~/.config/.smt and ~/.config/.smtk on macOS and Linux, a temporary .stk_ file followed by ten hex characters, and ~/Library/LaunchAgents/com.apple.sysmond.plist on macOS
• On Windows, smt.cmd and smtk in %USERPROFILE%\.config, a scheduled task named SysMon and a Startup folder file named sysmon.cmd
• Process command lines containing ssh -N -R '*:0:localhost:22' or autossh -M 0

Microsoft adds a reminder that matters for anyone tempted to skip the cleanup: the takedown of the attacker server "does not remove artifacts already present on a device."

The bigger lesson for AI coding tools

This is not the first supply chain attack through an editor extension, but it is one of the clearest examples of why AI coding tools are such attractive targets. An extension like Claude Code sits inside the editor with the same permissions as the editor itself. As Ars Technica notes, that means access to local files, source code and developer tooling. Developer machines also tend to hold exactly the things attackers want: cloud credentials, API keys, SSH keys and access to private repositories.

Three details make this case worth remembering:

• The trusted name was the attack. The malicious build did not look like a typo squatted copy. It arrived as an update to a real, widely used extension under its expected listing.
• Auto update did the distribution. Automatic updates are normally a security feature. Here they turned an 11 hour window into up to 5,000 installs.
• Forked ecosystems add another link. Cursor users depend not only on Anthropic but also on Cursor's own marketplace operations. Microsoft confirmed that its own marketplace and npm were clean, which shows how much risk can sit in a single extra distribution channel.

Microsoft points teams to Cursor's security hardening guidance, in particular two settings: restricting extensions to approved publishers, and an install cooldown that delays newly published versions. A cooldown of even a day would have kept this build off most machines, because it was pulled within 11 hours.

The open question is still how the attacker got access to the official listing in the first place. Until Cursor explains that, teams that rely on its marketplace have good reason to turn on those controls now rather than later.

Sources

• Cursor security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313)
• Microsoft Security Blog: Inside a malicious Claude Code branded extension and its persistent SSH backdoor
• Ars Technica: Anthropic VS Code extension on Cursor backdoored for nearly 12 hours
• The Register: Anthropic says the Claude Code extension compromise was not its systems
• Sophos: Malicious Claude Code extension distributed through Cursor marketplace
• Noma Security: Backdoored Claude Code v2.1.313 on Cursor, IoCs and fixes