For about 11 hours on Thursday, October 29, Cursor’s extension marketplace served its users an update to Anthropic’s Claude Code extension that Anthropic didn’t write. Version 2.1.313 arrived under the extension’s real publisher ID, anthropic.claude-code, so anyone with auto-updates on could pick it up without clicking anything suspicious. Cursor says at most 5,000 users received the tampered build.

That’s a small number next to Cursor’s user base. It’s a big deal anyway, because of where the package came from and what it tried to do.

Cursor disclosed the incident in a security notice on October 29. In its words, “The extension runs malicious code that attempts to install a persistent SSH backdoor.” Researchers at OpenSourceMalware and Phorion then tore the package apart and confirmed the details: a roughly 66-line loader slipped in front of the extension’s legitimate code, leaving everything else untouched. The code runs the moment the extension loads, no Claude conversation required.

What the Claude Code extension backdoor tried to do

Once active, the loader went through a checklist. It collected host details: hostname, username, operating system, home directory path, environment variable names, the configured Git email, and the machine’s public IP address. It sent that reconnaissance to an attacker-controlled server at 134.209.82.225 over plain HTTP.

Then it tried to get in for good. It added an attacker-controlled SSH key, labeled svc-telemetry, to the machine’s authorized_keys file. It tried to switch on the local SSH service. It opened a reverse SSH tunnel back to the attacker’s server, retrying roughly every 60 seconds. And it installed persistence so the implant would survive a reboot: a scheduled task on Windows, a LaunchAgent on macOS, and a cron entry on Linux.

Uninstalling the extension is not enough. Cursor warns that the payload drops standalone persistence scripts that keep running after the extension is gone, which is why its notice includes cleanup scripts for both Windows and macOS.

Why the backdoor mostly failed

Here’s the twist: the attack probably didn’t work as intended on most machines, and the reason was the attacker’s own mistakes.

Turning on the local SSH service needs administrator rights, and Cursor typically doesn’t run with them on Windows or macOS. On macOS, the malware checked whether Remote Login was enabled by running a command without elevated privileges, which returned an error instead of a clean answer, so the enabling step was skipped. On Windows, the OpenSSH install was routed through a Unix shell that doesn’t exist on standard Windows machines. BleepingComputer’s teardown and Phorion’s analysis reach the same conclusion: the reverse tunnel very likely never opened on most affected machines.

Don’t read that as a clean bill of health. The SSH key still landed in authorized_keys. The persistence entries still landed. Host data still went out to the attacker’s server, including environment variable names that can point straight at credentials. Cursor’s advice to affected users is blunt: treat the machine as compromised, clean it up, and rotate credentials from a separate machine.

Who is affected, and what to check

Scope here is narrow, and that’s worth stating plainly. Only Cursor’s marketplace distributed the tampered build, between about 2:27 a.m. and 1:35 p.m. Pacific Time on October 29. Cursor flagged versions 2.1.312 and 2.1.313, pulled both, shut down its entire marketplace to audit other extensions, rotated its access keys, rebuilt the marketplace, and worked with the hosting provider to take the attacker’s server offline.

Anthropic says its own systems were not compromised and it did not build or publish the malicious version. Per Anthropic’s Felix Rieseberg, a malicious actor used access to Cursor’s marketplace to publish a tampered copy. Microsoft’s security team confirmed the same boundary: the packages were never published on Microsoft’s Visual Studio Marketplace or npm, and those channels are not affected. Anthropic skipped ahead to version 2.1.314 on its official channels so the poisoned number can’t be confused with a real release.

If you installed or updated Claude Code from Cursor’s marketplace on October 29, check three things. First, look for the svc-telemetry key in ~/.ssh/authorized_keys and remove it if present. Second, run Cursor’s cleanup scripts to strip the persistence entries and any running tunnel processes. Third, confirm you’re on version 2.1.314 or later, then rotate any secrets that machine could reach, including cloud credentials and repository tokens.

Why this matters

Supply chain attacks on developer tools are the nightmare scenario for a reason: a developer’s machine holds the keys to production. One poisoned extension can open a path into code repositories, cloud accounts, and customer data, and it arrives wearing a trusted name. This incident didn’t need a lookalike package or a phishing email. It rode the normal update channel, under the real publisher ID, for 11 hours.

It also exposes an uncomfortable gap nobody has closed yet. Cursor has not explained how the attacker published under Anthropic’s publisher ID on its marketplace, and Anthropic says the compromise was on Cursor’s side. Until that question gets a real answer, every developer using a third-party extension marketplace has to assume the trust boundary is thinner than it looks. Auto-update is convenient right up until it isn’t.

The incident lands in a week when AI coding tools are moving deeper into professional workflows, with companies wiring agents into repositories and deployment pipelines. That trend makes the tooling itself a target, and this week proved the point: the most dangerous package in the store was the one users already trusted.

Frequently asked questions

What happened with the Claude Code extension on Cursor?

A tampered build of Anthropic’s Claude Code extension, version 2.1.313, was distributed through Cursor’s extension marketplace for about 11 hours on October 29, 2026. It carried a hidden loader that tried to plant a persistent SSH backdoor, and Cursor says at most 5,000 users received it.

Am I affected if I use Cursor?

You are in scope only if you installed or updated the Claude Code extension from Cursor’s marketplace between about 2:27 a.m. and 1:35 p.m. Pacific Time on October 29. Users who got the extension from Microsoft’s VS Code Marketplace, Open VSX, or npm are not affected.

How do I check for the svc-telemetry SSH key?

Look in your ~/.ssh/authorized_keys file for a key labeled svc-telemetry. If it is there, remove it, run Cursor’s cleanup scripts to delete the persistence entries, update to version 2.1.314 or later, and rotate any credentials reachable from that machine.

Did the backdoor actually give attackers access to victims’ machines?

Probably not on most Windows and macOS machines. Turning on the local SSH service needs administrator rights the extension usually lacked, and coding errors in the malware broke that step. The planted key, persistence entries, and stolen host data still need cleanup.

Sources: BleepingComputer, The Verge, Cursor’s security notice, The Hacker News, StepSecurity, Microsoft Security Blog.