A tampered Claude Code extension spent about 11 hours in Cursor's marketplace trying to plant an SSH backdoor on developers' machines.
The tampered copy of Anthropic's Claude Code extension was available in Cursor's extension marketplace on Thursday 29 October 2026.
Eleven hours live
The live window lasted about 11 hours, according to Phorion, the security firm that first flagged the compromise. Its co-founder and chief technology officer Luke Roberts said extensions update automatically in Cursor by default, so most affected developers didn’t choose to install anything.
The versions involved were 2.1.312 and 2.1.313, built for Windows and macOS. Cursor said the incident affected at most 5,000 users.
- Live window about 11 hours on 29 October 2026.
- Affected versions 2.1.312 and 2.1.313, for Windows and macOS.
- Users reached at most 5,000, according to Cursor.
In appearance and function, the extension was nearly indistinguishable from the genuine one. A brief loader in its code launched when the editor opened.
What the loader did
On macOS, the loader sets up a LaunchAgent; on Windows, it creates a scheduled task. It also attempts to install the attacker’s SSH key, enable the computer’s SSH service and create a reverse tunnel to the attacker’s server. The key is labelled svc-telemetry.
Most macOS and Windows computers don’t give the extension the administrator privileges required for the tunnel. Cursor said the attempt would generally fail. Even so, the SSH key, persistence scripts and data upload were installed, and removing the extension may not remove them.
Attempted vs confirmed
What the loader attempted
Three steps
- Add the attacker's SSH key to the workstation
- Turn on the computer's SSH service
- Open a reverse tunnel to the attacker's server
What Cursor says happened
Outcome on most machines
- The tunnel needs administrator rights and would usually fail
- The key and persistence scripts still landed
- The data upload still went through
The extension gathered machine and user information, including the hostname, username, Git email and public IP address. Phorion said it transmitted the names of as many as 40 environment variables associated with keys, tokens and secrets, but not their values.
Phorion said the attacker gained access to the official distribution channel. Version 2.1.313 appeared on Anthropic's own account in the marketplace, Roberts said.
The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312
Anthropic says its own systems held
Anthropic said its systems weren’t breached and it didn’t create the malicious build. Felix Rieseberg, a member of Anthropic’s technical staff, said the altered copy was put on Cursor’s marketplace using access to that marketplace.
We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.
Independent researcher Kevin Beaumont made the same point as Phorion about the official account, Dan Goodin reported for Ars.
Cursor removed the affected versions, took its entire marketplace offline to review other extensions, rotated its keys and restored the marketplace. It also arranged for the attacker’s server to be taken offline and released scripts to find and remove the backdoor. Customers were told to install Claude Code for VS Code, version 2.1.314.
The update alone isn’t a complete fix. Startup scripts keep running on their own, so a clean version doesn’t clear them.
- 29 OctTakedown The affected versions are removed after the malicious builds go live.
- 29 OctMarketplace closed Cursor shuts the whole marketplace while it checks other extensions and rotates its keys.
- 29 OctMarketplace reopened The marketplace comes back after Cursor confirms there is no further risk.
- AfterClean version Cursor asks all customers to update to 2.1.314.
Microsoft Threat Intelligence analysed the injected JavaScript and confirmed that the malicious packages on Cursor’s marketplace were never published or distributed from Microsoft’s Visual Studio Marketplace or from the npm package. The versions on Microsoft’s marketplace and Open VSX, and the npm package itself, aren’t affected.
Why IDE extensions carry weight
Gal Weizman, security researcher at Forever Security, said extensions inside an editor ask for more than their browsers do.
IDE extensions are scarier than browser extensions because, unlike browser extensions, they are designed to have the same level of permissions as their host
Weizman said the usual route in is stolen publishing credentials.
Historically, the most common way extensions and plug-ins get hijacked is through theft of locally stored credentials that allow publishing new versions of these packages.
Enabling 2FA for publishing such extensions is an excellent way to significantly mitigate such risk in the future. Relying on an access token as the only gate for pushing such critical software significantly increases the risk of this happening
Check and clean
Cursor explains how to check for the key. On a Mac, use Terminal to look for svc-telemetry in ~/.ssh/authorized_keys. On Windows, search for it in PowerShell in the authorized_keys file inside your user profile's .ssh folder, as well as in C:\ProgramData\ssh\administrators_authorized_keys.
For both systems, Cursor provides scripts that clear the extension, SSH key, startup components and active tunnels. It also recommends that users change all passwords, tokens and API keys the machine could access, using another trusted device.
What we know
- The tampered builds were 2.1.312 and 2.1.313, for Windows and macOS.
- Cursor said at most 5,000 users were affected.
- Cursor has published scripts to check for and remove the backdoor.
- The Microsoft marketplace, Open VSX and the npm package are not affected.
Still unclear
- How the attacker gained publishing access through Anthropic's official account on Cursor's marketplace.
- Whether the SSH key, persistence scripts and uploaded data remain on affected machines after uninstalling.
This is the third Claude-branded attack in a week. Earlier incidents involved fake download pages hosted on claude.ai and counterfeit apps packaged with signed installers. This year, attacks through the software supply chain have targeted npm packages used by developers. Researchers have also cautioned that AI coding tools could make such attacks more powerful.
OpenSourceMalware, a community threat intelligence platform, examined the extension and found that the attacker left most of it intact. Above the original code, the attacker added a 66-line loader, with changes confined to extension.js.
| Figure | |
|---|---|
| Loader size | 66 lines |
| Variable names harvested | up to 40 |
How the attacker gained access remains undisclosed by both Anthropic and Cursor. It is also unclear whether uninstalling removes the attacker's SSH key, persistence scripts and uploaded data.
