A tampered Claude Code extension sat in the Cursor marketplace for 11 hours and installed an SSH backdoor
The short answer
On 29 October, a modified build of Anthropic's Claude Code extension was published to the Cursor VS Code extension marketplace under the real publisher's identity and offered to users as an ordinary update. It was available for about eleven hours. Cursor says at most 5,000 users were affected. The payload added an attacker's SSH key to the machine, tried to open a reverse tunnel, and installed persistence so it survived a reboot. Anthropic never published those versions.
What happened, in order
Cursor's timeline is specific. The malicious package, anthropic.claude-code versions 2.1.312 and 2.1.313, was served between about 2:27am and 1:35pm Pacific time on 29 October. That is the middle of the working day for Europe and the start of it for the United States, which is exactly when a developer is least likely to question an update prompt.
When it ran, it did what a remote access toolkit does. It collected basic host details, added an SSH key named svc-telemetry to the account's authorised keys, attempted to start the local SSH service, opened a reverse tunnel out, and installed persistence: a LaunchAgent on macOS, a scheduled task on Windows. Some builds also reported host information to an address that has since been taken offline.
Cursor removed the package and shut down the marketplace while it audited the rest of it, rotated its keys, and rebuilt the marketplace before restoring it. Microsoft's security team confirmed the package was never published on the Visual Studio marketplace or the npm package for Claude Code, which narrows the blast radius to people who installed it through Cursor.
Why this one matters more than a normal bad extension
Extension marketplaces have had malicious packages before. What makes this different is who published it: the extension carried Anthropic's own publisher identity, so nothing in the listing looked wrong. There was no lookalike name, no typosquat, no suspicious rating count. The only signal was the version number, and only if you happened to know that Anthropic went from 2.1.312 to 2.1.314.
That is the uncomfortable part for anyone who builds with AI tools. The editor is now the place where credentials live: repository tokens, cloud keys, SSH keys, environment files. One update prompt accepted at 9am is enough to hand all of it over, and the tool that gets blamed will be the one whose name was on the extension.
If you use Cursor, check these five things
- Version. Open the extensions panel and look at
anthropic.claude-code. Anything at 2.1.312 or 2.1.313 installed on 29 October should be removed and reinstalled from a clean source. - SSH keys. Read
~/.ssh/authorized_keysand look for an entry you did not add. A key labelledsvc-telemetryis the indicator published by Cursor. - Persistence. On macOS check LaunchAgents for a new plist created on 29 October. On Windows check scheduled tasks for something created that day, particularly one that tries to run as SYSTEM.
- Outbound connections. A reverse SSH tunnel from a developer machine should not exist unless you built it. Check for an SSH process you did not start.
- Rotate, do not debate. If any of the above is present, treat every credential on that machine as exposed: cloud keys, repository tokens, CI secrets, and any password stored in the browser profile.
What it means if you do not use Cursor
The specific package does not touch you, but the pattern does. Every AI coding tool now runs with your permissions, updates itself, and pulls code from a registry you do not audit. The reasonable response is not to stop using them; it is to stop treating the editor as a trusted boundary. Keep credentials out of the machine where possible, scope tokens to a single repository, and pin extension versions on anything that touches production.
We covered the same lesson from a different angle earlier this week in our note on five AI coding tools with a breakable embedded browser. Same conclusion both times: the model is not the attack surface. The plumbing around it is.
Questions people are asking
Was Anthropic's own build compromised?
No. Cursor says the modified versions were not developed by Anthropic, and Anthropic's published releases went from 2.1.312 to 2.1.314. The bad builds existed only in Cursor's marketplace.
How do I know if my machine was affected?
Check the extension version, look for an unknown key in authorised_keys, and check for new LaunchAgents or scheduled tasks created on 29 October. Cursor published the indicators in its security notice.
Does this affect VS Code or npm users?
Microsoft says the malicious packages were never published on the Visual Studio marketplace or the npm package, so the exposure is limited to the Cursor marketplace.
What should I do first if I think I was hit?
Rotate credentials rather than investigating first. Cloud keys, repository tokens and CI secrets on that machine should be treated as exposed, then remove the extension and the persistence.
Is the marketplace safe to use now?
Cursor rebuilt it and says no other extension was tampered with. That is a statement about this incident, not a guarantee about the next one.
Sources
Cursor, "Security notice: malicious version of anthropic.claude-code (2.1.312 and 2.1.313)", 29 October 2026 · Microsoft Security Blog, 30 October 2026 · The Hacker News, 30 October 2026 · Ostorlab analysis, 30 October 2026.