Claude Code extension tampered on Cursor's marketplace planted SSH backdoors for 11 hours

What Cursor disclosed

Anysphere, the company behind the Cursor code editor, published a security notice saying that malicious builds of the Claude Code extension, published under Anthropic's real extension ID Anthropic.claude-code as versions 2.1.312 and 2.1.313, were available in Cursor's VS Code extension marketplace on 29 October 2026. Cursor says the builds targeted macOS and Windows, were live from about 2:27am to 1:35pm Pacific time and reached at most 5,000 of its users. Cursor updated the notice on 30 October with revised indicators of compromise and the affected version list.

Cursor states plainly that these versions were not developed by Anthropic. Because the tampered package used the legitimate ID and a higher version number, editors with automatic updates treated it as a normal update to a widely used extension. Users did not have to search for or install anything unusual.

What the backdoor did

Researchers at OX Security, StepSecurity and others who analysed the package describe a short loader inserted ahead of the genuine extension code. According to OX Security and Cursor's notice, it collected host and user information, appended an attacker-controlled public key labelled svc-telemetry to the user's SSH authorized_keys file, installed a persistence mechanism outside the extension folder, tried to enable the local SSH service and tried to open a reverse SSH tunnel to an external server.

Cursor says the step that turns on the SSH server usually fails on macOS and Windows because it needs administrator rights, and some reports note that without it the attacker could not log in through the tunnel. Cursor still advises treating any machine that received the build as compromised. That is the cautious reading: the extension ran with the developer's own permissions, on machines that often hold source code, cloud credentials and API keys.

Updating to a clean version or uninstalling the extension does not remove the key or the autostart entry, because both live outside the extension directory. Cursor has published check and cleanup scripts for macOS and Windows and recommends looking for the svc-telemetry entry, isolating affected hosts, removing the key and persistence, considering a rebuild and rotating any credentials the user could reach.

Where it came from and what was not hit

Anthropic says the incident was not a compromise of its systems. Felix Rieseberg of Anthropic said it was not a breach of Anthropic's infrastructure or employee laptops, and the company's account is that a malicious actor used access to Cursor's marketplace to publish the tampered version. Microsoft has confirmed the malicious version was never published on the Visual Studio Marketplace or through npm. Reports conflict on Open VSX: Help Net Security said researchers saw the package there, while Socket said registry records show no public availability and BleepingComputer reported that Cursor was the only distribution point. Anthropic says its official VS Code and Open VSX listings were unaffected.

Cursor removed the version once it detected it, then shut down its entire marketplace to audit other extensions, rebuilt it, rotated all access keys and worked with the hosting provider to take the attacker's server offline. It says it found no other affected extension versions. Neither company has said how the attacker gained publishing access, which is the key open question for anyone who relies on a third-party mirror of extensions.

Why it matters for AI coding tools

AI coding agents are now among the most trusted software on a developer's machine. They read whole repositories, run terminal commands and hold tokens for model providers and code hosts, and they update often. A poisoned update to one of them is a high-value target, and this case shows that the risk sits not only with the model vendor but with every marketplace that redistributes its extension. Cursor, like other editors built on the VS Code codebase, runs its own extension store rather than Microsoft's, so a security gap there affects its users even when the original publisher is clean.

For individual developers the first check is short. Anyone who used Cursor on macOS or Windows on 29 October with automatic extension updates turned on should look at the installed Claude Code version history, search the SSH authorized_keys file for svc-telemetry and review login and startup items for entries they do not recognise. If the key is present, Cursor's guidance is to assume the attacker could have had access, so tokens for model providers, code hosts and cloud accounts stored on that machine should be revoked and reissued, not only the SSH key removed. Security teams can use the indicators in Cursor's updated notice to search endpoint logs for connections to the attacker's server.

The incident follows Anthropic's own threat report on misuse of Claude in cyber operations, though there is no sign the two are linked. For teams, the practical lessons are familiar ones from software supply chain security: pin extension versions in managed environments, monitor authorized_keys and autostart locations, and treat developer workstations as production systems. More coverage sits in our cybersecurity section.

Questions people ask

Which Claude Code versions were malicious?

Versions 2.1.312 and 2.1.313 of Anthropic.claude-code for macOS and Windows, but only as served by Cursor's extension marketplace on 29 October 2026, according to Cursor.

Does uninstalling the extension remove the backdoor?

No. The SSH key and the persistence entry sit outside the extension folder. Check authorized_keys for an entry labelled svc-telemetry and use Cursor's cleanup scripts, then rotate credentials.

Was Anthropic hacked?

Anthropic says no. It says an attacker used access to Cursor's marketplace to publish the tampered build, and that its official VS Code and Open VSX listings were not affected.

Sources

1. Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace (Cursor, 29 Oct 2026)
2. Compromised Claude Code Extension (2.1.313) in Cursor Marketplace Plants Attacker SSH Key and Persistence (OX Security, 29 Oct 2026)
3. Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines (StepSecurity, 30 Oct 2026)
4. Malicious Claude Code extension on Cursor planted SSH backdoors (BleepingComputer, 30 Oct 2026)
5. Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor (The Hacker News, 30 Oct 2026)
6. Claude Code extension poisoned with persistent SSH backdoor (Help Net Security, 30 Oct 2026)