On 29 October, Cursor says, a maliciously modified version of Anthropic's Claude Code extension was available in the Cursor extension marketplace. Cursor's security notice says the extension runs code that "attempts to install a persistent SSH backdoor". The notice says the modified package was version 2.1.313 of Anthropic.claude-code, and that at most 5,000 users were affected.

What Cursor says happened

According to Cursor's notice, the tampered build was available between about 2:27am PT and 1:35pm PT on 29 October. AI Chat Daily, reporting on 30 October, put the window at about 11 hours.

Cursor's position on authorship is direct: "This malicious version of the extension was not developed by Anthropic." Cursor also says: "We have no evidence that other versions of the extension or the official distribution are affected."

Cursor says it took these steps:

  • It removed the malicious version and blocked further distribution.
  • It shut down the whole VS Code marketplace as a precaution.
  • It audited access and confirmed no other extensions were tampered with.
  • It rotated its keys, rebuilt the marketplace and brought it back online.
  • It worked with the hosting provider to take the attacker's server offline.

Cursor says that server no longer functions, so the reverse shell and the host-detail upload no longer work. It says it will contact affected users directly.

What the injected code did

OpenSourceMalware, which published an analysis of the package, says the extension identified itself as anthropic.claude-code version 2.1.313. It says the main JavaScript bundle held a 66-line loader inserted before the legitimate extension code. Loading the extension was enough to run it: the user did not need to start a conversation with Claude. The analysis says the package declares no install scripts, so the behaviour occurs at extension runtime.

Cursor and OpenSourceMalware describe the same sequence of actions:

  • Collecting host details. The code gathered hostname, username, operating system, architecture, home directory, working directories, the configured Git email and the public IP address. OpenSourceMalware says it also collected the names, not the values, of up to 40 environment variables containing words such as KEY, TOKEN, SECRET, PASS, AWS or GCP.
  • Adding an SSH key. It appended an attacker-controlled public key, labelled svc-telemetry, to the user's authorized_keys file.
  • Enabling SSH and opening a tunnel. It tried to turn on the local SSH service and open a reverse SSH tunnel to 134.209.82[.]225. Cursor says background scripts retried the tunnel roughly every 60 seconds.
  • Installing persistence. On macOS this was a LaunchAgent named com.apple.sysmond. On Windows it was a scheduled task called SysMon that attempts to run as SYSTEM, with a Startup-folder script as fallback. OpenSourceMalware says Linux got an @reboot crontab entry.
  • Reporting back. It sent the collected information by HTTP POST to port 8099 of the same server.

OpenSourceMalware says the injected stage downloads no further executable or script.

Why the worst step probably failed on most machines

Cursor says turning on the local SSH service needs administrator rights, which the extension does not have on most macOS and Windows hosts. On those hosts, it says, the attacker could not have logged in through the tunnel. It adds that the extension still added the attacker's key, installed persistence and sent host details, and tells users to follow its remediation steps regardless.

Security firm Phorion, in an advisory dated 30 October, describes a specific flaw on macOS. By its account, the script runs systemsetup -getremotelogin without administrator access. That prints an error and exits with status 0, and the script only tries to enable Remote Login if the output contains "Off". So it skips the enabling step. Phorion adds that a Mac with Remote Login already switched on, or switched on later, would leave the backdoor ready.

My reading is that Cursor's reassurance covers inbound access only. The key and the persistence scripts are described as installed either way.

What is not yet explained

Pasquale Pillitteri's write-up says Cursor's notice does not explain how the version reached the marketplace.

A Hacker News comment from the account felixrieseberg, which opens "Felix from Anthropic here.", says: "We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users." AI Chat Daily, in its 30 October report, said Anthropic did not immediately respond to a request for comment.

Another Hacker News commenter, Phemist, disagreed. Phemist wrote that a responsible vendor would have considered the Cursor (OpenVSX) extension an official channel, and that the extension hosted there has Anthropic copyright notices and terms of use. OpenSourceMalware says Cursor told it that the Claude Code extension in the Cursor Marketplace was the origin of the malicious extension, not Open VSX.

OpenSourceMalware's analysis says "The provenance of the analyzed directory is not established." It continues: "These findings show that this specific artifact is malicious; they do not, by themselves, demonstrate that Anthropic’s official Marketplace release or distribution infrastructure was compromised."

On other channels, OpenSourceMalware says the @anthropic-ai/claude-code npm package, the OpenVSX extension and the Microsoft VS Code extension are not malicious. Pillitteri notes that the Microsoft marketplace version history jumps from 2.1.312 to 2.1.314, with no 2.1.313. Cursor was acquired by SpaceX, according to AI Chat Daily and India Today.

What Cursor tells users to do

Cursor's advice applies to anyone who installed or updated to 2.1.313 from the Cursor marketplace in that window:

  • Check for the key. Look in ~/.ssh/authorized_keys for the svc-telemetry key. On macOS, Cursor gives a one-line grep for this. On Windows, it gives a PowerShell check covering both the user's authorized_keys file and the administrators' one.
  • Run the removal script. Cursor published remediation scripts for macOS and Windows, and warns that uninstalling the extension may not be sufficient, because the payload drops standalone persistence scripts that keep running.
  • Isolate and rotate. It advises isolating hosts that show evidence of payload execution and rotating credentials and sessions reachable from affected machines, from a trusted system. It says the limited environment-variable collection does not rule out later credential access over the backdoor.
  • Update. Cursor's post on X, embedded in Pillitteri's write-up, asks all customers to update to Claude Code for VS Code version 2.1.314.

Pillitteri notes that the 5,000-user figure is Cursor's own estimate and that no third party has verified it. Cursor's notice lists indicators for security teams, including the attacker IP address, file paths, hashes and command-line patterns, and gives [email protected] for questions.

Sources

Agarwal, A. (2026) 'Cursor shuts down marketplace after malicious Claude Code extension hits 5,000 users, offers fix', India Today, 30 October 2026, available at: https://www.indiatoday.in/technology/news/story/cursor-shuts-down-marketplace-after-malicious-claude-code-extension-hits-5000-users-offers-fix-3028432-2026-10-30 (Accessed: 30 October 2026).

Cursor (2026) 'Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace', Cursor, 29 October 2026, available at: https://cursor.com/blog/claude-code-extension-security-notice (Accessed: 30 October 2026).

Hall, C. (2026) 'Official Claude Code Extension Compromise: Security Advisory', Phorion, 30 October 2026, available at: https://phorion.io/blog/offical-claude-code-vsx-compromise/ (Accessed: 30 October 2026).

OpenSourceMalware (2026) 'Trojanized Claude Code Extension Plants an SSH Backdoor', OpenSourceMalware, 30 October 2026, available at: https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor (Accessed: 30 October 2026).

Pillitteri, P. (2026) 'Claude Code extension compromised on Cursor, tries to open an SSH backdoor', Pasquale Pillitteri, 30 October 2026, available at: https://pasqualepillitteri.it/en/news/28312/claude-code-extension-cursor-ssh-backdoor (Accessed: 30 October 2026).

Schafer, J. (2026) 'Cursor says malicious Claude Code extension tried to backdoor up to 5,000 users', AI Chat Daily, 30 October 2026, available at: https://www.aichatdaily.com/ai-security/cursor-says-malicious-claude-code-extension-tried-backdoor (Accessed: 30 October 2026).

Picture credits

  • Top picture: The Golden Gate Bridge and San Francisco skyline. Photo: Daniel L. Lu, CC BY-SA 4.0 (source)