Cursor says a maliciously modified version of Anthropic's Claude Code extension was distributed through its VS Code extension marketplace on October 29, reaching up to 5,000 users. The tampered build, version 2.1.313 of the Anthropic.claude-code extension, tried to plant an SSH backdoor on developer machines. Cursor said in a security notice that the version was not developed by Anthropic.
The window was about 11 hours. Cursor says the modified version became available at roughly 2:27 a.m. Pacific Time and was pulled at about 1:35 p.m. the same day, after which the company blocked further distribution and contacted affected users directly.
Once installed, the extension collected host and user details: hostname, username, operating system, architecture, home directory path, environment variable names, working directories, the configured Git email and the machine's public IP address. It sent that information, along with the status of the backdoor, by HTTP POST to an attacker-controlled server on port 8099.
Key facts
- 01Cursor says a malicious Anthropic.claude-code extension, version 2.1.313, was live in its marketplace on October 29, 2026.
- 02The tampered build was available from about 2:27 a.m. to 1:35 p.m. Pacific Time, and up to 5,000 users were affected.
- 03The code added an attacker SSH key labeled svc-telemetry and installed persistence on macOS and Windows hosts.
- 04Cursor says the version was not developed by Anthropic and no other extensions were tampered with.
- 05Cursor rotated its keys, rebuilt the marketplace and published remediation scripts for macOS and Windows.
The backdoor itself had three parts. The code added an attacker-controlled SSH key, labeled svc-telemetry, to the user's authorized_keys file, tried to switch on the local SSH service, and tried to open a reverse SSH tunnel to the attacker's server. Background scripts retried the tunnel roughly every 60 seconds.
Cursor says the most dangerous step would fail on most machines. Enabling SSH requires administrator rights, which the extension does not have on most macOS and Windows hosts, so in most cases the attacker could not log in through the tunnel. The key and persistence were still installed on most hosts, though. On macOS that persistence took the form of a LaunchAgent named com.apple.sysmond; on Windows, a scheduled task called SysMon that tries to run as SYSTEM, with a Startup-folder script as a fallback.
Cursor's response went beyond removing one package. The company temporarily shut down its entire VS Code extension marketplace, audited access, confirmed no other extensions had been tampered with, rotated its keys and rebuilt the marketplace before bringing it back online. It also worked with the hosting provider to take the attacker's server offline, and says that server no longer functions.
Cursor says it has no evidence that other versions of the Claude Code extension, or Anthropic's official distribution, were affected. Cursor has not said how the modified build got into its marketplace. Anthropic did not immediately respond to a request for comment.
For developers who installed or updated to version 2.1.313 during the window, Cursor's guidance is blunt: uninstalling the extension may not be enough, because the standalone persistence scripts keep running. The company published a remediation script for macOS, run as the affected user rather than root, and a PowerShell script for Windows, run as Administrator. Both exit with a non-zero status if anything remains.
The quickest check is to search the SSH authorized_keys file for the svc-telemetry key. Cursor also published file paths, VSIX hashes, the attacker IP address 134.209.82.225 and command-line patterns such as autossh and schtasks entries for security teams to hunt in endpoint and network telemetry. It recommends isolating any host that shows signs of payload execution, considering a full rebuild, and rotating credentials and sessions reachable from affected machines using a trusted system.
Cursor, which is owned by SpaceX, said the incident did not affect other extensions on its marketplace and directed questions to its security team at security@cursor.com.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
