A security incident involving a tampered version of Anthropic’s Claude Code extension briefly exposed users of the Cursor AI coding platform on October 29, 2026.
Cursor, the SpaceX-owned company behind the popular AI-assisted code editor, disclosed that malicious builds of the Anthropic.claude-code extension—specifically versions 2.1.312 and 2.1.313 for Windows and macOS—were available in its VS Code Extension Marketplace for roughly eleven hours, from about 2:27 a.m. to 1:35 p.m. Pacific Time.
The company estimated that no more than 5,000 users were affected.Cursor emphasized that these altered packages were not created by Anthropic.
The malicious code attempted to establish a persistent SSH backdoor on infected machines.
Upon loading, it gathered system and user details, including hostname, username, operating system and architecture, home directory path, names of environment variables, working directories, configured Git email addresses, and the machine’s public IP address.
It then tried to append an attacker-controlled public key, labeled “svc-telemetry,” to the user’s SSH authorized_keys file, enable the local SSH service, and open a reverse SSH tunnel to a remote server at 134.209.82.225.
Persistence mechanisms were also deployed: a LaunchAgent on macOS or a scheduled task (with a Startup-folder script fallback) on Windows, designed to retry the tunnel connection approximately every 60 seconds.
Cursor noted that errors in the malicious code, combined with the fact that enabling SSH typically requires administrator privileges, meant the remote-access step would fail on most standard machines.
Nonetheless, the extension successfully added the unauthorized key, installed the persistence components, and transmitted host reconnaissance data before the attack was disrupted.
Upon discovery, Cursor immediately removed the malicious versions, blocked further distribution, and took the entire marketplace offline as a precaution.
After auditing access controls and confirming that no other extensions had been altered, the company rotated its keys, rebuilt the marketplace from scratch, and restored it.
Cursor also coordinated with the cloud hosting provider to take the attacker’s command-and-control server offline, neutralizing the reverse shell and data-exfiltration endpoint.
Anthropic separately clarified that the incident did not involve any compromise of its own systems or employee devices.
A member of its technical staff stated that a malicious actor had exploited access to Cursor’s marketplace to publish a modified copy of the Claude Code extension that Anthropic neither built nor released.
Official versions of the extension available through Anthropic’s channels, including the Microsoft VS Code Marketplace and Open VSX, remained unaffected; the issue was limited to Cursor users.
Cursor has urged anyone who installed or updated to the affected versions during the exposure window to check their systems for the “svc-telemetry” key, remove any persistence mechanisms, isolate potentially compromised hosts, and rotate credentials and sessions from a clean machine.
Uninstalling the extension alone is not sufficient, as the payload drops standalone scripts that continue running.
The company is also recommending that all users update to the clean version 2.1.314.
Indicators of compromise, including file hashes and remediation scripts, have been published for both macOS and Windows.
The episode highlights the risks inherent in software supply chains for developer tools, where a single compromised distribution channel can briefly affect thousands of machines that routinely hold sensitive credentials and source code.
