Tampered Claude Code Extension on Cursor's Marketplace Reached Up to 5,000 Users

Cursor said on October 29, 2026 that a maliciously modified version of Anthropic's Claude Code extension was available in its extension marketplace for about 11 hours that day, reaching at most 5,000 users. The tampered build tried to plant a persistent SSH backdoor and sent host details to an attacker's server, the company said.

Claude Code is Anthropic's coding agent, and its extension runs it inside VS Code based editors such as Cursor. Like other AI developer tools delivered as extensions, it runs with the permissions of the editor and the user. Cursor stresses that the malicious versions "were not developed by Anthropic."

What did Cursor disclose?

Cursor said in a security notice dated October 29, 2026 that the tampered Claude Code extension was live in its marketplace between about 2:27 a.m. and 1:35 p.m. Pacific time that day. Users who installed or updated the extension on macOS or Windows in that window are the ones at risk, according to the notice.

Cursor says it removed the malicious version as soon as it was detected, then shut down the whole marketplace as a precaution. It audited access, found no other tampered extensions, rotated its keys, rebuilt the marketplace and brought it back online. In a post on X, the company put the impact at "at most 5,000 users" and asked all customers to update to Claude Code for VS Code version 2.1.314.

Cursor also had the attacker's server taken offline with its hosting provider, the notice says. It does not say how the modified build got into the marketplace.

The incident comes about 11 weeks after SpaceX closed its roughly $60 billion acquisition of Cursor maker Anysphere on August 14, 2026, GIGAZINE reported. Cursor's notice says Grok and its other SpaceX Super Intelligence products are not affected.

What did the malicious extension do?

The code ran as soon as the editor loaded the extension, before its normal startup routine, so a user did not have to open or click anything, according to a technical write-up by Calum Hall of macOS security firm Phorion, published October 30, 2026.

Both Phorion and Cursor describe the same four steps:

• A planted login key. The script appends an attacker's public key, labeled svc-telemetry, to the user's SSH authorized keys file. SSH is the standard protocol for remote logins, and that key lets its owner sign in as the user.
• A reverse tunnel. It opens an outbound SSH connection to a server at 134.209.82.225 that would forward the attacker's traffic back to the victim's own SSH port.
• Persistence. On macOS it installs a user LaunchAgent disguised with an Apple style name, com.apple.sysmond; on Windows it tries a scheduled task called SysMon, falling back to a Startup folder script. Background scripts retry the tunnel about every 60 seconds.
• Reconnaissance. It reports the hostname, username, operating system, home folder, Git email, public IP address and the names, not the values, of environment variables that look like keys or tokens.

Both firms warn that uninstalling the extension does not remove the backdoor, because the persistence scripts keep running on their own.

Could the attacker actually log in?

On most machines, probably not, according to both Cursor and Phorion: the tunnel only leads somewhere if the computer's own SSH service is running, and turning it on needs administrator rights the extension usually lacks. The two accounts differ on how rare the exceptions are.

Cursor says that "outside of highly unusual circumstances" where Cursor was started with administrator privileges, errors in the malicious code made this step fail, and the attacker could not have logged in through the tunnel. Phorion traced one of those errors on macOS: the script asks whether Remote Login is off without administrator rights, gets an error message back instead of the word "Off," and so never tries to switch SSH on. Phorion adds that this is no defense on a Mac where Remote Login was already enabled, or is turned on later, because the planted key and tunnel are then "ready and waiting."

Because the key, persistence and data upload did go through, Cursor tells affected users to follow its remediation steps "regardless."

Which versions were affected?

Cursor names Claude Code versions 2.1.312 and 2.1.313 for macOS and Windows, after an update to its notice on October 30, 2026 at 11:30 a.m. Pacific time that "clarified affected versions." Phorion's advisory, published the same day, names only 2.1.313 and says the 2.1.313 releases on npm and the VS Code marketplace were pulled as well.

The public npm registry is consistent with that account. As of October 30, 2026, the package metadata for Anthropic's Claude Code lists versions 2.1.312 and 2.1.314 but no 2.1.313. Version 2.1.314, the version number Cursor now asks users to install, was published at 00:12 UTC on October 30, which by this site's arithmetic is about three and a half hours after the window Cursor gives closed. Cursor says it has no evidence that the official distribution was affected; version 2.1.312 on npm dates from October 27 and is not flagged.

What we don't know yet

• How the attacker got a modified build into Cursor's marketplace, and whether Cursor's key rotation points to stolen publishing credentials.
• How many of the up to 5,000 users actually ran the payload, and whether any operator logged in through a tunnel before the server went offline.
• Why Cursor's and Phorion's lists of affected versions and platforms differ.
• Whether Anthropic will comment on the incident or change how its extension is distributed through third party marketplaces.