On October 29, 2026, Cursor pulled from its own extension marketplace a tampered build of Claude Code for VS Code, the extension that brings Anthropic’s coding agent into the code editor. Listed under the identifier Anthropic.claude-code as version 2.1.313, it was available there from about 2:27 a.m. to 1:35 p.m. Pacific Time for Apple silicon Macs and x64 Windows PCs. According to the security notice Cursor posted the same day, the build tried to install a persistent SSH backdoor and “was not developed by Anthropic.” At most 5,000 users were affected, and Cursor says it will contact them directly.
Early on October 30, Cursor posted on X asking all customers to update to version 2.1.314. The pattern resembles what happened with Rank Math PRO, whose publisher shipped backdoored updates for 11 hours from its own website on October 15 and 16. In both cases, the tampered version reached users through their usual update channel: the publisher’s site for Rank Math PRO, Cursor’s extension marketplace for Claude Code.
Eleven hours on Cursor’s marketplace
Cursor, an AI coding editor built by Anysphere, runs its own marketplace of VS Code extensions. Its notice says the tampered version was available “between about 2:27am PT and 1:35pm PT” on October 29, or 9:27 a.m. to 8:35 p.m. UTC. The notice covers anyone who installed 2.1.313 from that marketplace during the window or received it as an update. Two packages are involved: darwin-arm64 for macOS and win32-x64 for Windows.
OpenSourceMalware, a malware-tracking site that analyzed the package, found it identical to the original except for one file, official bundled binary included. In extension.js, 66 lines of malicious code had been inserted ahead of the legitimate code. They run as soon as the editor loads the extension; the user never has to start a conversation with Claude.
Version 2.1.313 does not appear in any other Claude Code distribution channel. Anthropic’s changelog on GitHub jumps from 2.1.312 to 2.1.314, and none of the npm registry, Open VSX or Microsoft’s Visual Studio Marketplace listed a 2.1.313 on October 30. Version 2.1.314 showed up on those registries on the evening of October 29, around 5:12 p.m. PT on npm, then between 6:07 and 6:20 p.m. PT on Open VSX and Microsoft’s marketplace, according to their timestamps.
A planted SSH key, a persistent script and a report to the attacker
According to Cursor, the tampered extension starts by collecting information about the machine and its user: hostname, username, operating system, architecture, home directory path, environment variable names, working directories, configured Git email and public IP address. OpenSourceMalware adds that the code keeps the names of up to 40 variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP, but not their values. Those names alone can reveal which cloud providers and credential types are set up on the machine, the site notes.
The code then appends an attacker-controlled SSH key to the user’s authorized_keys file. It tries to turn on the machine’s SSH service and open a reverse SSH tunnel to the attacker’s server: an outbound connection held open from the machine, which the attacker could use to connect back in if the SSH service is running.
To make the tunnel persistent, it installs a LaunchAgent named com.apple.sysmond.plist on macOS. The name mimics Apple’s naming, but the file is not an Apple component, OpenSourceMalware points out. On Windows, it tries to create a scheduled task called SysMon that runs as SYSTEM and, if that fails, drops a script in the user’s Startup folder. Background scripts restart the tunnel roughly every 60 seconds.
The extension also sends the collected information and the backdoor’s status to the attacker’s server in an HTTP request to port 8099. According to OpenSourceMalware, the code downloads no additional malware and ignores whatever the server sends back.
SSH access failed on most machines
Enabling the SSH service requires administrator rights, which the extension does not have on most macOS and Windows machines, Cursor writes. On those machines the step fails and “the attacker could not have logged in through the tunnel,” except in “highly unusual circumstances” where Cursor was launched with administrator privileges. Cursor also cites “errors in the malicious code.” Security firm Phorion describes one on macOS: run as a standard user, the command that checks Remote Login status prints an error instead of “Off,” so the script skips the step that would turn it on.
The failed tunnel does not stop the rest of the code: the extension still adds the attacker’s key, sets up persistence and sends the machine’s details, Cursor says. It warns that “uninstalling the extension may not be sufficient,” because the persistence scripts keep running. The attacker’s server no longer responds; Cursor got the hosting provider to take it offline.
Several questions remain open. Cursor does not explain how the tampered version got into its marketplace, and OpenSourceMalware only reports that Cursor told it the Claude Code extension in its marketplace “experienced some form of compromise.” The 5,000 figure is a ceiling: Cursor does not say how many machines actually ran the code. OpenSourceMalware’s first post attributed the tampered build to the Open VSX registry; the site corrected it after Cursor got in touch.
As of early afternoon Paris time on October 30, Anthropic had posted no statement on its news page, its status page or the security advisories of the Claude Code GitHub repository.
Cursor rebuilds its marketplace and publishes cleanup scripts
Cursor says it removed the version as soon as it was detected and blocked further distribution, then shut down its entire extension marketplace “out of an abundance of caution.” An access audit found no other tampered extensions, the company adds. It rotated its keys, rebuilt the marketplace and brought it back online. Cursor reports “no evidence that other versions of the extension or the official distribution are affected,” and OpenSourceMalware says the npm package and the Open VSX and Microsoft marketplace extensions are not malicious.
To check whether a machine is affected, Cursor advises searching for the string svc-telemetry, the label of the attacker’s key, in ~/.ssh/authorized_keys on macOS and, on Windows, in the user’s copy of that file and in the one under ProgramData. If the string shows up, Cursor provides cleanup scripts, meant to be run as the affected user on macOS and from an elevated PowerShell window on Windows.
The notice recommends isolating the machine, deciding whether it should be rebuilt and rotating the credentials and sessions reachable from it, working from a trusted system. The limited collection of environment variables “does not rule out later credential access over the backdoor,” Cursor notes. It also lists indicators of compromise: the server address, package hashes and the files created.
In its post on X, Cursor adds that the incident does not affect other extensions in its marketplace or “Grok Bot, Grok or our other SpaceXSI products.” Cursor is owned by SpaceX, which acquired it in August, according to BusinessToday.
What it means
On Cursor’s marketplace, the attacker reused the extension’s official identifier, Anthropic.claude-code, and the version number right after that of the last genuine release (2.1.312). According to OpenSourceMalware, the extension kept its usual interface while the malicious code ran. To a user, 2.1.313 looked like a routine update.
Since mid-October, several makers of professional software have seen their own infrastructure turned against their customers. After Rank Math PRO, keys stolen from TeamUpdraft were used to install malicious plugins on WordPress sites running UpdraftPlus on October 18 and 19, and an intrusion at OpenCode, disclosed on October 17, may have exposed OpenAI and Anthropic API keys. Cursor’s case adds a code editor’s own extension marketplace to the list: a single point of failure for everyone who installs from it.
The announced scope is limited to version 2.1.313 as served by Cursor’s marketplace: neither the notice nor the post on X mentions VS Code users who install from Microsoft’s marketplace, or people using Claude Code in the terminal. The risk comes from what these tools can reach: an extension runs with the permissions of the code editor and its user, Phorion notes, and a coding agent works amid source code, SSH keys and access to cloud services.
Even where the SSH access failed, the attacker’s key and the persistent scripts stay on disk until someone removes them, and machine details went to the server for as long as it was up. Three things are still missing: Cursor’s explanation of how the tampered version got into its marketplace, any response from Anthropic, whose name served as cover, and the number of machines where the svc-telemetry key was actually found.
Sources
- Security notice: malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace, Cursor, October 29, 2026
- We identified a security incident affecting a modified Claude Code VS Code extension, Cursor (@cursor_ai) on X, October 30, 2026
- Trojanized Claude Code Extension Plants an SSH Backdoor, OpenSourceMalware, October 30, 2026
- Official Claude Code Extension Compromise: Security Advisory, Phorion, October 30, 2026
- Claude Code, CHANGELOG.md, Anthropic on GitHub, read October 30, 2026
- Claude Code for VS Code, Visual Studio Marketplace (Microsoft), version history read October 30, 2026
- Claude Code for VS Code, Open VSX, version history read October 30, 2026
- Cursor flags malicious Claude Code extension, up to 5,000 users affected, Business Today, October 30, 2026
Header image: MACCUS chart. Data: Cursor, npm, Open VSX and Visual Studio Marketplace registries, read October 30, 2026
