Malicious Claude Code Extension Hit Cursor Marketplace

Introduction

On October 29, 2026, Cursor identified a security incident in its VS Code Extension Marketplace. Two builds of the extension listed as Anthropic.claude-code, versions 2.1.312 and 2.1.313 for Windows and macOS, were malicious. Cursor's notice states that "these malicious versions of the extension were not developed by Anthropic," and that it has "no evidence that other versions of the extension or the official distribution are affected."

According to Cursor, a maliciously modified version of Anthropic's Claude Code extension was available between about 2:27am PT and 1:35pm PT that day. The code attempts to install a persistent SSH backdoor. Cursor updated its notice on October 30 at 11:30am PT with revised indicators of compromise and clarified affected versions. Security firm Phorion's advisory was updated on October 31 to add 2.1.312, after first identifying only 2.1.313.

Timeline and Affected Builds

Ars Technica's headline describes the extension as backdoored for "nearly 12 hours." Ars reports that Anthropic pushed version 2.1.314 several hours after the earlier version appeared on Cursor, citing independent researcher Kevin Beaumont.

What the Payload Does

Cursor lists three behaviors, and Phorion's reverse engineering adds detail.

1. Reconnaissance. The payload collects hostname, username, OS, architecture, home directory path, environment variable names, working directories, the configured Git email and the public IP. Phorion reports that only variable names matching KEY|TOKEN|SECRET|PASS|AWS|GCP are collected (up to 40), not their values, and that the report is sent by plaintext HTTP POST to a /beacon endpoint on port 8099.
2. SSH access. It attempts to append an attacker-controlled SSH key, labeled svc-telemetry, to authorized_keys, enable the local SSH service and open a reverse SSH tunnel.
3. Persistence. It attempts to keep the tunnel alive through a LaunchAgent on macOS, or a scheduled task that tries to run as SYSTEM with a Startup-script fallback on Windows. Background scripts retry the tunnel roughly every 60 seconds.

Phorion adds that the injected code is prepended to the extension bundle and executes as soon as Node loads the file, before the extension's normal activate callback, so no user interaction is required. Phorion also says the implant contains setup logic for macOS, Linux and Windows, while Cursor's notice describes the affected builds as being for Windows and macOS.

Why It Often Failed, and Why That Is Not a Defense

Cursor says that, outside highly unusual cases where Cursor was started with administrator privileges, the SSH-enabling step would fail because of errors in the malicious code and because turning on the local SSH service needs admin rights. On those hosts the attacker could not have logged in through the tunnel. Phorion traces one such bug on macOS: systemsetup -getremotelogin run without elevation prints an administrator-access error and exits with status 0, so the script never sees "Off" and skips the enablement step.

Cursor is explicit that this is no reason to stand down. The extension still added the attacker's key, installed persistence and sent host details. Phorion adds that if Remote Login was already enabled, or is turned on later, the backdoor is ready and waiting.

How to Check and Remediate

Cursor's guidance applies if you installed or updated to 2.1.312 or 2.1.313 from the Cursor marketplace on macOS or Windows during the window. On macOS, Cursor provides this check:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

Cursor also publishes a PowerShell equivalent, and platform remediation scripts (remediate-macos.sh and remediate-windows.ps1) that remove the extension, persistence, running tunnel processes and the attacker's key. Its steps include searching endpoint and network telemetry for the published indicators, isolating hosts that show payload execution, and rotating credentials and sessions reachable from affected hosts from a trusted system. Cursor warns that uninstalling the extension may not be sufficient, because the payload drops standalone persistence scripts that keep running. Phorion notes that successful inbound logins through the tunnel would appear in SSH logs as coming from localhost with the svc-telemetry key.

What Is Not Yet Established

• How the builds were published. Ars reports that Beaumont and Phorion's CTO said 2.1.313 was distributed through Anthropic's official account on Cursor, and that neither Cursor nor Anthropic had explained how attackers gained control of it. Cursor's notice, as read on October 31, does not state a root cause. Evermx does not characterize the incident beyond what these sources establish.
• User count. Ars attributes an "at most 5,000 users" figure to Cursor. That figure does not appear in the current Cursor notice, so treat it as Ars's reporting.
• Anthropic's response. Ars reported on October 30 that Anthropic had not publicly warned customers. As of publication, Evermx found no statement about this incident on Anthropic's news page or in the Claude status incident history, both checked on October 31.

Analysis: Marketplace Supply-Chain Risk for AI Coding Tools

Extensions run with the permissions of the IDE and the user, so a tampered extension gets immediate access to local files, source code and developer tooling, as Phorion notes. Phorion says the environment-variable-name collection gives the operator a quick inventory of which cloud credentials or API tokens live on a machine, so they know which hosts to prioritise.

The incident also shows that a vendor name on a listing is only as reliable as the publishing controls of the marketplace carrying it. As an editorial suggestion rather than a sourced finding, teams may want to review whether editor extensions auto-update on developer machines (Phorion's CTO told Ars that Cursor extensions auto-update by default but can be configured) and to monitor extension host processes that write to SSH authentication files, a detection approach Phorion describes.

Pros and Cons of the Response

Strengths: Cursor published hashes plus network, file and process indicators, check commands and remediation scripts, and removed the builds on detection, per its notice. Phorion's independent write-up documents the implant, including its bugs.

Limitations: The cause is unexplained in the sources reviewed, uninstalling is not enough, and affected-version guidance changed after the first reports.

Outlook

Open items to watch are a root-cause statement from Cursor or Anthropic, any Anthropic notice to customers, and further revisions to the indicator lists. Both vendors' pages may change; this article reflects sources as of October 31, 2026.

Conclusion

For anyone who updated this extension through Cursor on October 29, the practical step is to run the published check and, if the svc-telemetry key is present, remediate and rotate credentials rather than simply uninstalling. For everyone else, the incident is a reminder that extension marketplaces are part of the software supply chain for AI coding tools. Rating: 3 out of 5, reflecting the incident's severity for affected users against a contained scope and a documented response.

Editor's Verdict

Malicious Claude Code Extension Hit Cursor Marketplace is a contained but serious supply-chain incident, and the documented response makes it actionable for anyone affected.

The strongest case for paying attention: Cursor published file hashes plus network, file and process indicators of compromise. That alone gives defenders something concrete to hunt for. Reinforcing that, Cursor provided check commands and remediation scripts for both macOS and Windows — practical value rather than just headline appeal. The broader signal worth registering is straightforward: the affected builds appeared under the Anthropic.claude-code name on Cursor's marketplace, yet Cursor states they were not developed by Anthropic. On the other side of the ledger, one constraint is real rather than a marketing footnote: the sources reviewed do not explain how the malicious builds were published. It should factor into any serious decision. Layered on top of that, uninstalling the extension alone does not remove the persistence the payload installs — which means a quick uninstall is not a fix.

For developers and security teams who run Claude Code inside Cursor, the smart move is to run Cursor's check now and watch for a root-cause statement from Cursor or Anthropic.