A Tampered Claude Code Extension Reached 5,000 Cursor Users: What Happened and What to Check Now

Key takeaway: A tampered copy of Anthropic’s Claude Code extension sat in Cursor’s extension marketplace for about 11 hours on October 29, 2026, reaching at most 5,000 users. It tried to plant a persistent SSH backdoor, so affected users must check for an attacker key and run Cursor’s cleanup script — simply uninstalling the extension is not enough.

Cursor, the AI code editor built on Visual Studio Code, disclosed the incident on October 29, 2026. The malicious builds were versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension for macOS and Windows, distributed through Cursor’s own VS Code extension marketplace. Cursor says the builds were not developed by Anthropic, and Anthropic says its own systems were not compromised.

What happened on October 29

Between about 2:27 a.m. and 1:35 p.m. Pacific Time on October 29, 2026 — 09:27 to 20:35 UTC — a maliciously modified version of the Claude Code extension was available in Cursor’s marketplace. Cursor says at most 5,000 users received it, and that it will contact affected users directly.

The tampered build looked like the real extension: there was no obvious typo or fake publisher name for users to spot. Its malicious code loaded as soon as the editor loaded the extension, before any Claude conversation started, according to researchers who analysed the package. Cursor removed the builds on detection, then shut down its entire marketplace as a precaution, audited access, found no other tampered extensions, rotated its keys, rebuilt the marketplace, and brought it back online. It also worked with the hosting provider to take the attacker’s server offline, so the beacon and reverse tunnel no longer function.

Who is affected — and who is not

You are in scope only if all of these apply: you use Cursor on macOS or Windows, and you installed or auto-updated the Claude Code extension to version 2.1.312 or 2.1.313 from Cursor’s marketplace during the October 29 window.

Users of Microsoft’s Visual Studio Code, which installs from the Visual Studio Marketplace, are not affected, and neither are users of editors that install from Open VSX. Early coverage pointed at the Open VSX registry as the source, but the corrected picture — confirmed by Cursor and Anthropic — is that the tampered build was limited to Cursor’s marketplace, with official distribution channels clean. One grey area remains: some early analysis found a clean 2.1.312 build on Open VSX, while Cursor lists 2.1.312 among the bad versions in its own marketplace. If you had either version from Cursor in that window, treat yourself as in scope and run the check below.

What the backdoor actually did

According to Cursor’s security notice, the malicious code collected and reported host details: hostname, username, operating system, architecture, home directory path, the names of environment variables (not their values), working directories, the configured Git email, and the machine’s public IP address.

It then tried to add an attacker-controlled SSH key, labelled svc-telemetry, to the user’s authorized_keys file, enable the local SSH service, and open a reverse SSH tunnel to the attacker’s server at 134.209.82.225. For persistence it installed a LaunchAgent called com.apple.sysmond on macOS, or a scheduled task called SysMon with a Startup-script fallback on Windows, retrying the tunnel roughly every 60 seconds.

Two facts limit the damage. Enabling the local SSH service needs administrator rights, which the extension does not have on most machines, and errors in the malicious code meant that step would fail unless Cursor was started with administrator privileges. Cursor says that on most affected machines the attacker could not have logged in through the tunnel. But the key was still added, persistence files were still written, and host details were still sent while the server was up — a failed tunnel is not an all-clear.

How to check and clean up your machine

Start with Cursor’s one-line check. On macOS, run:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

On Windows, run Cursor’s PowerShell check, which covers both the user’s authorized_keys file and the administrators’ file under C:\ProgramData\ssh. If the key is found, your machine is impacted.

If you are impacted, Cursor advises you to isolate the host, run its remediation script for your platform (remediate-macos.sh as the affected user, not as root; remediate-windows.ps1 from PowerShell opened as administrator), and rotate credentials and sessions accessible from that machine — from a trusted system, not the affected one. The scripts remove the malicious extension, the persistence mechanisms, the running tunnel processes, and the attacker key, and exit with a non-zero status if anything remains. Also update Claude Code to version 2.1.314 or later, the clean release Cursor points users to.

Do not stop at uninstalling the extension. The payload deliberately drops standalone persistence scripts that keep running after the extension is gone, which is why Cursor warns that uninstalling alone may not be sufficient. Machines that already had SSH or Remote Login switched on are the highest-risk case — assess whether they should be rebuilt.

What it costs, and what you need first

The fix itself is free: Cursor’s check and remediation scripts cost nothing, and the clean extension update is free. The real cost is time and caution — checking every machine that runs Cursor, rotating credentials from a clean device, and, in the worst case, rebuilding a host. Before you start you need only three things: your machine’s Cursor extension history (did it install 2.1.312 or 2.1.313 on October 29?), a terminal or PowerShell session, and a trusted, unaffected machine to rotate passwords and keys from.

What is still unknown, and what to watch

Verified fact: how the tampered build got into Cursor’s marketplace has not been publicly explained. Analysis: that gap is the most important unanswered question, because it decides whether this was a one-off marketplace slip or a weakness other extensions could inherit. Until Cursor explains it, treat marketplace auto-updates as a trust decision, not a background detail — especially for extensions that run code on a developer’s machine.

What to watch: whether Cursor publishes a root-cause explanation, and whether any affected user reports actual unauthorised access. The incident also lands in a week when AI trust controls are being tested in public — from a shared opt-out signal for AI training to tighter safety rules for younger users.

Why this matters beyond 5,000 users

Five thousand users is small next to Cursor’s total user base, but the target makes it serious: developer machines hold source code, cloud credentials, and production keys. A backdoor that survives uninstallation, even one whose tunnel mostly failed, is a reminder that an extension is code running with your user’s permissions, often auto-updated without a second thought. The defence here was not clever detection by users; it was a vendor notice, a one-line key check, and a cleanup script. For anyone building software with AI tools, that check is now part of basic hygiene.

Frequently asked questions

Was Anthropic hacked in the Cursor extension incident?

No, according to both companies. Cursor says the malicious versions of the Claude Code extension were not developed by Anthropic, and Anthropic says its systems and official distribution channels were not compromised. The tampered build was limited to Cursor’s marketplace.

How do I know if my machine got the tampered Claude Code extension?

Check whether you installed or updated to Claude Code version 2.1.312 or 2.1.313 from Cursor’s marketplace on October 29, 2026, then search your SSH authorized_keys file for a key labelled svc-telemetry. If that key is present, your machine is impacted and you should run Cursor’s remediation script.

Does uninstalling the extension remove the backdoor?

No. The payload installs persistence outside the extension folder — a LaunchAgent on macOS or a scheduled task with a Startup-script fallback on Windows — so it keeps running after the extension is removed. Run Cursor’s remediation script and check for the attacker key instead.

What should I do if I am affected?

Isolate the host, run Cursor’s remediation script for your platform, update Claude Code to version 2.1.314 or later, and rotate credentials and sessions accessible from that machine from a trusted system. Assess whether the host should be rebuilt, especially if SSH was already enabled on it.

Are VS Code or Open VSX users affected?

No. Cursor and Anthropic say the tampered build was never distributed through the Microsoft Visual Studio Marketplace, Open VSX, or Anthropic’s own channels. Only Cursor users who took versions 2.1.312 or 2.1.313 from Cursor’s marketplace in the October 29 window are in scope.