Claude Code extension backdoor hits Cursor marketplace

A tampered copy of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313, sat in Cursor's VS Code Extension Marketplace for about 11 hours on October 29 and reached at most 5,000 installs. The payload tried to install a persistent SSH backdoor, so uninstalling the extension may not have cleaned affected machines.

Key facts

• The malicious builds of Anthropic.claude-code 2.1.312 and 2.1.313 were live in the Cursor VS Code Extension Marketplace from about 2:27am to 1:35pm PT on October 29, 2026 — roughly 11 hours.
• Cursor says at most 5,000 users downloaded the tampered builds, published under Anthropic's legitimate extension ID for Windows and macOS.
• The payload appended an attacker-controlled ed25519 key labeled svc-telemetry to authorized_keys, installed persistence (a macOS LaunchAgent, a Windows scheduled task), and beaconed host details to 134.209.82.225 over HTTP.
• Enabling the SSH service requires admin rights, so on most hosts the tunnel step failed — but the key, the persistence scripts, and the host-detail beacon landed anyway.
• OX Security's analysis found the tamper was a 66-line loader prepended to extension.js under Anthropic's real extension ID, so installer-side provenance checks would not have flagged it.
• Phorion, a detection firm, first spotted the malicious extension on a customer's Mac; Cursor has since taken the attacker server offline with the hosting provider.

What happened

Cursor disclosed the incident in a security notice on October 29 and updated it on October 30 with expanded indicators of compromise. Between roughly 2:27am and 1:35pm PT, a maliciously modified version of Anthropic's Claude Code extension was available in Cursor's own VS Code Extension Marketplace. The extension is Anthropic's agentic coding tool; Cursor, the AI code editor now owned by SpaceX, distributes it through its marketplace rather than through Anthropic's official channels.

The payload ran in three stages. First it collected host and user details: hostname, username, OS, architecture, home directory, environment-variable names, the configured Git email, and the public IP. Second it appended an attacker-controlled SSH key, labeled svc-telemetry, to the user's authorized_keys file, then tried to enable the local SSH service and open a reverse tunnel to tunnel@134.209.82.225 over TCP port 22. Third it made the tunnel persistent: a com.apple.sysmond LaunchAgent on macOS, a SysMon scheduled task that tries to run as SYSTEM on Windows, with background scripts retrying the connection about every 60 seconds.

The attack's saving grace was its own bug. Enabling the local SSH service requires administrator rights the extension does not normally have, and errors in the malicious code meant that step failed except in unusual cases where Cursor ran with elevated privileges. On those most machines the attacker could not actually log in through the tunnel. The failed step did not make the payload harmless: the SSH key, the persistence mechanisms, and the host-detail beacon all landed regardless. Cursor worked with the attacker server's hosting provider to take it offline, so the reverse shell and beacon are no longer functional.

Cursor removed the malicious versions, shut down the whole marketplace out of caution, audited access, rotated keys, and rebuilt the marketplace. The company says it has no evidence other extensions were tampered with. Anthropic staff separately stated on X that the malicious builds were not built or published by Anthropic and that no Anthropic systems were compromised. What remains unanswered is how the attacker got write access to the marketplace at all; Cursor did not respond to WIRED's question about whether this was a breach of Cursor itself.

Why it matters

The install-time trust model held exactly as designed and still failed. The extension ID was Anthropic's own, the publisher name matched, and nothing about the install looked off. If your defense is "only install extensions from the real publisher," this incident defeats it. The soft spot was not the model, the weights, or the code Anthropic shipped; it was the registry standing between the vendor and the developer.

That is now a pattern. In October, LiteLLM 1.107.0 shipped with a credential stealer and RAT after its package was tampered with, and ProjectDiscovery disclosed a backdoored 7B model published under a trusted name. AI developer tooling is being attacked through its distribution layer — marketplaces, package registries, model hubs — because that is where one compromise reaches thousands of developer machines at once. An agent harness with shell access is a particularly valuable target: the credentials it holds tend to be cloud keys, git tokens, and provider API keys with broad reach.

For builders running agent harnesses and coding agents, the remediation bar is higher than the uninstall button. Cursor explicitly warns that uninstalling the extension may not be sufficient because the payload drops standalone persistence scripts that keep running after removal. Affected hosts need the attacker key removed, persistence hunted down, credentials rotated from a trusted machine, and in some cases a rebuild.

Background

Claude Code is Anthropic's terminal- and editor-based coding agent, distributed both through Anthropic's official channels and through third-party editor marketplaces like Cursor's. The marketplace compromise affected only the Cursor distribution: Anthropic's own published versions carry different hashes, and Cursor's notice points auditors at the modified VSIX hashes so teams can check what they actually received.

Phorion's write-up of the VSX compromise describes detecting the implant on a customer Mac before Cursor's disclosure, and OX Security's breakdown documents the 66-line loader that turns the legitimate extension into a first-stage dropper. The incident is the second supply-chain compromise of AI developer tooling in ten days, and it lands in the same coverage family as our tracker work on AI security incidents across the provider stack. The common thread across the LiteLLM, ProjectDiscovery, and Cursor incidents is identity: in each case the malicious artifact carried a name developers already trusted.

What's next

Cursor's remediation scripts and indicators of compromise are on its security page, and the company updated the notice on October 30 with clarified affected versions. Unanswered questions to watch: how the attacker obtained marketplace publish access, whether Cursor publishes a post-mortem with that root cause, and whether the marketplace adds publisher-side signing or verification that would have caught a tampered build under a legitimate extension ID. Anyone who installed or updated Claude Code through Cursor's marketplace on October 29 should run the svc-telemetry check today; the attacker server is offline, but the planted SSH keys are not self-cleaning.