Two tampered builds of the Claude Code extension, versions 2.1.312 and 2.1.313, were available in Cursor’s extension marketplace on Thursday, October 29, and tried to install a persistent SSH backdoor on developers’ computers. Cursor says the malicious files were live from about 2:27 a.m. to 1:35 p.m. Pacific time, that they were not written by Anthropic, and that the attacker’s server has since been taken offline. Anyone who installed or updated the extension on macOS or Windows in that window should check their machine today.

What happened

Cursor’s security notice describes a maliciously modified copy of the Anthropic.claude-code extension that was published to its VS Code-compatible marketplace. Security firm Phorion, which says it detected the problem, reports that the attacker added a block of code at the start of the extension’s main file while leaving the rest of the bundle looking normal, with the usual Claude Code strings and interface code.

According to Cursor, the code did four things:

  • It collected the hostname, username, operating system, home directory, names of environment variables, working directories, the configured Git email and the public IP address.
  • It tried to add an attacker-controlled SSH key, labeled svc-telemetry, to the user’s authorized_keys file.
  • It tried to switch on the local SSH service and open a reverse SSH tunnel to a server run by the attacker.
  • It tried to make that tunnel survive reboots, using a LaunchAgent on macOS or a scheduled task on Windows, with background scripts retrying roughly every 60 seconds.

Phorion’s write-up adds that the implant also contains logic for Linux. Cursor’s notice, however, lists Windows and macOS as the affected platforms and says it has no evidence that other versions or the official distribution were involved.

How far the attack got

Both companies say bugs in the malware limited the damage. Cursor explains that enabling the local SSH service normally needs administrator rights, which the extension does not have on most macOS and Windows machines, so on those hosts the attacker could not have logged in through the tunnel. Phorion found a specific mistake on macOS: the script checks the Remote Login state without root privileges, gets an error message instead of the word “Off,” and therefore skips the step that turns SSH on.

The important caveat is that the key, the persistence files and the host details were still sent or written. Phorion calls the malware “a significant threat” despite the flaws, because it establishes persistence and reports reconnaissance to the operator. Cursor also warns that the limited environment-variable collection “does not rule out later credential access over the backdoor.”

Ars Technica, which put the story in front of a wider audience on October 30, reported that as many as 5,000 users could have been affected, and that neither Cursor nor Anthropic had explained how the attacker gained control of the publishing account. Ars also reported that Anthropic had not yet issued a public notice to customers when it published. We have not seen an Anthropic statement either, so the root cause remains unconfirmed.

What to check and do

Cursor published a short test and removal scripts, and we recommend using its official page rather than copying commands from anywhere else. The logic is simple:

  1. Check whether your ~/.ssh/authorized_keys file (on Windows also C:\ProgramData\ssh\administrators_authorized_keys) contains a key with the comment svc-telemetry. If it does, treat the machine as affected.
  2. Do not rely on uninstalling the extension. Cursor says the payload drops standalone persistence scripts that keep running, so use the vendor’s remediation script or rebuild the host.
  3. Rotate credentials, API tokens and sessions that were reachable from the machine, doing so from a different, trusted computer.
  4. Search endpoint and network logs for the indicators in the Cursor and Phorion advisories, including the server address and the SysMon task name on Windows.

Why this matters beyond one extension

Editor extensions run with the same permissions as the editor and the person using it, which on a developer laptop means source code, cloud keys and access to production systems. AI coding tools raise the stakes because they are installed widely, update automatically by default and are trusted to touch the whole repository. Our guide to using AI coding assistants effectively covers permission hygiene, and the incident fits a pattern we have followed in recent weeks, from the OpenCode console breach that exposed API keys to the way AI models are finding and helping exploit PHP flaws.

A laptop protected with a physical security lock
Developer laptops hold source code and cloud keys, which is why a backdoored editor extension is a serious risk. Photo: Richard Nowell / Wikimedia Commons, CC BY-SA 4.0

Several practical lessons follow. Turn off automatic extension updates for tools that hold credentials, or at least delay them; pin versions in managed environments; and keep API keys in a secrets manager instead of environment variables that any extension can list.

What to watch next

  • Whether Anthropic publishes its own notice and explains how its marketplace account was compromised.
  • Whether Cursor and other VS Code-compatible marketplaces add signing, publisher verification or staged rollouts.
  • Further indicators of compromise or additional affected versions in updated advisories.
  • Whether the same group targets other AI developer tools on open extension registries.
  • Any evidence of follow-on access using credentials taken from affected machines.

Key takeaways

  • Claude Code extension versions 2.1.312 and 2.1.313 on Cursor’s marketplace were malicious, according to Cursor, and were live on October 29 for about 11 hours.
  • The code tried to plant an SSH key, enable remote login and keep a reverse tunnel open on macOS and Windows.
  • Bugs in the malware blocked inbound access on most machines, but the key and persistence files were still written.
  • Uninstalling the extension is not enough; use the vendor’s check and removal scripts and rotate credentials.
  • The root cause, meaning how the attacker reached the publishing account, has not been explained publicly.

Frequently asked questions

Which versions of the Claude Code extension were malicious?

Cursor identified versions 2.1.312 and 2.1.313 of Anthropic.claude-code, distributed through the Cursor marketplace for macOS and Windows. It says it has no evidence that other versions or the official distribution were affected.

How do I know if my computer was affected?

Look for a public key with the comment svc-telemetry in your authorized_keys file. If it is there, follow Cursor’s remediation steps and rotate any credentials that machine could reach.

Is it enough to uninstall the extension?

No. Cursor says the payload leaves behind scripts and scheduled tasks that keep running, so you need the removal script or a full rebuild of the machine.