Trojanized Claude Code update in Cursor's marketplace planted an SSH backdoor — up to 5,000 installs, and removing the extension isn't enough

Between about 2:27 a.m. and 1:35 p.m. Pacific Time on October 29, 2026, a maliciously modified version of Anthropic’s Claude Code extension was available in the Cursor VS Code Extension Marketplace, according to Cursor’s security notice. It carried the extension’s legitimate publisher identity, anthropic.claude-code, and was served under the numbers 2.1.312 and 2.1.313 for Windows and macOS — so users with automatic updates could receive it as a routine update rather than a new install. The published code analysis examined version 2.1.313, a version number Anthropic never released on its official channels: Anthropic’s releases jump from 2.1.312 on October 27 to a clean 2.1.314 on October 30. Cursor says the malicious builds were not developed by Anthropic, that at most 5,000 users were affected, and that its audit found no other extensions tampered with. The extension on Open VSX, the Microsoft VS Code Marketplace and the npm package were confirmed clean in the published analysis. Cursor updated its notice on October 30 to clarify the affected versions.

Eleven hours as an ordinary update#

Cursor removed the malicious versions on detection, then shut the whole marketplace down, audited access, rotated its keys, rebuilt the marketplace and brought it back online. It also worked with the hosting provider to take the attacker’s server offline, so the reverse tunnel and beacon no longer function, according to the notice.

What the payload does#

The tampering was a 66-line loader inserted before the legitimate code in the extension’s main JavaScript file, extension.js, according to the analysis by OpenSourceMalware detailed by Ostorlab. Because it runs when the extension module loads — on editor startup and when the extension’s webview opens — no further action from the user was needed. The loader collects host and user details (hostname, username, operating system, architecture, home directory, configured Git email and public IP, plus the names — not the values — of up to 40 environment variables matching terms such as KEY, TOKEN and SECRET), appends an attacker-controlled Ed25519 public key labelled svc-telemetry to the user’s authorized_keys file, tries to switch on the local SSH service, and opens a reverse SSH tunnel to the attacker’s server, retrying roughly every 60 seconds. It also installs persistence: a LaunchAgent on macOS, a cron entry on Linux, and a scheduled task on Windows, plus a beacon that posts the collected details to the attacker’s server.

The tunnel step mostly failed — the rest still landed#

The most alarming step mostly failed. Enabling the local SSH service needs administrator rights the extension does not normally have, and Cursor says errors in the malicious code meant that step would fail outside highly unusual circumstances, such as Cursor itself running with administrator privileges. Without a listening SSH service, the tunnel had nothing to connect to on those machines. But the key, the persistence and the beacon still landed, and Cursor tells affected users to follow its remediation steps regardless. On a host where the SSH service did start, an operator holding the matching private key could have connected through the tunnel and run commands as the victim’s user account, the analysis notes. No second-stage downloader was found.

How it got in — and what is still unknown#

How the tampered build reached Cursor’s marketplace has not been established publicly. The method attackers used to introduce the unauthorised update remains unclear, and Anthropic has denied that its own systems were compromised. Felix Rieseberg, a member of Anthropic’s technical staff, said Anthropic was working with Cursor on the incident but that it “wasn’t a compromise of Anthropic’s systems or employee laptops,” and that a malicious actor had used access to Cursor’s marketplace to publish a tampered copy Anthropic did not build or publish, The Register reported. Cursor told OpenSourceMalware the extension in its marketplace “experienced some form of compromise” — which places the incident in Cursor’s distribution path rather than in Anthropic’s release infrastructure, according to Ostorlab’s account.

No CVE has been assigned and the incident was not in CISA’s Known Exploited Vulnerabilities catalogue as of October 30, according to Ostorlab. Anthropic published the clean 2.1.314 build to Open VSX and the Microsoft VS Code Marketplace on October 30, so extensions from those marketplaces update to a clean build normally.

What to do if you updated that day#

The check that matters is the key. On macOS or Linux, run grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted" — the command from Cursor’s notice, which also gives the Windows PowerShell equivalent and remediation scripts for macOS and Windows.

If the key is found, treat the machine as compromised: isolate it, preserve evidence, remove the extension, the persistence mechanisms and any running tunnel processes using Cursor’s scripts, rotate credentials and sessions from a clean system, and assess whether the host should be rebuilt. Uninstalling the extension alone is not enough, because the payload drops standalone persistence scripts that keep running. A missing key does not prove the extension never ran — it proves the key step did not complete — so searching for the other published indicators, including the persistence files, the scheduled task or LaunchAgent, and connections to the attacker’s address (134.209.82[.]225), is part of the check.

Sources: Cursor’s security notice, Ostorlab’s write-up of OpenSourceMalware’s code analysis, and The Register’s report of Anthropic’s response. Images are AI-generated editorial illustrations.