Cursor has warned developers that a tampered version of Anthropic’s Claude Code extension was distributed through its extension marketplace on 29 October, reaching at most 5,000 users before it was removed. The company says the malicious build tried to plant a persistent SSH backdoor on affected machines, collecting host details and adding an attacker-controlled key, even though a flaw in the code meant the remote-login step would fail on most computers. Cursor has shut down, rebuilt and reopened its marketplace, and says no other extensions were tampered with.
What happened
The malicious build was available for about eleven hours, from around 2:27 a.m. to 1:35 p.m. Pacific Time on 29 October. Cursor’s updated notice identifies the affected versions as Anthropic.claude-code 2.1.312 and 2.1.313 for Windows and macOS in its own marketplace. The company stresses neither version was developed by Anthropic, even though the package carried the extension’s legitimate identity.
That identity is what made the incident dangerous. Developers with automatic updates switched on could have received the tampered build without choosing to install anything new, since extensions often update by default. Cursor says it removed the malicious version on detection, blocked further distribution, and then shut down the whole marketplace as a precaution while it investigated.
Cursor says it audited access and found no other tampered extensions, rotated its keys, rebuilt the marketplace and brought it back online. It also worked with the cloud provider hosting the attacker’s server to take that server offline, so the reverse connection and host-detail reports no longer function. The company says it will contact affected users directly.
What the code tried to do
Researchers who examined the package found a short loader inserted before the legitimate extension code, which ran as soon as the extension loaded, without any need to start a conversation with Claude. Once running, it collected host and user details including hostname, username, operating system, architecture, home directory, working directories, Git email, public IP address and environment variable names.
The payload then tried to add an attacker-controlled SSH key, labelled svc-telemetry, to the machine’s authorized keys file, switch on the local SSH service and open a reverse tunnel back to the attacker. It also tried to make that tunnel persistent, through a LaunchAgent on macOS and a scheduled task on Windows, with background scripts retrying roughly every sixty seconds.
Cursor’s notice is explicit that this step would fail on most machines, because turning on the local SSH service needs administrator rights the extension does not normally have. Even so, the extension still added the attacker’s key, installed persistence and sent host details to the attacker. That is a confirmed compromise, unlike the Qwen upload case.
How to check and clean up
Anyone who installed or updated Claude Code from Cursor’s marketplace in the window should check their machine for the svc-telemetry key in their SSH authorized keys file. Cursor has published validation and remediation scripts for macOS and Windows that remove the extension, the planted key, persistence mechanisms and running tunnel processes, exiting with an error if anything remains.
Cursor advises isolating hosts showing evidence of payload execution, and rotating credentials and sessions reachable from affected hosts from a trusted system. Simply uninstalling the extension is not enough, because the payload drops standalone persistence scripts that keep running after the extension itself is gone. Anthropic has published version 2.1.314, and Cursor asks all customers to update to it.
What remains unknown
How the tampered package reached Cursor’s marketplace is still unexplained. Cursor has not said how a package carrying Anthropic’s legitimate extension identity was published to its store, and researchers have said they do not know whether stolen credentials or another route were involved. That gap matters, because it decides whether this was a one-off lapse or a repeatable weakness.
Cursor says it has no evidence that other versions or the official distribution are affected, and users who installed Claude Code through Open VSX or Microsoft marketplaces are not known to be affected. The number of users who ended up with the key on disk has not been disclosed, and Anthropic has not explained the incident in its own words.
Why It Matters
The incident matters because it strikes at the trust developers place in extension marketplaces. A coding extension runs with broad access to files, source code and developer tools, so a compromised update is a direct route into the machines that build software. Eleven hours still reached up to 5,000 users.
It also arrives in a week when Claude’s security was already under scrutiny, after a personal Claude agent was reported running for two months on a Pentagon network. The incidents differ in kind, one a supply-chain compromise and the other misuse of a legitimate tool, but together they pressure Anthropic and its partners to show their safeguards hold up.
Background
Cursor, the AI coding editor, distributes third-party extensions through its own VS Code marketplace, separate from Microsoft’s official store, and that marketplace is now back online after its shutdown, audit and rebuild.
Source: Cursor security notice, Hacker News report
0 Comments