Tampered Claude Code extension in Cursor marketplace exposed up to 5,000 users to SSH backdoor

Tampered versions of Anthropic's Claude Code extension were available in Cursor's extension marketplace for about 11 hours on October 29, 2026, and Cursor said at most 5,000 of its users received them, according to StepSecurity and Cursor's security notice summarized in reports on the incident.

The affected versions were 2.1.312 and 2.1.313 of anthropic.claude-code, for macOS and Windows, available from about 09:27 to 20:35 UTC on October 29, or 2:27 a.m. to 1:35 p.m. Pacific time.

What the tampered build did

StepSecurity reported that version 2.1.313 carried a malicious loader embedded in its extension.js bundle. On load, the extension planted an attacker SSH key, installed per-operating-system persistence, opened a reverse SSH tunnel to attacker infrastructure, and sent host reconnaissance over plain HTTP.

Reports summarizing Cursor's notice said the code collected host and user information, including hostnames, usernames, operating systems, architecture details, home-directory paths, environment-variable names, working directories, configured Git email addresses, and public IP addresses, and attempted to add an attacker-controlled SSH key labeled svc-telemetry.

Cursor warned that uninstalling the extension may not remove the persistence, and published remediation scripts for macOS and Windows.

Anthropic was not compromised, according to Anthropic

Anthropic clarified that this was not a compromise of its systems or employee laptops, StepSecurity reported on October 30. A malicious actor used access to Cursor's marketplace to publish a tampered copy that Anthropic did not build or publish, and Anthropic's official channels were not affected.

Anthropic also confirmed that version 2.1.313 was never published to Open VSX, the Microsoft Visual Studio Marketplace, or any of its official hosts, and that it skipped to version 2.1.314 to avoid confusion. Early reports that the build came from Open VSX were corrected after Cursor confirmed the compromise was in Cursor's own marketplace.

What happens next

Cursor said it removed the affected versions, temporarily took its marketplace offline, audited other extensions, rotated its keys, and rebuilt the service. Users who installed or updated to version 2.1.312 or 2.1.313 from Cursor's marketplace during the exposure window should follow Cursor's cleanup instructions, check for the svc-telemetry SSH key, remove persistence mechanisms, and rotate credentials accessible from the affected machine, according to reports on the incident. The fixed version is 2.1.314 or later.