.jpg){kind=link}
A tampered copy of the Claude Code extension sat in Cursor’s extension marketplace for about 11 hours on Wednesday, October 29. Anyone who installed it got code that tried to open a hidden SSH backdoor on their computer. Cursor says at most 5,000 users were affected and that it will contact them directly.
The package carried Anthropic’s name and the version number 2.1.313. But Cursor says it “was not developed by Anthropic,” and nothing published so far shows a breach of Anthropic’s own systems or releases. The risk sits with developers who installed or updated the extension inside Cursor that day. It also sits with their employers, whose code and cloud keys live on those laptops.
What Cursor says happened on October 29
Cursor is the AI coding editor that SpaceX finished acquiring on August 14. It runs its own marketplace for Visual Studio Code extensions.
Its security notice, posted the same day, names the package as Anthropic.claude-code 2.1.313. It was available from about 2:27 a.m. to 1:35 p.m. Pacific time.
Cursor said it removed the package and blocked further downloads. It also took the whole marketplace offline, rotated keys, rebuilt the marketplace and brought it back.
The company worked with the hosting provider to take the attacker’s server down. Its audit found no other tampered extensions. It says it has “no evidence” that other versions or the official distribution are affected.
Nobody has said publicly how the package got into the marketplace. Cursor told the research group OpenSourceMalware that the compromise started in Cursor’s own marketplace, “not Open-VSX.”
Open VSX is the community registry that many VS Code-style editors draw from. A HOL Guard incident page notes a different account from the supply-chain firm StepSecurity. It says the version went to Open VSX first and Cursor copied it. Either way, the Cursor copy is the only one known to have reached users.
The code ran as soon as the editor started
According to OpenSourceMalware’s analysis, the attacker added a 66-line loader to the top of the extension’s main file. It ran when the editor started and when the extension’s panel opened. A user didn’t have to talk to Claude for it to fire.
The loader first gathered details about the machine. Cursor lists the hostname, username, operating system and home directory. It also took working directories, the Git email address, the public IP address and the names of environment variables. All of it went to an attacker server on port 8099.
Next it tried to give the attacker a way back in. It added an SSH key labeled svc-telemetry to the user’s authorized_keys file. Then it tried to switch on the computer’s SSH service and open a reverse tunnel to the attacker. Background scripts retried that link about every 60 seconds.
To survive a reboot, it set up a LaunchAgent on macOS and a scheduled task or Startup script on Windows. OpenSourceMalware says it also tried a crontab entry on Linux.
Admin rights blunted the backdoor, but cleanup still matters
The most dangerous step had a limit. “Turning on the local SSH service requires admin rights,” Cursor wrote. The malicious extension “does not have” those rights “on most macOS and Windows hosts.” Without a running SSH service, nobody can log in with the planted key.
That doesn’t make an infected machine clean. The planted key, the data it sent and the persistence scripts could all still be there. And on a machine where SSH was already on, the admin barrier would not apply.
Cursor is blunt about cleanup. “Uninstalling the extension may not be sufficient,” its notice says, because “the payload drops standalone persistence scripts that keep running.”
The environment variable list matters too. Cursor and the researchers both describe the code taking names, not values. Even so, names can show which cloud services and AI tools a developer uses. That is a map of where to go next once a backdoor works.
Anthropic’s official builds look clean
OpenSourceMalware says three official versions are not malicious. They are the Claude Code package on npm, the Open VSX extension and Microsoft’s VS Code Marketplace version. It adds that its findings alone don’t show any compromise of Anthropic’s release systems.
We checked the Open VSX listing on Friday. Version 2.1.314 is now the latest, posted at 01:07 UTC on October 30 by a verified publisher. Version 2.1.313 returns “not found.” Cursor’s notice does not mention 2.1.314, so updating is a step alongside cleanup, not a replacement for it.
We found no public statement from Anthropic on the incident as of Friday. The episode is separate from the startup Cathedral’s recent claim that its AI agents got into Anthropic’s internal systems during an authorized test.
How to check a machine that ran Cursor on October 29
Cursor’s advice applies to anyone who installed or updated Claude Code from its marketplace during that 11-hour window. Its notice includes commands and cleanup scripts for macOS and Windows. These are the main steps.
- Look for a key ending in
svc-telemetryin~/.ssh/authorized_keysfor every user account. - Isolate the machine first, and keep logs if your company has a security team.
- Remove the key, the LaunchAgent or scheduled task, and any tunnel process with Cursor’s scripts.
- Consider a full rebuild, which OpenSourceMalware calls safer than deleting known files.
- From a clean device, rotate the passwords, API keys, SSH keys and cloud sessions the machine could reach.
OpenSourceMalware also lists the attacker’s server, 134.209.82.225. Network teams can search firewall logs for traffic to it on ports 22 and 8099.
Why AI coding extensions make tempting targets
Extensions like Claude Code run inside the editor with the developer’s own permissions. They can read project files, run terminal commands and see how a laptop connects to company systems. That access is what makes them useful, and it is exactly what an attacker wants.
This attack didn’t need a fake brand or a lookalike name. It used the real publisher name and a believable next version number, in the store where users expect safe updates. Cursor’s notice covers anyone who “installed or updated” to 2.1.313, so a routine update was enough.
That puts the burden on marketplace operators, not users.
Cursor has explained what the code did and how to clean up. It hasn’t explained how a package under Anthropic’s name got published without Anthropic. With AI tools now speeding up attackers too, companies that run Cursor will want that answer. Cursor says it is contacting affected users directly and takes questions at security@cursor.com.
Disclosure: BreezyScroll uses Anthropic’s Claude to help draft articles.