A security notice from Cursor disclosed that on 29 October 2026, a maliciously modified version of the Claude Code extension appeared in Cursor's VS Code extension marketplace. The version was not developed by Anthropic, yet it carried the Anthropic.claude-code name and version number 2.1.313, and it may have affected up to 5,000 users. Cursor has removed the version and rebuilt the marketplace, and said it will contact affected users directly.
What the malicious version did
According to Cursor, the malicious code tried to install a persistent SSH backdoor after the extension started: it collected hostnames, usernames, operating systems, architectures, home directory paths, environment variable names, working directories, Git email addresses and public IP addresses; it wrote an attacker-controlled SSH key into authorized_keys, tried to enable the local SSH service and open a reverse tunnel; and it used a LaunchAgent or a scheduled task to keep the tunnel persistent, retrying roughly every 60 seconds, while reporting host details and backdoor status to an attacker server. Cursor said it worked with the cloud provider hosting the attacker server to take it offline, so the reverse channel and reporting no longer work.
Who should check now
Anyone who installed or updated to version 2.1.313 from the Cursor marketplace between 2:27 a.m. and 1:35 p.m. Pacific Time on 29 October is inside the affected window. The key marker is a key labelled svc-telemetry in the authorized_keys file; finding it means the machine is affected. Cursor warned that uninstalling the extension is not enough: the payload leaves standalone persistence scripts behind, so users must follow the official remediation scripts to remove the key, the persistence mechanisms and the tunnel processes, isolate hosts showing signs of a backdoor, and rotate credentials and sessions accessible from affected hosts from a trusted system. After cleanup, users should upgrade to version 2.1.314.
Why the extension marketplace became the weak point
The danger here lies in the chain of trust: users did not download obscure software from an unknown website. Inside the editor marketplace they use every day, they received an official-looking extension with the right name and version number. An 11-hour window was enough for an automatic update to deliver a backdoor onto developers' machines, which often hold access to code repositories, keys and cloud credentials. Cursor said an audit confirmed no other extensions were tampered with, and that it rotated keys and rebuilt the marketplace. For users, the lesson stands: a marketplace identity is not a security guarantee, and anything abnormal involving SSH keys and persistence permissions must be treated as a security incident, not an ordinary failed update.
