Cursor says a trojanized copy of Anthropic’s Claude Code extension was served through its extension marketplace for about 11 hours on October 29, planting a persistent SSH backdoor on the machines of up to 5,000 users, according to the company’s security notice. The Claude Code backdoor shipped inside extension versions 2.1.312 and 2.1.313 for macOS and Windows, and Cursor has now shut down, audited and rebuilt its marketplace in response.

A legitimate package with a malicious core

The tampered builds carried the real Anthropic publisher identity and were identical to the official extension in every way except a small loader inserted into extension.js, security researchers found. No click or prompt was required: merely loading the extension in Cursor, including through automatic update, was enough to run the payload. Users who installed or auto-updated between 2:27 a.m. and 1:35 p.m. Pacific time (09:27 to 20:35 UTC) are in scope, and Cursor says it will contact the affected users directly.

StepSecurity’s analysis found the malicious build about 7 KB larger than the previous release, a 66-line loader hiding in front of the legitimate code. A clean version 2.1.314 was published on October 30.

What the backdoor did

Fact card summarizing the trojanized Claude Code extension backdoor: exposure window, users in scope, and payload

According to Cursor’s notice, the payload collected and reported host and user information (hostname, username, operating system, architecture, home directory, environment variable names, working directories, configured Git email and public IP address). It then attempted to add an attacker-controlled SSH key labeled svc-telemetry to the user’s authorized_keys file, enable the local SSH service and open a reverse SSH tunnel to an attacker server. Persistence retried the tunnel roughly every 60 seconds through a LaunchAgent on macOS and a scheduled task plus a Startup-folder script on Windows.

Two facts limit the damage. Enabling the local SSH service requires administrator rights, which the malicious extension does not have on most macOS and Windows hosts, so that step failed and the attacker could not have logged in through the tunnel, the ThreatDefence advisory notes. And Cursor worked with the hosting provider to take the attacker’s server offline, so the reverse shell and the host-detail beacon no longer function. Even so, the key and the persistence were installed, and host details were sent.

Anthropic: not our build, not our channels

Anthropic has said the tampered extension was not its build and that its own systems were not compromised. “A malicious actor used access to Cursor’s marketplace to publish a tampered extension targeting Cursor’s users, we were not involved with building, publishing, or hosting this,” the company said in a statement quoted by security analysts. The tampered build never appeared on Open VSX, the Microsoft Visual Studio Marketplace or any of Anthropic’s own distribution channels, so users of other editors are out of scope.

Early reports placed the malicious build on Open VSX and showed only a macOS version. Cursor’s updated notice corrected both: the tampered builds came from its own marketplace and affected macOS and Windows. The practical lesson, ThreatDefence writes, is to confirm the distribution channel against the vendor’s own statement before narrowing the hunt.

Cursor shut down and rebuilt its marketplace

Cursor removed the malicious version immediately upon detection, then shut down its entire marketplace out of caution, the notice says. The company audited access, confirmed no other extensions were tampered with, rotated its keys, rebuilt the marketplace and brought it back online. The incident was first spotted by security firm Phorion on customer endpoints.

What Cursor users should do now

Fact card with remediation steps for Cursor users: check for the svc-telemetry SSH key, update to 2.1.314, run remediation scripts, and rotate credentials

Cursor’s key instruction: uninstalling the extension is not enough, because the payload drops standalone persistence scripts that keep running after the extension is gone. Users in the exposure window should check their SSH authorized_keys for the svc-telemetry key, run Cursor’s remediation scripts (remediate-macos.sh on macOS, remediate-windows.ps1 from an elevated PowerShell on Windows), and rotate credentials reachable from affected machines, including SSH keys, Git and CI/CD tokens and cloud credentials, from a clean computer. Machines where SSH was already running when the backdoor landed may need a full rebuild.

Why it matters

Developer tools are a high-value attack surface. Editor extensions run with the developer’s full permissions and update themselves in the background, while developer machines hold the keys to source code, cloud accounts and production systems. A single tampered package in one marketplace was enough to reach thousands of developers here, including teams shipping AI-assisted coding workflows at scale. For those teams, the takeaway is practical: pin extension versions where the editor allows it, know which marketplace each of your editors uses and include developer workstations, Macs as well as Windows, in endpoint monitoring, as security analysts are urging after this incident.

Sources