Tampered Claude Code Extension Hit 5,000 Cursor Users
A tampered Claude Code extension reached up to 5,000 Cursor users on October 29, planting an SSH backdoor. Find out if your machine is affected and what to do.
A tampered copy of Anthropic's Claude Code extension sat in Cursor's extension marketplace for about 11 hours on October 29, reaching up to 5,000 users. The malicious build tried to plant a persistent SSH backdoor on developer machines. Cursor pulled it the same day, but simply uninstalling the extension is not enough to clean an affected machine.
What happened
Between about 2:27am and 1:35pm Pacific time on October 29, 2026, a maliciously modified version of Anthropic's Claude Code extension was available in Cursor's VS Code extension marketplace. The affected versions are 2.1.312 and 2.1.313 for Windows and macOS. Cursor says at most 5,000 users received the tampered build. The tampered build was not developed by Anthropic. Anthropic has said a malicious actor used access to Cursor's marketplace to publish it, and that its own systems, employee laptops and official distribution channels were not compromised. The clean version 2.1.314 followed on October 30.
What the tampered build did
The malicious code was a small loader hidden inside the extension's normal code, so it ran as soon as the extension loaded. No Claude conversation was needed. Once running, it collected host and user details including hostname, username, operating system, home directory path, environment variable names, working directories, Git email and public IP address, and sent them to an attacker server. It then tried to add an attacker-controlled SSH key, labeled svc-telemetry, to the machine's authorized keys file, switch on the local SSH service and open a reverse SSH tunnel. It also installed persistence so the tunnel would survive a restart, using a LaunchAgent on macOS and a scheduled task on Windows. There is one piece of good news. Turning on the local SSH service needs administrator rights, which the extension does not have on most macOS and Windows machines, so that step would fail on most affected computers and the attacker could not have logged in through the tunnel. Even so, the key was added, persistence was installed and host details were sent, so Cursor says affected users must follow its cleanup steps regardless.
Who is affected and how to check
You are in scope only if you installed or updated to Claude Code 2.1.312 or 2.1.313 from Cursor's marketplace on macOS or Windows during the October 29 window. Other extensions, other marketplaces and Anthropic's official channels are not affected. The fastest check is to search your SSH authorized keys file for the attacker's key label. On macOS, run: grep svc-telemetry ~/.ssh/authorized_keys. On Windows, check the same file in PowerShell. If the svc-telemetry key is found, the machine is impacted. Cursor has published remediation scripts for macOS and Windows that remove the extension, the persistence mechanisms, the running tunnel processes and the attacker's key. After cleaning up, rotate any credentials that were reachable from the affected machine, such as source control tokens, cloud keys and SSH keys, using a trusted device. If the tunnel is confirmed to have connected, rebuilding the machine is safer than cleaning it.
What Cursor did next
Cursor removed the malicious versions as soon as it detected them and then shut down its whole extension marketplace out of caution. It audited access and found no other extensions were tampered with, rotated its own keys, rebuilt the marketplace and brought it back online. It also worked with the hosting provider to take the attacker's server offline, so the reverse shell and data reporting no longer function. How the tampered build got into the marketplace in the first place is still not explained. That unanswered question is the part developers should watch, because this was not a typosquat or a lookalike package. It carried the extension's real identifier, which is exactly why users trusted it.
Why it matters for developers
Developer tools are a high-value target because they run with broad access to code, credentials and infrastructure. This incident shows that even an official extension from a trusted marketplace can be swapped for a malicious copy, and that auto-updates can deliver it silently. The practical lesson is simple: treat extension updates like any other software supply chain risk. Keep an eye on security notices from your editor vendor, check for unexpected SSH keys after an incident like this, and rotate credentials quickly when a tool you use reports a compromise.
Sources
- Cursor - https://cursor.com/blog/claude-code-extension-security-notice - StepSecurity - https://stepsecurity.io/blog/claude-code-extension-trojanized - Reuters - https://www.nogentech.org/cursor-users-warned-claude-code-malicious-extension/