Tampered builds of Anthropic’s Claude Code extension sat in Cursor’s extension marketplace for about 11 hours on Wednesday, October 29, trying to plant a hidden way back into developers’ computers, Cursor says. The company estimates that at most 5,000 users received one of the bad builds.
The affected versions were 2.1.312 and 2.1.313 of the extension, for macOS and Windows. They were available from about 2:27 a.m. to 1:35 p.m. Pacific time on October 29 — 09:27 to 20:35 UTC — and Cursor says they were not developed by Anthropic. Anyone who installed or auto-updated the extension through Cursor in that window should treat their machine as in scope and run the checks below, even if nothing looks wrong: the real extension kept working, so users would not have noticed anything.
What the tampered builds did
Researchers at StepSecurity found a small loader — about 66 lines — placed ahead of the extension’s normal code, so it ran as soon as the editor loaded the extension. The user never had to open a Claude chat.
According to Cursor’s security notice and the researchers’ analyses, the loader first collected details about the machine: the hostname, username, operating system, architecture, home-directory path, working directories, configured Git email address and public IP address, plus the names — not the values — of up to 40 environment variables whose names contained KEY, TOKEN, SECRET, PASS, AWS or GCP. That inventory was sent to an attacker-controlled server.
It then tried to add an attacker-controlled SSH key, labelled “svc-telemetry”, to the user’s authorized_keys file, switch on the local SSH service, and open a reverse SSH tunnel back to the attacker’s server, retrying about every 60 seconds. To survive a reboot it installed persistence: a LaunchAgent named com.apple.sysmond on macOS, and a scheduled task named SysMon with a startup-script fallback on Windows.
What did not happen — and what still needs cleaning
There is one important mitigation. Switching on the SSH service needs administrator rights, and Cursor says errors in the malicious code meant that step failed on most affected machines, unless the editor was running with elevated permissions. Cursor also worked with the hosting provider to take the attacker’s server offline, so the tunnel and the reporting endpoint no longer function.
But that does not mean affected machines are clean. The attacker’s key, the persistence files and the machine details were still written or sent while the server was up, and Cursor warns that uninstalling the extension does not remove them, because the loader drops standalone persistence that keeps running after the extension is gone. Cursor’s own assessment is that the limited collection “does not rule out later credential access over the backdoor”.
Two early reports have since been corrected, and the corrections matter for who should check. The bad builds came from Cursor’s own marketplace — not from Open VSX, Microsoft’s Visual Studio Marketplace or npm, and not from any of Anthropic’s own distribution channels. Anthropic has confirmed its systems were not compromised. A clean build, version 2.1.314, followed the removal.
How to check your machine
Cursor’s notice gives a one-line check for macOS: search your SSH authorized_keys file for the label svc-telemetry. If it prints nothing, the key is not there; if it prints a line, the machine was hit. Cursor’s notice gives the equivalent PowerShell check for Windows, which also looks in the administrators’ authorized_keys file.
Cursor has also published remediation scripts for macOS and Windows that remove the persistence and exit with an error if anything remains. After cleanup, rotate any credentials that were accessible from the affected machine, using a trusted device — not the machine being cleaned. If in doubt, rebuilding the machine is the safest option, and it is the option security researchers recommend for machines where the key is found.
What is still unknown
Cursor removed the affected versions, temporarily shut the whole marketplace, audited other extensions, rotated its keys and rebuilt the service, but how the attacker gained the ability to publish to Cursor’s marketplace has not been made public. Nor is it yet known how many machines actually ran the malicious code, as opposed to merely installing it. Until those answers appear, the 5,000 figure should be read as Cursor’s upper estimate of who received a bad build, not as a count of compromised machines.
Frequently asked questions
I use Cursor but not Claude Code — am I affected? No, on the current evidence: only the tampered Claude Code builds 2.1.312 and 2.1.313 in Cursor’s marketplace are implicated, and Cursor says it found no evidence that other extensions were affected.
Is uninstalling the extension enough? No. Cursor says the persistence files survive uninstalling, so you must also check for the svc-telemetry key and remove the persistence mechanisms, or use Cursor’s remediation scripts.
Was this an Anthropic breach? No. Anthropic says its systems were not compromised and the builds were not developed by Anthropic; the distribution point was Cursor’s marketplace.
Related coverage: PHP2Shell: the critical AI-found PHP flaw developers had to patch fast and Google is shutting down Jules, its AI coding agent, on December 31.
Sources
- Brandefense — Malicious Extensions: Claude Code Playbook (Cursor security notice, Microsoft Threat Intelligence 30 Oct, StepSecurity analysis)
- ThreatDefence — Malicious Claude Code Extension in the Cursor Marketplace advisory (30 Oct, updated 31 Oct)
- Abijita — Malicious Claude Code Versions in Cursor Tried to Plant SSH Backdoors (Reuters / Cursor notice)
- Modeldex — Fake Claude Code Update in Cursor’s Marketplace Tried to Plant a Backdoor
- Circuit Bay — The Claude Code extension backdoor in Cursor: what happened, and the one check to run
