Fake Claude Code extension on Cursor planted SSH backdoors

A tampered build sat in Cursor's marketplace for about 11 hours. Anthropic did not make it.

Cursor has confirmed that a tampered version of the Claude Code extension was available in its marketplace on October 29, 2026 for about eleven hours. Cursor says Anthropic did not build it. The code tried to open a backdoor on developer computers, and Cursor has published checks for anyone who installed it.

Key facts

A modified Claude Code extension was available in the Cursor extension marketplace on October 29, 2026, from about 09:27 to 20:35 UTC.
Cursor’s notice lists versions 2.1.312 and 2.1.313 for macOS and Windows. Cursor says Anthropic did not develop the malicious extension.
The code collected host details, tried to add an attacker SSH key labeled “svc-telemetry” and tried to set up persistence.
Cursor removed it, rebuilt its marketplace and rotated its keys. Press reports said up to 5,000 developers could have been exposed.

What happened

Cursor, the AI code editor, published a security notice saying a malicious build of the Claude Code extension had been distributed through its own extension marketplace. According to the notice, it was online for roughly eleven hours on October 29, 2026. Cursor updated the notice on October 30 with new indicators of compromise and clarified which versions were affected.

BleepingComputer reports that researchers found a malicious JavaScript loader added to the start of the extension’s main file, while the rest of the legitimate code was left unchanged. The loader ran when the extension started, with no action from the user.

Cursor describes what the code tried to do. It collected the hostname, username, operating system, home directory, names of environment variables, Git email and public IP address and sent them to an attacker server. It tried to add an attacker controlled SSH key to the user’s authorized keys file, to switch on the local SSH service and to open a reverse tunnel. It also tried to stay on the machine, using a LaunchAgent on macOS or a scheduled task on Windows.

There is some good news. Cursor says the reverse tunnel step would generally fail without administrator rights, which most computers do not give by default. BleepingComputer adds that coding errors probably blocked remote access on many systems. Even so, the key, the persistence scripts and the data upload could still have worked.

Early reports claimed other marketplaces were also affected. BleepingComputer says Cursor later said it was the only source distributing the malicious version. How the attackers managed to publish under Anthropic’s name has not been explained in the coverage reviewed.

Why it matters

Many people now install AI coding helpers as editor extensions, and those extensions run with the same access as the developer who installs them. When a trusted name is copied or tampered with, the usual signal of trust, the name of the publisher, stops being enough.

For everyday users the lesson is practical rather than alarming. Most people never installed this build, and Cursor says the more dangerous remote access step usually failed. But the case shows why it is worth keeping tools updated only from official sources, reading security notices from the vendor, and treating any unexpected extension update with some caution.

It also shows a difference between two kinds of statements. Cursor’s notice describes what its own investigation found. The figure of up to 5,000 exposed developers comes from press coverage, and the full cause is still unknown. Independent researchers may add detail in the coming days.

How to try it

You do not need to be a security expert to act on a notice like this one, but security notices are dense. The Try it prompt, Explain simply, turns technical text into plain language you can act on.

1. Open the prompt and paste it into ChatGPT, Claude or Gemini. 2. Where it asks for the text, paste the “Recommended actions” part of Cursor’s notice. 3. Where it asks for your level, write something like “I use Cursor at work but I am not a security person”. 4. Ask for three things: a plain summary, a short checklist of what to look at on your own machine, and one question to send to your IT team.

For example, paste the paragraph about the “svc-telemetry” key and ask what an authorized keys file is and how you would check it. Compare the answer with the original notice. If the assistant gives a command that is not in the text, run nothing until you have checked it against the vendor’s own instructions.

Try it

Rewrite text more clearly