Backdoored Claude Code extension was served on Cursor's marketplace for about 11 hours; here's how to check your machine
Announced · Published · By Contractor AI Shop
Malicious Anthropic.claude-code versions 2.1.312 and 2.1.313 were served on Cursor's extension marketplace from about 2:27 AM to 1:35 PM PT Oct 29, trying to plant an SSH backdoor. Ars and BleepingComputer cite at most 5,000 users. Cursor says uninstalling may not be enough.
Key facts
- Cursor says modified Anthropic.claude-code 2.1.312 and 2.1.313 for Windows and macOS were available in its VS Code Extension Marketplace between about 2:27 AM and 1:35 PM PT on Oct 29; it updated the notice Oct 30 to add 2.1.312. Cursor (security notice)
- Per Cursor, the code collected host details, tried to add an attacker SSH key, enable SSH and open a persistent reverse tunnel. Due to bugs, the SSH step would usually fail unless Cursor ran with admin rights. Cursor (security notice)
- Check your machine: Cursor says the malware adds a key labeled 'svc-telemetry' to your SSH authorized_keys file, and its notice gives a one-line check for macOS and Windows plus remediation scripts. Cursor (security notice)
- Cursor says uninstalling the extension may not be sufficient because the payload drops standalone persistence scripts; it advises isolating affected hosts and rotating credentials from a trusted system. Cursor (security notice)
- Ars Technica and BleepingComputer report the release affected 'at most 5,000 users.' Ars, citing researcher Kevin Beaumont and Phorion's Luke Roberts, says it went out through Anthropic's official Cursor account. Ars Technica (Dan Goodin)
- BleepingComputer reports early claims that npm, Open VSX and Microsoft's VS Code Marketplace were hit were wrong; Cursor was the only source of the malicious extension. BleepingComputer (Bill Toulas)
- Cursor says it pulled the version, shut down and rebuilt the marketplace, rotated keys, and got the attacker's server taken offline. Cursor (security notice)
Our take: what it means for contractors
If anyone in your office uses Cursor with the Claude Code extension, have them run Cursor's check today. It takes seconds. More broadly, AI coding tools auto-update extensions by default, so treat them like any other software that can touch your files and passwords.
What we don't know yet
- How attackers got control of the publisher account; neither Cursor nor Anthropic has explained (Ars, BleepingComputer)
- Exact number of affected machines
- Ars and BleepingComputer name only 2.1.313; Cursor lists 2.1.312 and 2.1.313, and we use Cursor's list and times
Sources
- Cursor (security notice) · Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace · 2026-10-29 · Primary
- Ars Technica (Dan Goodin) · Anthropic VS Code extension on Cursor backdoored for nearly 12 hours · 2026-10-30 · Secondary
- BleepingComputer (Bill Toulas) · Malicious Claude Code extension on Cursor planted SSH backdoors · 2026-10-30 · Secondary