A backdoored Claude Code extension shipped through Cursor's marketplace. Check your machine, then turn on a cooldown

Published October 31, 20265 min read

According to Cursor's security notice, versions 2.1.312 and 2.1.313 of Anthropic.claude-code in the Cursor VS Code Extension Marketplace were modified by someone other than Anthropic. They were live from about 2:27am to 1:35pm Pacific on October 29. Cursor says the affected packages were the macOS and Windows builds. Cursor told reporters at most 5,000 users were affected, per The Hacker News.

Microsoft's analysis found the package was never published to the Visual Studio Marketplace or npm, and says “Anthropic confirmed to Microsoft that their systems were not compromised.” Anthropic then published a clean 2.1.314. Neither Cursor nor anyone else has said how the modified build got into Cursor's marketplace. We haven't analyzed the sample ourselves; everything below comes from Cursor's notice and the researchers' write-ups.

What the payload did

The attacker added a loader to the top of the extension's main JavaScript bundle, ahead of the real code, so the extension still worked normally. When the extension loaded, the loader did five things:

1. Collected host details: hostname, username, OS, CPU architecture, home and working directories, global Git email, and public IP.
2. Listed secret names: the names, not values, of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS, or GCP.
3. Planted an SSH key: appended an Ed25519 public key with the comment svc-telemetry to authorized_keys and tried to turn on the local SSH server.
4. Opened a reverse tunnel: ran ssh -N -R '*:0:localhost:22' to the attacker's server, retrying every 60 seconds, so the attacker could SSH back into your machine.
5. Persisted: installed startup items so the tunnel came back after a reboot, even after the extension was removed.

Cursor says coding errors meant the SSH server step usually failed unless Cursor was running with administrator rights, so the attacker probably couldn't log in on most Macs and Windows PCs. The key, the startup items, and the host report still landed. Cursor also says the attacker's server has been taken offline. Both points lower the risk, but they aren't a reason to skip cleanup.

The secret names matter more than they look. A list such as AWS_SECRET_ACCESS_KEY, OPENAI_API_KEY, and NPM_TOKEN tells an attacker which clouds and registries you can reach. OpenSourceMalware's Paul McCarty made the same point to The Hacker News.

How to check your machine

The quickest test is the key comment. Cursor treats any machine with this key as affected.

# macOS or Linux
grep -n svc-telemetry ~/.ssh/authorized_keys

# Windows (PowerShell)
Select-String -Path "$env:USERPROFILE\.ssh\authorized_keys",
  "C:\ProgramData\ssh\administrators_authorized_keys" -Pattern svc-telemetry

The key alone isn't the whole infection. These are the persistence artifacts Microsoft lists:

The Linux path exists in the code, but Cursor only names macOS and Windows packages as affected. A Linux Cursor user should still run the grep. Also look for hidden .stk_ files in your temp directory, which hold the tunnel's private key, and any network history to 134.209.82.225. The names SysMon and com.apple.sysmond were picked to look like system components, so check what an item runs before deleting it.

If you find it

• Disconnect the machine from your VPN and anything sensitive before you start.
• Run Cursor's scripts. The notice links remediate-macos.sh (run as your user, not root) and remediate-windows.ps1 (run from an admin PowerShell). Read them first. They exit non-zero if anything is left.
• Rotate from a different machine. Every credential reachable from the infected host should be considered exposed, starting with the ones whose names were in your environment: cloud keys, registry tokens, model API keys, and Git credentials.
• Consider a rebuild. Cursor and Microsoft both say removing the extension doesn't remove files written outside it. If you can't account for everything the tunnel could have done, reinstalling is the honest answer.

A missing key isn't an all-clear on its own. If any artifact from the table turns up, or you know 2.1.312 or 2.1.313 was installed, go through the steps above anyway. If a check fails with a permissions error, that's not a clean result either. Whatever you find, update the extension to 2.1.314 or later. Cursor says it will contact affected users directly.

The setting that would have stopped it

The malicious build was live for about 11 hours. Cursor already ships a control that waits a set time before installing a newly published version, and its extension docs describe it:

• Individuals: set "extensions.installCooldownHours": 24 in your Cursor settings. It covers installs and updates.
• Team admins: set Marketplace Install Cooldown (hours) under Team settings, Security & automation. Any value above 0 applies to the whole team and overrides personal settings.
• Allowed extensions: limit installs to approved publishers or extension IDs from the team dashboard, or with the AllowedExtensions MDM key.
• Signature checks: enterprise teams can require valid Open VSX signatures before install.

A 24-hour cooldown would have skipped this build completely, because Cursor pulled it before it was a day old. An allowlist alone wouldn't have, since the bad build carried the real Anthropic publisher ID. The cooldown default is 0, which is off. The cost is waiting a day for legitimate fixes, which is the same trade pnpm's minimumReleaseAge makes for packages.

Why this keeps happening

This is the third security incident around AI developer tools we've covered in ten days. The OpenCode Console breach leaked some users' provider keys. The LiteLLM compromise shipped a credential stealer in a package release. Yesterday's EMBRACE report showed the editors' built-in browsers could read your files.

Editor extensions are an easy target because they auto-update silently and run with your full user account. The same extension can also reach you through more than one marketplace. Here the clean build was on Open VSX and Microsoft's marketplace while Cursor's own copy was tampered with, so each channel is a separate place for a bad build to slip in. Until Cursor explains how this happened, treat any extension update as untrusted for its first day.

What we don't know yet

Nobody has said how the modified package was uploaded, whether through a stolen credential, a marketplace bug, or something else. Cursor's notice doesn't give an exact count of machines that ran the payload, and no CVE has been assigned. We'll update this page if Cursor publishes a root cause.

Sources

• Cursor: Security notice for Anthropic.claude-code 2.1.312 and 2.1.313 (October 29, updated October 30, 2026): affected versions, window, IOCs, and remediation scripts.
• Microsoft Security: Inside a malicious Claude Code-branded extension (October 30, 2026): payload behavior, persistence artifacts, and Anthropic's confirmation.
• The Hacker News (October 30, 2026): the 5,000-user figure and researcher comments.
• Cursor docs: Extensions: install cooldown, allowed extensions, and signature verification.