Tampered Claude Code extension in Cursor's marketplace planted SSH backdoor

On Thursday, 29 October, Cursor's extension marketplace distributed a malicious build of Anthropic's Claude Code extension, version 2.1.313, for about 11 hours. The code tried to install a persistent SSH backdoor on developers' machines and to report details about each host to a server run by the attacker. Ars Technica reports that Cursor said "at most 5,000 users" were affected.

It matters because of where the code ran. Cursor extensions run with the same permissions as the editor. That gives them access to local files, source code and developer tooling. An AI coding assistant is normally trusted with exactly those things, so a tampered update reaches the parts of a machine that are worth the most.

What happened

According to Cursor's security notice, the malicious version was available from about 2:27am to 1:35pm Pacific time on 29 October. Cursor says it removed the version as soon as it found it and blocked further distribution. It then shut down its whole extension marketplace "out of an abundance of caution", audited access, confirmed that no other extensions had been tampered with, rotated its keys, rebuilt the marketplace and brought it back online. Cursor also worked with the hosting provider to take the attacker's server offline.

Independent researcher Kevin Beaumont and Luke Roberts, CTO and co-founder of security firm Phorion, told Ars Technica the build was distributed through Anthropic's official account on Cursor. "The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312," Roberts said. "Extensions auto-update in Cursor by default, but users can configure this in settings." That means many users would have received the tampered version without doing anything.

Cursor says the malicious versions "were not developed by Anthropic". It also says it has no evidence that other versions or the official distribution were affected. StepSecurity's analysis says Anthropic stated it did not build or publish 2.1.313. StepSecurity also says that version never appeared on Open VSX or the Microsoft marketplace, and that Anthropic skipped to 2.1.314. Neither Cursor nor Anthropic has explained how the attackers got the ability to publish under Anthropic's name in Cursor's marketplace. Ars reports that neither company answered its questions, and that Anthropic had not publicly warned customers when the story ran.

What the code did

StepSecurity reports that the rest of the extension matched the official release. The malicious part was a loader in the extension's main JavaScript file. It ran when the extension module loaded. It did not need a Claude conversation or any action from the user.

Cursor and StepSecurity describe the same steps:

• Collect host and user information and send it to the attacker over plain HTTP. This included hostname, username, operating system, home directory, working directories, Git email, public IP and environment variable names.
• Add an attacker-controlled SSH key, labelled `svc-telemetry`, to the user's `authorized_keys` file.
• Try to turn on the local SSH service and open a reverse SSH tunnel to attacker infrastructure, retrying about every 60 seconds.
• Persist through a LaunchAgent on macOS, a SYSTEM scheduled task with a Startup-folder fallback on Windows, and, according to StepSecurity, cron entries on Linux.

StepSecurity says the beacon collected the names of environment variables that contained terms such as KEY, TOKEN, SECRET, PASS, AWS or GCP. Phorion told Ars this let the operator quickly take inventory of cloud credentials and API tokens on each machine, likely to decide which ones to target next.

The backdoor did not always work. Cursor says turning on the SSH service needs admin rights, which the extension lacks on most macOS and Windows machines. On those machines, the attacker could not log in through the tunnel. The exception is the unusual case where Cursor was started as administrator. Phorion told Ars that bugs in the Windows and macOS code also stopped it in some cases, but that "the malware is still a significant threat that installs persistence and beacons host reconnaissance back to the operator." Cursor makes the same point: the key was still added, persistence was still installed and host details were still sent.

What affected users are told to do

Cursor's notice, updated on 30 October with revised indicators and a clarification of affected versions, recommends these steps:

• Check `authorized_keys` for the `svc-telemetry` key.
• Search telemetry for the published indicators of compromise and isolate hosts that show signs of the payload.
• Remove the key, the persistence mechanisms and any tunnel processes.
• From a trusted machine, rotate the credentials and sessions that were reachable from affected hosts.

Cursor has published remediation scripts for macOS and Windows. Both Cursor and StepSecurity warn that uninstalling the extension is not enough, because the loader leaves standalone scripts that keep running after the extension is removed. They recommend rebuilding the host where an attacker may have had access.

What it means for work

AI coding assistants are useful because they can read a whole codebase, run commands and work alongside a developer's credentials. The same access makes them a high-value channel for attackers. This incident shows what happens when the distribution path is compromised rather than the tool itself: users who trusted the publisher name and accepted automatic updates did nothing wrong and still received malicious code. Security teams now have to treat extension marketplaces, publisher accounts and auto-update settings as part of their software supply chain, not as background convenience. Developers can reduce the damage by keeping long-lived secrets out of environment variables and by running the editor without admin rights. The main question is still open: how a malicious build came to appear under Anthropic's name on Cursor. Until that is explained, nobody can say which controls would have stopped it.