Cursor has removed maliciously modified Claude Code extension builds from its VS Code Extension Marketplace after the packages attempted to install a persistent SSH backdoor on developer machines.
A marketplace incident, not an Anthropic system breach
In a security notice published October 29 and updated October 30, Cursor said Anthropic.claude-code versions 2.1.312 and 2.1.313 for macOS and Windows were available in its marketplace from about 2:27 a.m. to 1:35 p.m. PT on October 29, 2026. Cursor said those versions were not developed by Anthropic.
Microsoft Threat Intelligence said the malicious packages found in Cursor’s marketplace were never published or distributed from the Microsoft Visual Studio Marketplace or from the npm package @anthropic-ai/claude-code. Microsoft also said Anthropic confirmed to it that Anthropic’s systems were not compromised and that Anthropic did not develop the malicious package posted in Cursor’s marketplace.
That narrows the confirmed distribution path to Cursor’s marketplace. Early technical write-ups explored whether Open VSX or other registries were involved, but later updates from researchers and Microsoft’s analysis pointed back to Cursor’s marketplace as the affected channel.
Cursor said it removed the malicious version, blocked further distribution, temporarily shut down the marketplace, audited access, rotated keys, rebuilt the marketplace, and worked with the hosting provider to take the attacker’s server offline.
What the backdoor attempted
Cursor, Microsoft, Phorion, OpenSourceMalware, and other researchers describe a tampered extension bundle that looked largely like the real Claude Code extension except for injected JavaScript placed at the start of extension.js.
Phorion said the injected code ran as soon as Node loaded the file, before the extension’s normal activation callback. StepSecurity similarly reported that no Claude conversation was needed and no package-manager lifecycle hook was involved. Loading the extension module was enough for the malicious code path to run.
The payload attempted to collect host and user information, including hostname, username, operating system, architecture, home directory, working directory, configured Git email, public IP address, and environment variable names. It also attempted to append an attacker-controlled SSH key to authorized_keys, enable the local SSH service, open a reverse SSH tunnel, and establish persistence.
Cursor said the reverse tunnel attempted to connect to 134[.]209[.]82[.]225, with background scripts retrying the tunnel about every 60 seconds. The persistence mechanisms included a macOS LaunchAgent and a Windows scheduled task with a Startup-script fallback. Cursor’s indicators also list Linux persistence artifacts, although the known affected packages in its notice are macOS and Windows builds.
The incident was serious even where full remote access failed. Cursor said enabling the local SSH service requires administrator rights, which the malicious extension did not have on most macOS and Windows hosts. Cursor also said errors in the malicious code would cause that step to fail outside unusual circumstances where Cursor was started with administrator privileges. Even then, the extension could still add the attacker’s SSH key, install persistence, and send host details.
Who needs to check
The highest-risk group is macOS or Windows users who installed or updated the affected builds from Cursor’s marketplace during the October 29 exposure window.
Sophos X-Ops said Cursor identified impacted macOS and Windows packages and estimated that as many as 5,000 users were affected. StepSecurity cautioned that having one of the affected version numbers installed does not, by itself, prove compromise. Source, timing, and host indicators matter.
Expel added one useful caution from its own incident response work. It investigated four customer incidents tied to the extension, all involving Macs, and said one showed first malicious activity about eight hours after Cursor’s stated exposure window closed. That is a small incident set, but it supports checking endpoint indicators rather than relying only on marketplace timestamps.
Indicators and response
Cursor published validation commands, remediation scripts, file hashes, network indicators, and persistence artifacts.
- SSH marker: an unauthorized key in
authorized_keyswith the commentsvc-telemetry. - Network endpoint: connections or attempted connections to
134[.]209[.]82[.]225, including SSH on TCP 22 and HTTP beaconing on port 8099. - Modified extension code:
extension.jscontaining134[.]209[.]82[.]225andsvc-telemetry. - Malicious JavaScript hash: SHA-256
ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15, which Cursor lists for the modifiedextension.js. - Persistence artifacts: on macOS,
~/Library/LaunchAgents/com.apple.sysmond.plistand related~/.config/.smtfiles; on Windows, a scheduled task namedSysMon,smt.cmd, and a Startup folder fallback.
Cursor warned that uninstalling the extension may not be enough because the payload drops standalone persistence scripts that can keep running. Its recommended response includes validating impact, searching endpoint and network telemetry, isolating hosts that show evidence of payload execution or backdoor installation, removing the unauthorized SSH key and persistence mechanisms, and rotating credentials and sessions accessible from affected hosts from a trusted system.
Microsoft gave similar guidance for organizations, recommending that teams identify systems that installed or automatically updated the affected versions from Cursor’s marketplace, preserve evidence, and rotate credentials or revoke sessions when investigation indicates exposure.
Why AI coding security extends beyond the model
This was a developer-tool supply-chain attack, not a Claude model failure. The malicious code was delivered through a trusted editor extension channel, which sits close to source code, local credentials, repository access, and deployment tooling. Model-side controls cannot inspect malicious code that runs before or outside the model interaction.
For teams approving AI coding tools, extension inventory, update provenance, endpoint monitoring, and credential rotation planning now sit closer to AI governance than they did when AI assistants were treated mainly as web apps or chat interfaces. A trusted extension update can become the attack path even when the model provider’s official package and core systems are not affected.
What remains unknown
Cursor has not publicly explained how the attacker obtained the ability to place malicious builds in its marketplace, and no actor has been publicly named in the sources reviewed. Cursor said it audited access and found no evidence that other extension versions or the official distribution were affected.
Affected systems should be treated as developer-machine security incidents, not just failed extension installs.
I can suggest related Tech Help Canada articles based on the topic you’re reading now.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
