A hacked Claude Code extension in Cursor tried to backdoor up to 5,000 developers’ computers

A tampered copy of Anthropic’s Claude Code extension sat in Cursor’s extension marketplace for about 11 hours on Thursday, and anyone who installed or updated to it may have opened a door into their computer. Cursor said in a security notice that the malicious version, Anthropic.claude-code 2.1.313, was available from about 2:27am to 1:35pm Pacific time on October 29 (09:27 to 20:35 UTC) and reached at most 5,000 users, whom it will contact directly.

Anthropic didn’t build the malicious version, Cursor said, and only the copy in Cursor’s own marketplace was affected. A technical analysis by OpenSourceMalware, which Dean Hardcastle alerted as the attack unfolded, says the @anthropic-ai/claude-code npm package, the Open VSX extension and the Microsoft VS Code Marketplace extension are all clean.

What the fake extension did

The malicious build looked and worked like the real thing. Its bundled Claude Code program was the official one; the only change, OpenSourceMalware found, was a 66-line loader added to the top of the extension’s main extension.js file. It ran as soon as the editor loaded the extension, so users didn’t need to start a Claude conversation, and it hid its errors so Claude Code carried on as normal.

Once running, it:

• Collected details about the machine: hostname, username, operating system, home and working folders, the Git email address, public IP address, and the names (not the values) of up to 40 environment variables containing words such as KEY, TOKEN, SECRET or AWS.
• Added an attacker’s SSH key to ~/.ssh/authorized_keys, labelled svc-telemetry to pass for an admin account.
• Tried to switch on the computer’s SSH server (Remote Login on a Mac, OpenSSH Server on Windows) and open a reverse SSH tunnel to a server at 134.209.82.225, retrying every 60 seconds.
• Set itself up to survive a restart with a fake com.apple.sysmond LaunchAgent on macOS, a scheduled task called SysMon or a Startup-folder script on Windows and, according to OpenSourceMalware, a crontab entry on Linux.
• Reported back to the attacker’s server over plain HTTP on port 8099.

It downloaded no further malware, OpenSourceMalware found. The danger was the tunnel, which would let whoever controlled the server log in and hunt for credentials.

Cursor says most logins would have failed

Cursor’s notice is more reassuring on that point. Switching on the SSH server needs administrator rights, which the extension doesn’t have on most Macs and Windows PCs, so on those machines “the attacker could not have logged in through the tunnel”, it said. The key, the persistence scripts and the report to the attacker would still have gone through. Cursor also had the attacker’s server taken offline by its cloud provider, so the tunnel and the beacon no longer work.

Cursor said it pulled the version on detection, shut its whole marketplace as a precaution, found no other extensions tampered with, then rotated its keys and rebuilt the marketplace. It hasn’t said how the malicious build got into its marketplace. It told users on X:

We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the http://cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products.

In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk.

If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314: https://cursor.com/blog/claude-code-extension-security-notice

— Cursor (@cursor_ai) October 30, 2026

Cursor, which SpaceX bought in August, is asking everyone to update to Claude Code for VS Code 2.1.314. Anthropic hasn’t commented.

How to check if you were hit

Only people who installed or updated the extension from Cursor’s marketplace in that window are at risk. The giveaway is the attacker’s key in your SSH authorised keys file. On a Mac or Linux machine, Cursor’s check is this one line in Terminal:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

On Windows, the notice has a PowerShell version that also looks in C:\ProgramData\ssh\administrators_authorized_keys. If the key turns up, the machine was affected.

How to clean up

Removing or updating the extension isn’t enough, Cursor warned, because the malware leaves standalone scripts behind that keep running. Its advice for affected machines:

• Isolate the machine, then run Cursor’s remediation script for macOS (as your normal user, not root) or Windows (in PowerShell opened as administrator). It removes the extension, the key, the persistence and any tunnel.
• To look by hand, check for ~/.config/.smt, ~/.config/.smtk and ~/Library/LaunchAgents/com.apple.sysmond.plist on a Mac, or the SysMon scheduled task and a sysmon.cmd file in the Startup folder on Windows. OpenSourceMalware adds an @reboot line in crontab -l on Linux.
• From a different, trusted computer, change the passwords, API keys, tokens and sessions the machine could reach, and consider rebuilding it.
• Update to Claude Code for VS Code 2.1.314.

Why it matters

Coding assistants run with their developer’s access, which makes their extensions a prize: this comes less than a fortnight after LiteLLM’s PyPI package was poisoned to steal AI API keys. A trusted name in a marketplace is no guarantee, so it pays to know what a Claude Code add-on can reach before installing one.

Sources: Cursor security notice, OpenSourceMalware, Cursor on X.