Cursor said on October 29, 2026 that malicious builds of the Anthropic.claude-code extension, versions 2.1.312 and 2.1.313 for Windows and macOS, were available in its VS Code Extension Marketplace for roughly eleven hours. The company said those builds were not developed by Anthropic. The packages attempted to plant a persistent SSH backdoor, collect host details, and beacon to an attacker-controlled server. Cursor removed the builds, temporarily shut down the marketplace, rotated keys, and worked with the hosting provider to take the attacker server offline.

Key Facts

Details
Product Anthropic.claude-code in Cursor's Extension Marketplace
Malicious versions 2.1.312 and 2.1.313 (Windows and macOS packages, per Cursor)
Exposure window About 2:27 a.m. to 1:35 p.m. PT on October 29, 2026 (~11 hours)
Behavior Host reconnaissance, attacker SSH key (svc-telemetry), reverse SSH tunnel attempts, persistence scripts
Reach of remote login Cursor says enabling local SSH needs admin rights; on most macOS/Windows hosts that step failed, though keys, persistence, and host-detail POSTs still ran
User count Cursor's live security notice does not state a figure; The Verge, Ars Technica, and other outlets reported Cursor's estimate of around / at most 5,000 users
Official VS Marketplace / npm Microsoft Threat Intelligence says Visual Studio Marketplace and npm @antropic-ai/claude-code were not affected
Anthropic systems Anthropic told Microsoft its systems were not compromised and it did not develop the malicious package

Background

Cursor's notice describes a supply-chain incident limited to its marketplace listing for Claude Code. The injected code collected hostname, username, OS, architecture, home directory, environment-variable names, working directories, configured Git email, and public IP, then tried to append an attacker Ed25519 key labeled svc-telemetry, enable local SSH, open a reverse tunnel to 134.209.82.225, and keep that tunnel alive with LaunchAgents, scheduled tasks, or Startup-folder scripts.

Microsoft's security team independently analyzed the injected JavaScript and published matching indicators. It stressed that a running tunnel attempt does not prove successful remote access, and that uninstalling the extension alone does not remove artifacts written outside the extension directory. Cursor published platform check commands and remediation scripts and warned that persistence can survive an uninstall.

How the attacker published under the Anthropic.claude-code listing is still unexplained in Cursor's notice. Ars Technica reported that researchers said the malicious 2.1.313 build appeared on Anthropic's official Cursor publisher account; neither Cursor nor Anthropic has publicly detailed the access path.

Reactions and Impact

Microsoft confirmed the malicious packages were never published on Visual Studio Marketplace or the official npm Claude Code package, and that Anthropic said its own systems were not compromised. Independent write-ups from Sophos, OX Security, and IT之家 repeated Cursor's roughly eleven-hour window and the “up to / about 5,000 users” figure attributed to Cursor. Ars Technica noted Anthropic had not issued its own public customer warning at the time of that report.

What We Don't Know Yet

  • How the attacker obtained the ability to publish the tampered VSIX under the Anthropic.claude-code marketplace identity.
  • How many of the reported ~5,000 installs actually executed the payload, and how many hosts achieved a working reverse tunnel.
  • Whether any follow-on credential theft succeeded after the beacon of environment-variable names.
  • Why Cursor's current security notice omits the user-count figure that multiple outlets attributed to the company.

Sources