Cursor: Fake Version of Claude Code Extension Attempted to Install SSH Backdoor on Up to 5,000 Users
Cursor revealed that a modified version of the Claude Code extension (2.1.313), which was not developed by Anthropic, was offered in its extension marketplace on October 29 for approximately eleven hours. It attempted to add an attacker-controlled SSH key and establish a reverse tunnel. Up to 5,000 users are affected; Cursor has released verification and cleanup scripts.
Cursor disclosed on Friday, October 30, at 8:46 a.m. Paris time, a security incident in its code editor’s extension marketplace. A modified version of the Claude Code extension for VS Code, published under the name Anthropic.claude-code at version 2.1.313, was made available there during part of the day on October 29. It was not developed by Anthropic, Cursor clarified, and it attempted to install an SSH backdoor on developers’ machines. Up to 5,000 users are affected.
What the compromised extension did
According to the security advisory published by Cursor, the malicious version was available on October 29 between roughly 2:27 a.m. and 1:35 p.m. Pacific Time (10:27 a.m. to 9:35 p.m. Paris time). Once installed, it:
- collected machine information: hostname, username, OS, architecture, home directory, environment variable names, working directories, the email address configured in Git, and the public IP address;
- attempted to add an attacker-controlled SSH key to the
authorized_keysfile, enable the local SSH service, and open a reverse SSH tunnel back to an attacker-controlled server; - established persistence for this tunnel via a LaunchAgent on macOS or a scheduled task on Windows, using scripts that reattempted the connection approximately every 60 seconds;
- transmitted the harvested details and the backdoor’s status back to the attacker’s server.
Cursor qualified the severity on one point: enabling the SSH service requires administrator privileges, which the extension lacks on most macOS and Windows workstations. On those machines, this step fails, preventing the attacker from connecting through the tunnel. However, the key, persistence mechanisms, and data transmission are installed anyway, and merely uninstalling the extension is not enough, as it leaves standalone scripts behind. The attacker’s server has since been taken offline with the assistance of its hosting provider.
Cursor’s response
Cursor stated that it removed the version as soon as it was detected, then shut down its entire extension marketplace as a precaution. The company says it audited access logs without finding any other modified extensions, rotated its keys, and rebuilt and reopened the marketplace. It indicated that there is no evidence that other extension versions or the official Claude Code distribution were impacted, and it will contact affected users directly.
What to do if you use Cursor
Cursor is requesting that all customers update to version 2.1.314 of Claude Code for VS Code. Anyone who installed or updated the extension from Cursor’s marketplace during the October 29 window should check whether their machine is compromised: the advisory provides a command for macOS and Windows that checks authorized SSH keys for the attacker’s key (identified by the comment svc-telemetry). If present, Cursor recommends isolating the machine, running its cleanup scripts, considering a full system rebuild, and changing passwords, keys, and sessions accessible from the system using a different computer. Cursor’s security notice also details indicators of compromise (package hashes, files, processes) to assist security teams.
What remains unknown
Cursor has not explained how a modified version could be published to its marketplace under Anthropic’s developer name, nor how many machines actually received the attacker’s key: the 5,000 figure is an upper bound.
Our take
The attack targets the exact reason AI-assisted code editors are valuable: highly popular extensions, updated frequently, installed on workstations that hold access to codebases, secrets, and infrastructure. Cursor, like other editors derived from VS Code, operates its own extension marketplace, and that is where the chain of trust broke down—not at Anthropic. The incident response was swift and transparent (clear time window, detailed technical breakdown, verification command, scripts), and the requirement for administrator rights mitigated the damage. Yet the core question—how a package was able to impersonate Anthropic—remains unanswered. For engineering teams, it is a tangible reminder: a coding agent runs with the developer’s permissions, and its extension warrants the same scrutiny as any software dependency.
Sources
- Cursor (X) — Security incident announcement Primary source
- Cursor — Security notice: malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace Primary source
A primary source comes directly from the company, lab or organization concerned. A secondary source reports the information without being its author: we flag it as such. Spotted an error? See our corrections policy.
