SAN FRANCISCO — A tampered copy of Anthropic's Claude Code extension sat in Cursor's extension marketplace for about 11 hours on Wednesday, 29 October 2026, reaching as many as 5,000 developers before it was removed, in a supply-chain incident that has put the security of AI coding tools — and the marketplaces that distribute them — under fresh scrutiny.
The compromised versions, 2.1.312 and 2.1.313, were available from roughly 09:27 to 20:35 UTC (2:27 a.m. to 1:35 p.m. Pacific), according to Cursor. Users who installed or updated the extension from its marketplace during that window may have received the tampered build instead of the genuine one. Cursor says at most 5,000 users received it, and has urged anyone who installed it then to treat their machine as potentially compromised until remediation is complete.
What makes the incident especially serious is that simply uninstalling the extension does not undo the damage. Researchers found it quietly installed persistent access mechanisms — including an attacker-controlled SSH key and a reverse tunnel — designed to survive long after the extension was gone. A clean replacement, version 2.1.314, was published on 30 October, but affected developers must run dedicated cleanup scripts and rotate credentials from a clean machine.
Illustration: A code editor screen showing a security warning, symbolising the tampered extension — an artist's impression, not a screenshot of the actual software.
What Happened
Cursor, the AI-powered code editor made by Anysphere, distributes extensions through its own marketplace. On 29 October, a tampered copy of the official Claude Code extension — the tool connecting Anthropic's Claude assistant to a developer's coding environment — appeared there in place of the genuine article, and users who fetched versions 2.1.312 or 2.1.313 during the roughly 11-hour window received the modified build.
According to StepSecurity's 30 October analysis, the tampered build was near-identical to the official extension, except for a small loader hidden inside its main file, extension.js, making the package about 7 KB larger. That loader ran when the extension loaded and carried out malicious actions in the background, invisible to the developer.
StepSecurity reported that the loader collected host details — hostname, username, operating system and architecture, home folder, Git email address, public IP address, and the names of environment variables (though not their values) — and sent them to an external server at IP address 134.209.82.225. It then added an attacker-controlled SSH key, labelled "svc-telemetry", to the machine's authorised keys, and set up a persistent reverse SSH tunnel and startup persistence so access would survive reboots: a macOS LaunchAgent named com.apple.sysmond, a Windows scheduled task called SysMon with a sysmon.cmd script in the Startup folder, a cron entry, and hidden files under ~/.config/.smt.
Cursor removed the tampered versions, took its marketplace offline while it investigated, audited access, and reported finding no other tampered extensions. It also said it rotated keys and rebuilt the marketplace before bringing it back online. The clean version 2.1.314 was published on 30 October, with rollout across registries between about 00:12 and 01:20 UTC.
Anthropic has stressed that its own systems and official distribution channels were not compromised, and that it did not build, publish or host the tampered build. The compromise affected only Cursor's marketplace copy — developers who installed Claude Code from Anthropic's own channels were not affected.
On 31 October, Microsoft Threat Intelligence published an analysis confirming the SSH key and reverse-tunnel behaviour, with Defender XDR detections for the activity. Microsoft also confirmed the tampered packages were never in the Visual Studio Marketplace or on npm, narrowing exposure to Cursor's marketplace.
Background
The incident arrived during a confusing first day of reporting, and some early details have since been corrected. Initial reports suggested the tampered extension had appeared on Open VSX, the open extension registry, and affected only Apple-silicon Macs. Cursor later confirmed the compromised copy was in its own marketplace, not Open VSX, and that both macOS and Windows were affected. No CVE identifier has been assigned.
How the tampered build got into Cursor's marketplace is still not publicly confirmed. Neither Cursor nor Anthropic has, as of 31 October, publicly described the entry point, and this article does not speculate about it. The mechanism of the initial compromise remains an open question researchers and users will be watching closely.
The episode also fits a broader pattern security professionals have warned about for years: the software supply chain is only as strong as its weakest distribution point. Developers routinely install extensions and packages with broad access to their machines, source code and credentials, so a single compromised listing can reach thousands of highly privileged targets in hours.
Claude Code has become a widely used tool, letting developers delegate coding, debugging and refactoring tasks to Anthropic's Claude models from inside their editor or terminal, and Cursor has grown rapidly as an AI-first editor. That popularity is precisely what makes a tampered listing so dangerous: users trust the marketplace to vouch for what it distributes, and few inspect an extension's code before installing an update.
Illustration: A developer workstation linked by a network tunnel to a remote server, symbolising the SSH backdoor — an artist's impression, not a diagram of the actual attack.
Why It Matters
For developers who received the tampered build, the stakes are immediate. Because the malware planted persistence mechanisms outside the extension itself, deleting Claude Code leaves the backdoor in place. An attacker with the planted SSH key and reverse tunnel could, in principle, return later, explore the machine, or use credentials stored on it to reach company codebases and cloud infrastructure.
That is why Cursor's remediation guidance goes well beyond uninstalling. Affected users should run Cursor's published remediation scripts to remove the persistence mechanisms, and rotate credentials — including SSH keys, API tokens and cloud credentials — from a clean machine, not the compromised one, since rotating from the affected machine risks exposing the new credentials to the same backdoor. Any secrets present on an affected machine during the exposure window should be treated as potentially exposed.
More broadly, the incident is a warning for the whole developer-tools ecosystem. Marketplaces and registries are attractive targets precisely because they offer scale: compromise one listing and you reach thousands of machines at once. Each similar supply-chain incident has prompted the same debate about verification before a package reaches users — code signing, provenance checks, reproducible builds, and faster revocation when something goes wrong.
The incident also highlights the particular risks around AI coding assistants. These tools, by design, operate with deep access to a developer's environment: they read code, run commands and interact with repositories. That access is what makes them useful, but it also means a compromised AI coding extension is far more dangerous than a compromised theme. Organisations will increasingly need to treat AI coding extensions as privileged software, worthy of the same scrutiny as any other tool with access to production systems.
Finally, the episode underscores the value — and limits — of rapid disclosure. Cursor removed the tampered versions within hours, Anthropic clarified the scope quickly, and researchers published analysis within a day, helping limit exposure to at most 5,000 users. But the unanswered question of how the build entered the marketplace means the industry still lacks the lesson that would prevent a repeat.
Illustration: An extension marketplace storefront with a shield and check mark, symbolising verified extensions — an artist's impression, not a screenshot of any real marketplace.
What Happens Next
Affected users should act without delay:
- Check whether you are affected: If you installed or updated the Claude Code extension through Cursor's marketplace on 29 October 2026, check whether you received version 2.1.312 or 2.1.313. If so, assume exposure and follow Cursor's remediation guidance in full — uninstalling alone is not enough.
- Run the remediation scripts: Cursor has published scripts to remove the persistence mechanisms, including the planted SSH key, the LaunchAgent or scheduled task, the cron entry and hidden files. Run them, then verify the artefacts are gone.
- Rotate credentials from a clean machine: Change SSH keys, API tokens, cloud credentials and other secrets from the affected machine, using a device known to be clean, and review account activity for anything unfamiliar.
- Watch for Cursor's findings on the entry point: Cursor has not yet publicly confirmed how the tampered build entered its marketplace. Any further disclosure will shape how other marketplaces harden their publishing pipelines.
- Expect marketplace security changes: The incident is likely to renew pressure on marketplaces to strengthen signing, provenance and review, and on organisations to vet and pin the extensions their developers use.
For now, the key message is simple: if you received the tampered build, do not stop at uninstalling it. Clean the persistence, rotate the credentials, and only then consider the machine safe.
Sponsored: explore today's featured sponsored offers
FAQ
What happened to the Claude Code extension on Cursor?
On 29 October 2026, a tampered copy of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313, was available in Cursor's marketplace for about 11 hours, roughly 09:27 to 20:35 UTC. Cursor says at most 5,000 users received it, and it planted an SSH backdoor and persistent access on affected machines.
Was Anthropic itself hacked?
No, according to Anthropic. The company says its own systems and official channels were not compromised, and it did not build, publish or host the tampered build. Only Cursor's marketplace copy was affected.
Does uninstalling the extension remove the backdoor?
No. The tampered build installed persistence outside the extension, including an attacker SSH key labelled "svc-telemetry", a reverse SSH tunnel, and startup persistence on macOS and Windows. Affected users must run Cursor's remediation scripts and rotate credentials from a clean machine.
How do I know if I was affected?
You may be affected if you installed or updated the Claude Code extension through Cursor's marketplace on 29 October 2026 and received version 2.1.312 or 2.1.313. Check for artefacts named in Cursor's guidance — the "svc-telemetry" SSH key, the com.apple.sysmond LaunchAgent on macOS, or the SysMon task on Windows — and follow the remediation steps if you find them.
How did the tampered build get into Cursor's marketplace?
That is still not publicly confirmed. As of 31 October 2026, neither Cursor nor Anthropic has publicly described the entry point, and no CVE has been assigned. Early reports pointing to Open VSX and Apple-silicon Macs only were later corrected: Cursor confirmed its own marketplace was affected, on both macOS and Windows.
Sources
- Cursor, security notice on the tampered Claude Code extension, 29–30 October 2026.
- StepSecurity, analysis of the tampered Claude Code extension, 30 October 2026.
- Microsoft Threat Intelligence, analysis of the tampered Claude Code extension, 31 October 2026.
- Security advisory and explainer reporting on the Cursor marketplace incident, 30 October 2026.
- Security advisory and explainer reporting on remediation for affected Cursor users, 31 October 2026.
Comments
Post a Comment