The Claude Code Extension in Cursor's Marketplace Was a Backdoor for About 11 Hours. Uninstalling It May Not Be Enough.
Cursor's security notice says that from about 2:27 AM to 1:35 PM Pacific on October 29, tampered versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension for Windows and macOS were served from Cursor's VS Code Extension Marketplace. They were not built by Anthropic. The payload collected host and user details, appended an attacker SSH key labeled svc-telemetry, tried to open a reverse tunnel, and installed persistence that retries about every 60 seconds. Cursor says the tunnel mostly failed but the key, persistence, and beacon landed, and that uninstalling may not be sufficient. The notice now lists Linux indicators while its remediation scripts still target macOS and Windows. We read Cursor's notice and Microsoft's write-up.
By T.W. Ghost
For about eleven hours today, October 29, 2026, the Claude Code extension in Cursor's marketplace was malware. Cursor's security notice says that between roughly 2:27 AM and 1:35 PM Pacific, tampered versions 2.1.312 and 2.1.313 of Anthropic.claude-code for Windows and macOS were served from the Cursor VS Code Extension Marketplace. Anthropic did not build them. Cursor removed the versions, shut down and rebuilt the marketplace, rotated keys, and took the attacker's server offline. Microsoft Threat Intelligence confirmed on October 30 that the tampered extension was never on the VS Marketplace or npm.
What the payload did, per Cursor: collected hostname, username, OS, architecture, home path, environment-variable names, working directories, Git email, and public IP, and sent them to the attacker; appended an attacker SSH key labeled svc-telemetry to authorized keys; tried to enable SSH and open a reverse tunnel; and installed persistence, a LaunchAgent on macOS and a scheduled task running as SYSTEM with a Startup fallback on Windows, retrying about every 60 seconds. Cursor says the tunnel and login steps mostly failed because of errors in the malicious code and a lack of admin rights. The key, the persistence, and the host report did not fail. Cursor's own words: uninstalling the extension "may not be sufficient." We read the notice, including its October 30 indicator update, and Microsoft's analysis. Here is what held up.
The Incident
| Tampered Anthropic.claude-code in Cursor's marketplace | |
|---|---|
| Window | About 2:27 AM to 1:35 PM PT, October 29, 2026 |
| Versions | 2.1.312 and 2.1.313, Windows and macOS |
| Built by Anthropic | No (Cursor) |
| Collected | Hostname, username, OS, arch, home path, env-var names, working directories, Git email, public IP |
| Dropped | SSH key labeled svc-telemetry; persistence retrying about every 60 seconds |
| Attempted | Enable SSH; reverse tunnel; mostly failed (Cursor) |
| Attacker IP | 134.209.82.225 |
| Key fingerprint | SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk |
| Linux indicators | ~/.config/.smt, /tmp/.stk_*, an @reboot cron entry (notice's Oct 30 update) |
| Cursor's response | Versions removed; marketplace rebuilt; keys rotated; attacker server offline |
| Not implicated, per Cursor | Other marketplace extensions; Grok Bot |
| Not on VS Marketplace or npm | Confirmed by Microsoft |
| Root cause, entry path, install count | Not published |
"Mostly failed" is not "no impact." A reverse tunnel that errored out still left a stranger's SSH key in your authorized keys and a scheduled task that keeps trying. The notice says so; that is why uninstalling is not the fix.
The Linux gap is in Cursor's own document. The install window describes Windows and macOS builds. The indicators section, updated October 30, lists Linux paths and a cron entry. The remediation scripts are still written for macOS and Windows. A Linux host with those paths should be treated as compromised, with or without a script.
"Official" branding did not mean Anthropic-signed. The extension carried Anthropic's publisher name in a marketplace Cursor operates. The trust a user placed in that name was placed in Cursor's supply chain, which Cursor has now rebuilt and not yet explained.
Verified vs Unconfirmed: The Scorecard
| Claim | Verdict |
|---|---|
| Window, versions, platforms | Verified (Cursor notice) |
| Not developed by Anthropic; other extensions and Grok Bot not implicated | Verified as Cursor's statement |
| Collection, SSH key, tunnel attempt, persistence, 60-second retry | Verified (Cursor notice) |
| "Uninstalling the extension may not be sufficient" | Verified (Cursor, quoted) |
| Attacker IP and key fingerprint | Verified (Cursor indicators) |
| Linux indicators listed; remediation still macOS and Windows | Verified (Cursor notice, Oct 30 update) |
| Never on VS Marketplace or npm | Microsoft's statement (Oct 30 blog) |
| Root cause, how it entered the marketplace, install count | Unverified (not published) |
What To Do
If you updated Claude Code through Cursor's marketplace in that window, run Cursor's check and remediation scripts, then look for the svc-telemetry key, the listed hashes, and the Linux cron and config paths by hand.
Rotate credentials from a clean machine, because the host report included your environment-variable names and working directories, which tells an attacker what to ask for next.
The frontier is elsewhere: this is the third credential story of the month after the OpenCode Console breach and the Brotli CVE, and the first where the malware wore a lab's name. Our model comparison has the current standings on the models; the extension that runs them is a separate trust decision.
Sources
- Cursor: Claude Code extension security notice
- Microsoft Security Blog: inside the malicious Claude Code-branded Cursor extension with a persistent SSH backdoor
*Not sure which editor and extension chain you should trust with your keys? Take the free 2-minute quiz and get matched. Then read about the Cursor feature announced the week before that gives an agent your whole desktop: Cursor desktop control.*