Cursor removes malicious Claude Code extension 2.1.313 that reached up to 5,000 users of its marketplace

1 hour ago

7 min read

Cursor has disclosed a security incident in its own VS Code extension marketplace: a tampered build of the Anthropic.claude-code extension, version 2.1.313, was available for download inside the Cursor editor for roughly eleven hours on October 29, 2026. In a security notice published the same day, Cursor said the malicious package "was not developed by Anthropic", that at most 5,000 users were affected, and that it would contact those users directly. The extension carried a payload designed to profile the developer's machine, plant an attacker-controlled SSH key, open a reverse SSH tunnel to an external server and make that tunnel survive reboots.

The window ran from about 2:27am to 1:35pm Pacific time on October 29, which corresponds to 09:27 to 20:35 UTC, or 10:27 to 21:35 in Central European Time. Anyone who installed or updated to Anthropic.claude-code 2.1.313 from the Cursor marketplace during that period falls within the scope Cursor defined. The company says it has no evidence that other versions of the extension, or Anthropic's official distribution of Claude Code, were affected, so the problem is confined to one version served through one channel rather than to Claude Code as a product.

The incident matters beyond its immediate numbers because the people who install an AI coding extension like Claude Code are, by definition, developers with access to source code, cloud credentials and production systems. A backdoor on a developer laptop is a direct route into everything that laptop can reach, which is why Cursor's guidance goes well beyond uninstalling the extension.

··········

WHAT THE MALICIOUS CLAUDE CODE BUILD DID ON INFECTED MACHINES.

According to Cursor's analysis, the payload worked in four stages. It first collected host and user information: hostname, username, operating system, CPU architecture, home directory, the names of environment variables, working directories, the Git email address configured on the machine and the public IP address. Cursor's notice refers to environment variable names, not values, which limits the immediate exposure of secrets stored in the environment, although the list of names alone tells an attacker which cloud providers, tokens and services a developer works with.

The second stage tried to give the attacker remote access. The extension attempted to append an attacker-controlled SSH public key to the user's authorized_keys file, enable the SSH server on the machine and open a reverse SSH tunnel to a server controlled by the attacker. A reverse tunnel is designed to bypass inbound firewall rules: instead of the attacker connecting to the laptop, the laptop connects out and exposes its local SSH port through the remote server. Cursor notes that enabling SSH and some of these steps would usually fail without administrator privileges, which means the outcome on a given machine depends heavily on how much privilege the developer's account had.

The third stage was persistence. On macOS the payload tried to install a LaunchAgent labelled com.apple.sysmond, a name chosen to resemble a legitimate Apple system service. On Windows it tried to create a scheduled task named SysMon, attempting to run it as SYSTEM, with a fallback script in the user's Startup folder. Background scripts retried the tunnel roughly every 60 seconds, so a single failed connection would not end the attempt.

The fourth stage reported back: the extension sent host details and the status of the backdoor installation to the attacker's server over HTTP on port 8099. Cursor says it worked with the hosting provider to take that server offline and that it no longer functions, which cuts off the reverse tunnel for machines where it had been established, but does not remove the planted key or persistence mechanisms that may still be present locally.

··········

HOW CURSOR RESPONDED AND WHAT IT HAS NOT DISCLOSED.

Cursor's notice describes a sequence of containment steps. The company removed the malicious version and blocked further distribution, then, in its own words, "followed with a full shut down of the VSCode Marketplace out of an abundance of caution." It audited access to the marketplace and reports that no other extensions were tampered with. It then rotated its keys, rebuilt the marketplace and brought it back online, and coordinated the takedown of the attacker infrastructure with the hosting provider.

The key rotation is the most informative detail in the response, because it suggests Cursor treated the signing or publishing pipeline of its marketplace as potentially exposed. The notice, however, does not explain how the malicious package came to be published under the Anthropic.claude-code identifier. It does not say whether a publisher account, an API token, a build system or the marketplace's own infrastructure was compromised, and it does not name a suspected actor. The notice also contains no statement from Anthropic beyond Cursor's own assertion that the malicious version was not developed by Anthropic. Until a root-cause analysis is published, the point of entry remains the main open question.

The figure of 5,000 users should also be read as an upper bound rather than a confirmed count of compromised machines. Cursor wrote that "at most" 5,000 users were affected, which most plausibly reflects the number of installations or updates of version 2.1.313 during the window. How many of those machines actually executed the payload, and on how many the SSH key or persistence was successfully installed, is not stated and will vary with each user's privileges and operating system.

··········

WHO IS AFFECTED AND WHAT CURSOR USERS SHOULD DO NOW.

The scope is narrow and well defined: users of the Cursor editor who installed or updated the Anthropic.claude-code extension to version 2.1.313 from the Cursor marketplace between 2:27am and 1:35pm PT on October 29, 2026. Users who obtained Claude Code through Anthropic's own distribution, or who stayed on another version of the extension, are outside the scope Cursor has described. Cursor published malicious package hashes for two builds, macOS on Apple silicon (darwin-arm64) and Windows on x64 (win32-x64); the notice does not mention Linux or Intel Mac builds.

Cursor's recommended response has five steps. Users should check whether the attacker's key, which carries the comment svc-telemetry, appears in their SSH authorized keys files; search endpoint, network and extension telemetry for the published indicators; isolate any host that shows execution of the payload or installation of the backdoor; remove the SSH key, the persistence mechanisms and the tunnel processes using the remediation scripts Cursor provides (remediate-macos.sh and remediate-windows.ps1); and rotate credentials and sessions that were reachable from an affected host, doing so from a trusted system. Cursor states explicitly that uninstalling the extension may not be enough and that a rebuild of the machine may be warranted.

On macOS, a check equivalent to the one Cursor published looks for the key comment in the user's authorized keys file:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted."

On Windows, Cursor's PowerShell check examines both the per-user file and the system-wide administrators file:

$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys"
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted." }

A negative result from this check is a useful first signal, but it is not proof that nothing ran: the host profiling and the beacon to the attacker's server could have succeeded even where the key installation failed for lack of privileges. For machines that had the extension installed during the window, rotating Git, cloud and package-registry credentials is the conservative course regardless of the check's outcome.

··········

INDICATORS OF COMPROMISE PUBLISHED BY CURSOR.

Cursor published a detailed list of indicators that security teams can feed into endpoint detection and network monitoring tools. The table below summarises the main ones, with network addresses kept in the defanged form Cursor used.

........

Indicator	Value
Malicious VSIX, darwin-arm64 (SHA-256)	432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62
Malicious VSIX, win32-x64 (SHA-256)	3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081
Attacker IP	134[.]209[.]82[.]225 (reverse SSH on TCP 22, beacon on port 8099)
Beacon	HTTP POST to 134[.]209[.]82[.]225:8099/beacon
Unauthorized SSH key	ssh-ed25519, comment svc-telemetry, SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk
Reverse-tunnel key fingerprint	SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ
macOS persistence	~/Library/LaunchAgents/com.apple.sysmond.plist
Windows persistence	Scheduled task SysMon; Startup folder sysmon.cmd

........

Cursor also listed file-system artifacts that are useful for hunting on individual machines. On macOS these include ~/.config/.smt, ~/.config/.smtk and temporary files named .stk_ followed by ten hexadecimal characters in the user's temporary directory. On Windows the equivalents are %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk and .stk_ files under %TEMP%.

At the process level, the indicators include reverse tunnels started with ssh -N -R '*:0:localhost:22' or autossh -M 0, SSH invocations with StrictHostKeyChecking=no and UserKnownHostsFile=/dev/null, the command systemsetup -setremotelogin on on macOS, and on Windows schtasks /create /tn SysMon together with Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0, the command that installs the OpenSSH server. Any of these appearing on a developer workstation around October 29 deserves investigation, since none is part of normal extension behaviour.

··········

THE INCIDENT IN THE CONTEXT OF AI DEVELOPER TOOL SUPPLY CHAINS.

The attack follows a pattern that has become familiar in the AI tooling ecosystem: rather than targeting the AI model or service, attackers target the distribution channel that developers trust to deliver the client software. Data Studios recently covered a comparable case in the Python ecosystem, where LiteLLM traced its malicious 1.107.0 release to a leaked master key, and a different class of exposure on the inference side, where Cloudflare disclosed a GLM-5.3 KV cache bug that leaked data across Workers AI customers. In each case the weak point was the infrastructure around the model rather than the model itself.

Editor marketplaces are a particularly sensitive link because extensions run with the full permissions of the user's editor process and, for AI coding assistants, are expected to read files, run commands and talk to remote services. That expected behaviour makes malicious network activity harder to spot. The choice of a popular, high-trust extension name such as Claude Code, and of persistence labels like com.apple.sysmond and SysMon that imitate operating system services, shows an attacker who understood both the audience and the camouflage.

Agent permission models offer limited protection against this kind of attack. Features such as GitHub Copilot's assisted permissions govern what an AI agent may do on a developer's behalf, but a tampered extension runs its own code outside the agent's approval loop, so the controls that matter here are package integrity, publisher verification and fast revocation in the marketplace itself.

··········

WHAT IS ESTABLISHED AND WHAT REMAINS UNCERTAIN.

The established facts come from Cursor's own notice: a malicious build of Anthropic.claude-code 2.1.313, not developed by Anthropic, was available in the Cursor VS Code extension marketplace for about eleven hours on October 29, 2026; at most 5,000 users installed or updated to it; the payload profiled hosts, attempted to install an SSH key and a persistent reverse tunnel, and reported to a server that has since been taken offline; and Cursor removed the package, temporarily shut down the marketplace, rotated its keys, rebuilt the marketplace and found no other tampered extensions.

Several important points remain undisclosed. Cursor has not said how the package was published, whether its marketplace infrastructure or a publisher credential was the entry point, how many machines actually executed the payload, or whether any affected organization has observed follow-on activity through the tunnels. Cursor's notice does not include a statement from Anthropic. For Cursor users who installed or updated the Claude Code extension on October 29, the practical answer does not depend on those details: check for the svc-telemetry key, hunt for the published indicators, and rotate credentials from a clean machine.

··········

·····

DATA STUDIOS

·····

datastudios.org