Key Takeaways
- Tampered versions 2.1.312 and 2.1.313 of Anthropic's Claude Code extension were available in Cursor's VS Code extension marketplace for Windows and macOS between about 2:27 a.m. and 1:35 p.m. Pacific Time on October 29, 2026, according to Cursor.
- Cursor said the tampered Claude Code extension affected at most 5,000 users and tried to add an attacker's SSH key, open a reverse SSH tunnel, survive restarts, and send details about each computer to the attacker.
- Cursor said turning on SSH requires administrator rights that the tampered Claude Code extension lacks on most macOS and Windows computers, so on those computers the attacker could not have logged in through the tunnel.
- Cursor advises anyone who installed Claude Code extension version 2.1.312 or 2.1.313 from its marketplace to check for the attacker's SSH key, isolate affected computers, remove the backdoor, and rotate credentials, because uninstalling the extension may not be enough.
What happened
Cursor, a coding agent built on the open-source codebase of Microsoft's Visual Studio Code (VS Code) editor, said on October 29, 2026, that it had found tampered versions of Anthropic's Claude Code extension in its VS Code extension marketplace. The Cursor security notice says versions 2.1.312 and 2.1.313 for Windows and macOS were available between about 2:27 a.m. and 1:35 p.m. Pacific Time that day. Cursor said these versions were not developed by Anthropic.
The Claude Code extension brings Anthropic's AI coding assistance into VS Code and editors based on it, according to Anthropic's documentation. The tampered update was published under the extension's real identity, anthropic.claude-code, rather than as a separate fake extension, The Hacker News reported. Jenn Gile, co-founder of OpenSourceMalware, told The Hacker News that anyone with Claude Code set to update automatically could have received it.
Cursor first named only version 2.1.313 and added 2.1.312 in an update on October 30. Security firm Phorion published an analysis of the tampered extension on October 30.
What the tampered extension did
The hidden code runs as soon as the editor loads the extension, before the extension's normal code starts, so the user does not need to interact with it, Phorion and Help Net Security reported.
According to Cursor, the code tries to add an attacker-controlled key for Secure Shell (SSH), a standard tool for logging in to a computer remotely, and to turn on the computer's SSH service. It then tries to open a reverse SSH tunnel, an outbound connection the attacker can use to reach back into the computer. Background scripts retry the tunnel about every 60 seconds and are set up to survive restarts, Cursor said.
The extension also sends details about the computer to the attacker, including its hostname, username, operating system, home directory, configured Git email address, and public IP address, Cursor said. Help Net Security reported that it sends the names, but not the values, of up to 40 environment variables that look like keys, tokens, or passwords.
Cursor said turning on SSH requires administrator rights that the extension does not have on most macOS and Windows computers, so on those computers the attacker could not have logged in through the tunnel. Phorion found a bug that often makes the code skip the step that turns on SSH on Macs. Phorion CEO Calum Hall said the malware "is still a significant threat that installs persistence and beacons host reconnaissance back to the operator."
Who is affected
Cursor said the incident affected at most 5,000 users and that it will contact them directly, The Hacker News and Help Net Security reported. Cursor said it has no evidence that other versions of the extension or the official distribution were affected, and that other extensions from its marketplace are not affected.
Anthropic's documentation says the company submits the extension for publication to Microsoft's Visual Studio Marketplace and the Open VSX registry. The Hacker News reported that the tampered update was distributed only through Cursor's marketplace. Microsoft confirmed it was never published through the Visual Studio Marketplace or npm, and security firm Socket found no evidence it was available through Open VSX, according to The Hacker News.
Response and open questions
Cursor said it removed the tampered versions as soon as it detected them, blocked further distribution, and then shut down its whole marketplace as a precaution. It audited access, found no other tampered extensions, rotated its keys, rebuilt the marketplace, and brought it back online. Cursor also worked with the cloud provider hosting the attacker's server to take it offline, which stopped the tunnel and the data reports from working.
How the attacker managed to publish an extension under Anthropic's name on Cursor's marketplace, and what level of access the attacker obtained, remain unanswered, The Hacker News reported.
What organizations should do
Cursor advises anyone who installed or updated to version 2.1.312 or 2.1.313 from its marketplace on macOS or Windows during the October 29 window to run the check it published for the attacker's SSH key. It also advises searching endpoint, network, and extension installation records for the indicators in its notice, and isolating computers that show signs of the backdoor.
On affected computers, Cursor advises removing the attacker's SSH key, the startup entries, and the running tunnel processes, and assessing whether to rebuild the computer. Uninstalling the extension may not be enough, Cursor said, because the code leaves standalone scripts that keep running. Cursor published cleanup scripts for macOS and Windows.
Cursor also advises rotating credentials and sessions that affected computers could reach, using a trusted system. Microsoft urges organizations to find systems that installed or automatically updated to the tampered versions, preserve evidence, review endpoint records, and rotate credentials, The Hacker News reported. Cursor and Phorion published the indicators of compromise in their reports.