Tampered Claude Code extension reached Cursor's marketplace with SSH backdoor

On 29 October 2026, Cursor disclosed that tampered copies of the anthropic.claude-code extension, versions 2.1.312 and 2.1.313, had been served through its VS Code extension marketplace. They were available from about 2:27 am to 1:35 pm Pacific time that day. Cursor said Anthropic did not develop these versions.

Microsoft's security team published an analysis on 30 October. It says the added code ran as soon as the extension loaded. It collected host details, such as the user name and Git email, and the names of up to 40 environment variables that looked like secrets, though not their values. It then tried to add an attacker's SSH key labelled svc-telemetry to authorized_keys, open a reverse SSH tunnel, and set itself to restart with the computer.

Cursor says the SSH step likely failed on most machines, because it needs admin rights and the code had errors. Even so, the key and the startup items were still installed on some machines. Cursor removed the versions, briefly shut its marketplace, rotated its own keys, and had the attacker's server taken offline.

Microsoft says the package was not on the Visual Studio Marketplace or in the npm package, and Anthropic told Microsoft its systems were not compromised. Cursor's notice does not fully explain how the package got in, and it gives no user count. Help Net Security reported that it reached at most 5,000 users. Its report also shows a dispute over whether the Open VSX listing was affected, as the firm Phorion first said.

Why it matters

The attacker did not need to fool anyone with a look-alike name. The listing and publisher were the ones people already trusted, and auto-update could deliver the change. Checking the publisher name would not have helped.

Coding tools are an attractive target because they run with your user rights on machines that hold keys and source code.

What you can do

• If you use Cursor, check whether you had version 2.1.312 or 2.1.313 installed from its marketplace on 29 October.
• Look in ~/.ssh/authorized_keys for an entry labelled svc-telemetry. Cursor's notice lists the Windows locations.
• Check Cursor's list of indicators, including startup items. Microsoft advises saving evidence before you clean up.
• Do not rely on uninstalling the extension, because that may not remove the backdoor.
• If you find anything, isolate the machine, read and then run Cursor's cleanup script, and rotate credentials from a separate trusted computer.
• For teams, limit extensions to approved publishers and wait a set time before accepting new versions.

Sources

• Cursor: Claude Code extension security notice
• Microsoft Security: inside the malicious extension
• Help Net Security: Claude Code extension poisoned

Source: Cursor